Firewall Design: Consistency, Completeness, Compactness

Transcription

1 Firewall Design: Consistency, Completeness, Compactness Alex X. Liu Department of Computer Sciences The University of Texas at Austin Austin, Texas , U.S.A. March, 2004 Co-author: Mohamed G. Gouda Alex X. Liu Firewall Design p.1

2 C IS CO S YS TE MS Firewall Basics Firewall Rest of Internet Private Network Firewall is a sequence of rules that allow packets that go through it to be accepted (and so proceed) or discarded. Alex X. Liu Firewall Design p.2

3 CI SC OS YS TE M S Firewall Example Malicious Host (IP: m) Mail Server (IP: s) Host (IP: h) Internet 0 1 r 0 : I = 0 S = any D = s P = tcp T = 25 a r 1 : I = 0 S = any D = s P = any T = any d r 2 : I = 0 S = m D = any P = any T = any d r 3 : I = 1 S = h D = any P = any T = any a r 4 : I = 1 S = any D = any P = any T = any a Alex X. Liu Firewall Design p.3

4 Three Firewall Design Problems Inconsistency Incompleteness Incompactness Alex X. Liu Firewall Design p.4

5 Inconsistency Problem r 0 : I = 0 S = any D = s P = tcp T = 25 a r 1 : I = 0 S = any D = s P = any T = any d r 2 : I = 0 S = m D = any P = any T = any d r 3 : I = 1 S = h D = any P = any T = any a r 4 : I = 1 S = any D = any P = any T = any a This firewall accepts all incoming SMTP packets even those originated at the malicious host m Solution: placing rule r 2 at the beginning of the the sequence of rules ahead of rule r 1 Alex X. Liu Firewall Design p.5

6 Incompleteness Problem r 0 : I = 0 S = m D = any P = any T = any d r 1 : I = 0 S = any D = s P = tcp T = 25 a r 2 : I = 0 S = any D = s P = any T = any d r 3 : I = 1 S = h D = any P = any T = any a r 4 : I = 1 S = any D = any P = any T = any a Any packet where I = 0, S m, and D s does not satisfy the predicate of any of the five rules r 0 through r 4. Solution: add the following rule immediately before rule r 3 I = 0 S = any D = any P = any T = any a Alex X. Liu Firewall Design p.6

7 Incompactness Problem r 0 : I = 0 S = m D = any P = any T = any d r 1 : I = 0 S = any D = s P = tcp T = 25 a r 2 : I = 0 S = any D = s P = any T = any d r 3 : I = 0 S = any D = any P = any T = any a r 4 : I = 1 S = h D = any P = any T = any a r 5 : I = 1 S = any D = any P = any T = any a Rule r 4 can be removed without affecting the set of packets accepted by the firewall and the set of packets discarded by the firewall. Solution: remove rule r 4 Alex X. Liu Firewall Design p.7

8 How to design a consistent, complete, and compact firewall? Start with a Firewall Decision Diagram (FDD) Apply 5 algorithms to the FDD reduction marking generation compaction simplification Alex X. Liu Firewall Design p.8

9 Firewall Decision Diagram [4,5] [6,7] F 0 [0,3] [2,3] [0,1] [2,3] PSfrag replacements[5,7] [4,4] [5,7] a d a [0,1] [4,4] d [0,4] [5,9] d d Consistency: for any two outgoing edges of a node, their labels are non-overlapping Completeness: the union of the labels of all the outgoing edges of a node is the domain of the label of the node Alex X. Liu Firewall Design p.9

10 Rules from FDD Each complete path in FDD can be represented by one rule For example: [4,5] [6,7] F 0 [0,3] [2,3] [0,1] [2,3] PSfrag replacements[5,7] [4,4] [5,7] a d a [0,1] [4,4] d [0,4] [5,9] d d F 0 [4, 7] [2, 3] [5, 7] a the number of rules = the number of decision paths Alex X. Liu Firewall Design p.10

11 FDD Reduction Collapse parallel edges into one edge Collapse isomorphic nodes into one node [4,5] [6,7] F 0 [0,3] [2,3] [0,1] [2,3] PSfrag replacements[5,7] [4,4] [5,7] a d a [0,1] [4,4] d [0,4] [5,9] d d [2,3] PSfrag replacements [5,7] F 0 [4,7] [0,3] [0,1] [4,4] a d Alex X. Liu Firewall Design p.11

12 FDD Marking Choose one outgoing edge to mark ALL [4,7] F [0,3] [4,7] F [0,3] ALL Alex X. Liu Firewall Design p.12

13 FDD Marking Algorithm For each node in FDD, choose one outgoing edge to mark ALL [2,3] PSfrag replacements [5,7] F 0 [4,7] [0,3] [0,1] [4,4] a d [2,3] PSfrag replacements [5,7] a F 0 [4,7] [0,3] [0,1] [4,4] ALL ALL d Alex X. Liu Firewall Design p.13

14 Firewall Generation Generate one rule for each complete path Use the mark ALL, instead of the specified set Order the rules properly [2,3] PSfrag replacements [5,7] a F 0 [4,7] [0,3] [0,1] [4,4] ALL ALL d r = ( F 0 [4, 7] [2, 3] [5, 7] a, F 0 [4, 7] ALL d, F 0 ALL [0, 9] d, ) Alex X. Liu Firewall Design p.14

15 Firewall Compaction A rule is redundant in a firewall iff the rule can be removed without affecting the semantics of the firewall. Theorem: A rule r i in firewall (r 0,, r m 1 ) is redundant iff for each j, i < j m 1, at least one of the following two conditions holds: 1. decision of r j = decision of r i. 2. No packet over the fields F 0,, F n 1 satisfies the predicate r i.op ( r i+1.ep r j 1.ep) r j.ep where r i.op denotes the original predicate of r i and r j.ep denotes the exhibited predicate of r j. Firewall compaction algorithm is in paper Alex X. Liu Firewall Design p.15

16 Firewall Compaction Example r = ( F 0 [4, 7] [2, 3] [5, 7] a, F 0 [4, 7] ALL d, F 0 ALL [0, 9] d, ) The second rule is redundant. r = ( F 0 [4, 7] [2, 3] [5, 7] a, F 0 ALL [0, 9] d, ) