A stateful mechanism for the tree-rule firewall

Thawatchai Chomsiri, Xiangjian He, Priyadarsi Nanda, Zhiyuan Tan

Research output: Chapter in Book/Conference proceedingConference contributionpeer-review

10 Citations (Scopus)

Abstract

In this paper, we propose a novel connection tracking mechanism for Tree-rule firewall which essentially organizes firewall rules in a designated Tree structure. A new firewall model based on the proposed connection tracking mechanism is then developed and extended from the basic model of Net filter's Conn Track module, which has been used by many early generation commercial and open source firewalls including IPTABLES, the most popular firewall. To reduce the consumption of memory space and processing time, our proposed model uses one node per connection instead of using two nodes as appeared in Net filter model. This can reduce memory space and processing time. In addition, we introduce an extended hash table with more hashing bits in our firewall model in order to accommodate more concurrent connections. Moreover, our model also applies sophisticated techniques (such as using static information nodes, and avoiding timer objects and memory management tasks) to improve its processing speed. Finally, we implement this model on Linux Cent OS 6.3 and evaluate its speed. The experimental results show that our model performs more efficiently in comparison with the Net filter/IPTABLES.

Original languageEnglish
Title of host publicationProceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages122-129
Number of pages8
ISBN (Electronic)9781479965137
DOIs
Publication statusPublished - 15 Jan 2015
Externally publishedYes
Event13th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014 - Beijing, China
Duration: 24 Sep 201426 Sep 2014

Publication series

NameProceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014

Conference

Conference13th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014
Country/TerritoryChina
CityBeijing
Period24/09/1426/09/14

Keywords

  • Connection tracking
  • Firewall
  • Network security
  • Stateful firewall
  • Tree-rule firewall

ASJC Scopus subject areas

  • Computer Science Applications
  • Safety, Risk, Reliability and Quality
  • Computer Networks and Communications

Fingerprint

Dive into the research topics of 'A stateful mechanism for the tree-rule firewall'. Together they form a unique fingerprint.

Cite this