Biforch: A system Improving Firewall Orchestration, Reverse proxy Configuration, and Harmonization

NCUIR > College of Electrical Engineering & Computer Science > Graduate Institute of Computer Science and Information Engineering > Electronic Thesis & Dissertation > Item 987654321/98247

Please use this identifier to cite or link to this item: https://ir.lib.ncu.edu.tw/handle/987654321/98247

Title:	Biforch: A system Improving Firewall Orchestration, Reverse proxy Configuration, and Harmonization
Authors:	張哲庭;Chang, Che-Ting
Contributors:	資訊工程學系
Keywords:	防火牆;反向代理;Firewall;Reverse Proxy;Biforch
Date:	2025-07-16
Issue Date:	2025-10-17 12:32:30 (UTC+8)
Publisher:	國立中央大學
Abstract:	隨著雲原生技術與微服務架構普及，企業日益依賴反向代理（Layer 7）作為統一入口。然而，當希望以服務為最小單位規劃防護時，存取規則被迫分散於兩層設備，配置複雜度的上升同時也造成資安風險。本文提出Biforch框架，以「Service-as-Alias」模式將服務抽象為防火牆Alias，集中在單一防火牆入口定義存取策略，並將相關規則轉譯與同步至反向代理。Core-Agent抽象具備廠商中立性，得以支援 FortiGate、OPNsense 等多品牌防火牆以及主流反向代理軟體。在1.4 GHz、1 vCPU環境之測試顯示，Biforch在多條規則的同步壓力下仍然可低負載運行。同時在理論分析中，Biforch的配置步驟優於手動配置步驟，且規則集中於單一位置、以語意化Alias呈現，可讀性大幅提升。研究證實 Biforch 能在不變更既有拓撲的前提下，低成本地協調 L3/L4與L7存取控制，減少人為配置風險，為中小型組織邁向零信任與微分段提供一條「最小侵入」之可行途徑。 ;With the growing adoption of cloud-native technologies and microservice architectures, enterprises increasingly rely on Layer-7 reverse proxies as a single entry point. When security policies must be defined at the service level, however, access rules become fragmented across two tiers of equipment, driving up configuration complexity and, consequently, security risk. This paper presents Biforch, a framework that introduces a Service-as-Alias model: each service is abstracted as a firewall alias, so access policies can be defined once—at a single firewall interface—then translated and synchronized to every reverse proxy. Thanks to its vendor-neutral Core–Agent design, Biforch supports multiple firewall brands (e.g., FortiGate, OPNsense) as well as mainstream reverse-proxy software. Stress tests on a modest 1.4 GHz, 1-vCPU platform show that Biforch remains lightweight even when synchronizing hundreds of rules. Theoretical analysis further demonstrates that Biforch requires fewer configuration steps than manual workflows, while concentrating rules in one place and expressing them through semantic aliases that greatly improve readability. Overall, the study confirms that Biforch can coordinate L3/L4 and L7 access control at low cost—without changing existing network topologies—significantly reducing human-error risk. It therefore offers small- and medium-sized organizations a minimal-intrusion path toward zero-trust security and fine-grained micro-segmentation.
Appears in Collections:	[Graduate Institute of Computer Science and Information Engineering] Electronic Thesis & Dissertation

Files in This Item:

File	Description	Size	Format
index.html		0Kb	HTML	18	View/Open

社群 sharing

Loading...