Limitation of listed-rule firewall and the design of tree-rule firewall

Thawatchai Chomsiri; Xiangjian He; Priyadarsi Nanda

doi:10.1007/978-3-642-34883-9_22

Limitation of listed-rule firewall and the design of tree-rule firewall

Thawatchai Chomsiri
, Xiangjian He
, Priyadarsi Nanda

Research output: Chapter in Book/Conference proceeding › Conference contribution › peer-review

7 Citations (Scopus)

Abstract

This research will illustrate that firewalls today (Listed-Rule Firewall) have five important limitations which may lead to security problem, speed problem, and "difficult to use" problem. These limitations consist of, firstly, limitation about "Shadowed rules" (the rule that cannot match with any packet because a packet will be matched with other rules above) which can lead to security and speed problem. Secondly, limitation about swapping position between rules can bring a change in firewall policy and cause security problem. The third limitation is about "Redundant rules" which can cause speed problem. Next, limitation of rule design; firewall administrators have to put "Bigger Rules" only at the bottom or lower positions that can result in a "difficult to use" problem. Lastly, limitation from sequential computation can lead to speed problem. Moreover, we also propose design of the new firewall named "Tree-Rule Firewall" which does not have above limitations.

Original language	English
Title of host publication	Internet and Distributed Computing Systems - 5th International Conference, IDCS 2012, Proceedings
Editors	Yang Xiang, Mukaddim Pathan, Xiaohui Tao, Hua Wang
Publisher	Springer Verlag
Pages	275-287
Number of pages	13
ISBN (Print)	9783642348822
DOIs	https://doi.org/10.1007/978-3-642-34883-9_22
Publication status	Published - 2012
Externally published	Yes
Event	5th International Conference on Internet and Distributed Computing Systems, IDCS 2012 - Wuyishan, China Duration: 21 Nov 2012 → 23 Nov 2012

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	7646 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	5th International Conference on Internet and Distributed Computing Systems, IDCS 2012
Country/Territory	China
City	Wuyishan
Period	21/11/12 → 23/11/12

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 15 Life on Land

Free Keywords

Firewall
Network security
Rule conflict
Rule list
Tree rule

ASJC Scopus subject areas

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-642-34883-9_22

Cite this

Chomsiri, T., He, X., & Nanda, P. (2012). Limitation of listed-rule firewall and the design of tree-rule firewall. In Y. Xiang, M. Pathan, X. Tao, & H. Wang (Eds.), Internet and Distributed Computing Systems - 5th International Conference, IDCS 2012, Proceedings (pp. 275-287). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 7646 LNCS). Springer Verlag. https://doi.org/10.1007/978-3-642-34883-9_22

Chomsiri, Thawatchai ; He, Xiangjian ; Nanda, Priyadarsi. / Limitation of listed-rule firewall and the design of tree-rule firewall. Internet and Distributed Computing Systems - 5th International Conference, IDCS 2012, Proceedings. editor / Yang Xiang ; Mukaddim Pathan ; Xiaohui Tao ; Hua Wang. Springer Verlag, 2012. pp. 275-287 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{c94ddf6850cd414081e0ce23a148b339,

title = "Limitation of listed-rule firewall and the design of tree-rule firewall",

abstract = "This research will illustrate that firewalls today (Listed-Rule Firewall) have five important limitations which may lead to security problem, speed problem, and {"}difficult to use{"} problem. These limitations consist of, firstly, limitation about {"}Shadowed rules{"} (the rule that cannot match with any packet because a packet will be matched with other rules above) which can lead to security and speed problem. Secondly, limitation about swapping position between rules can bring a change in firewall policy and cause security problem. The third limitation is about {"}Redundant rules{"} which can cause speed problem. Next, limitation of rule design; firewall administrators have to put {"}Bigger Rules{"} only at the bottom or lower positions that can result in a {"}difficult to use{"} problem. Lastly, limitation from sequential computation can lead to speed problem. Moreover, we also propose design of the new firewall named {"}Tree-Rule Firewall{"} which does not have above limitations.",

keywords = "Firewall, Network security, Rule conflict, Rule list, Tree rule",

author = "Thawatchai Chomsiri and Xiangjian He and Priyadarsi Nanda",

note = "Publisher Copyright: {\textcopyright} Springer-Verlag Berlin Heidelberg 2012.; 5th International Conference on Internet and Distributed Computing Systems, IDCS 2012 ; Conference date: 21-11-2012 Through 23-11-2012",

