A novel three-tiered visualization approach for firewall rule validation

NCUIR > College of Electrical Engineering & Computer Science > Department of Computer Science and information Engineering > journal & Dissertation > Item 987654321/51604

Please use this identifier to cite or link to this item: http://ir.lib.ncu.edu.tw/handle/987654321/51604

Title:	A novel three-tiered visualization approach for firewall rule validation
Authors:	Chao,CS;Yang,SJH
Contributors:	資訊工程學系
Keywords:	MANAGEMENT TOOLKIT;POLICIES;FIRMATO
Date:	2011
Issue Date:	2012-03-27 18:57:15 (UTC+8)
Publisher:	國立中央大學
Abstract:	Firewall is one of the most critical elements of the current Internet, which can protect the entire network against attacks and threats. While configuring the firewalls, rule configuration has to conform to, or say be consistent with, the demands of the network security policies such that the network security would not be flawed. For the security consistency, firewall rule editing, ordering, and distribution must be done very carefully on each of the cooperative firewalls, especially in a large-scale and multifirewall-equipped network. Nevertheless, a network operator is prone to incorrectly configure the firewalls because there are typically thousands or hundreds of filtering/admission rules (i.e., rules in the Access Control List file, or ACL for short), which could be set up in a firewall; not mentioning these rules among firewalls affect mutually and can make the matter worse. Under this situation, the network operator would hardly know his/her misconfiguration until the network functions beyond the expectation. For this reason, our work is to build a visualized validation system for facilitating the check of security consistency between the rule configuration of firewalls and the demands of network security policies. To do so, the developed validation system utilizes a three-tiered visualization hierarchy along with different compound viewpoints to provide users with a complete picture of firewalls and relationships among them for error debugging and anomaly removal. In addition, in this paper, we also enumerate the source of security inconsistency while setting ACLs and make use of it as a basis of the design of our visualization model. Currently, part of the firewall configuration of our campus network has been used as our system's input to demonstrate our system's implementation. (C) 2011 Elsevier Ltd. All rights reserved.
Relation:	JOURNAL OF VISUAL LANGUAGES AND COMPUTING
Appears in Collections:	[Department of Computer Science and information Engineering] journal & Dissertation

Files in This Item:

File	Description	Size	Format
index.html		0Kb	HTML	503	View/Open

社群 sharing

Loading...