year = "2012",

doi = "10.1007/978-3-642-34883-9\_22",

language = "English",

isbn = "9783642348822",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

pages = "275--287",

editor = "Yang Xiang and Mukaddim Pathan and Xiaohui Tao and Hua Wang",

booktitle = "Internet and Distributed Computing Systems - 5th International Conference, IDCS 2012, Proceedings",

address = "Germany",

}

Chomsiri, T, He, X & Nanda, P 2012, Limitation of listed-rule firewall and the design of tree-rule firewall. in Y Xiang, M Pathan, X Tao & H Wang (eds), Internet and Distributed Computing Systems - 5th International Conference, IDCS 2012, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 7646 LNCS, Springer Verlag, pp. 275-287, 5th International Conference on Internet and Distributed Computing Systems, IDCS 2012, Wuyishan, China, 21/11/12. https://doi.org/10.1007/978-3-642-34883-9_22

Limitation of listed-rule firewall and the design of tree-rule firewall. / Chomsiri, Thawatchai; He, Xiangjian; Nanda, Priyadarsi.
Internet and Distributed Computing Systems - 5th International Conference, IDCS 2012, Proceedings. ed. / Yang Xiang; Mukaddim Pathan; Xiaohui Tao; Hua Wang. Springer Verlag, 2012. p. 275-287 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 7646 LNCS).

Research output: Chapter in Book/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Limitation of listed-rule firewall and the design of tree-rule firewall

AU - Chomsiri, Thawatchai

AU - He, Xiangjian

AU - Nanda, Priyadarsi

N1 - Publisher Copyright: © Springer-Verlag Berlin Heidelberg 2012.

PY - 2012

Y1 - 2012

N2 - This research will illustrate that firewalls today (Listed-Rule Firewall) have five important limitations which may lead to security problem, speed problem, and "difficult to use" problem. These limitations consist of, firstly, limitation about "Shadowed rules" (the rule that cannot match with any packet because a packet will be matched with other rules above) which can lead to security and speed problem. Secondly, limitation about swapping position between rules can bring a change in firewall policy and cause security problem. The third limitation is about "Redundant rules" which can cause speed problem. Next, limitation of rule design; firewall administrators have to put "Bigger Rules" only at the bottom or lower positions that can result in a "difficult to use" problem. Lastly, limitation from sequential computation can lead to speed problem. Moreover, we also propose design of the new firewall named "Tree-Rule Firewall" which does not have above limitations.

AB - This research will illustrate that firewalls today (Listed-Rule Firewall) have five important limitations which may lead to security problem, speed problem, and "difficult to use" problem. These limitations consist of, firstly, limitation about "Shadowed rules" (the rule that cannot match with any packet because a packet will be matched with other rules above) which can lead to security and speed problem. Secondly, limitation about swapping position between rules can bring a change in firewall policy and cause security problem. The third limitation is about "Redundant rules" which can cause speed problem. Next, limitation of rule design; firewall administrators have to put "Bigger Rules" only at the bottom or lower positions that can result in a "difficult to use" problem. Lastly, limitation from sequential computation can lead to speed problem. Moreover, we also propose design of the new firewall named "Tree-Rule Firewall" which does not have above limitations.

KW - Firewall

KW - Network security

KW - Rule conflict

KW - Rule list

KW - Tree rule

UR - https://www.scopus.com/pages/publications/85015206921

U2 - 10.1007/978-3-642-34883-9_22

DO - 10.1007/978-3-642-34883-9_22

M3 - Conference contribution

AN - SCOPUS:85015206921

SN - 9783642348822

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 275

EP - 287

BT - Internet and Distributed Computing Systems - 5th International Conference, IDCS 2012, Proceedings

A2 - Xiang, Yang

A2 - Pathan, Mukaddim

A2 - Tao, Xiaohui

A2 - Wang, Hua

PB - Springer Verlag

T2 - 5th International Conference on Internet and Distributed Computing Systems, IDCS 2012

Y2 - 21 November 2012 through 23 November 2012

ER -

Chomsiri T, He X, Nanda P. Limitation of listed-rule firewall and the design of tree-rule firewall. In Xiang Y, Pathan M, Tao X, Wang H, editors, Internet and Distributed Computing Systems - 5th International Conference, IDCS 2012, Proceedings. Springer Verlag. 2012. p. 275-287. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-642-34883-9_22

Limitation of listed-rule firewall and the design of tree-rule firewall

Abstract

Publication series

Conference

UN SDGs

Free Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this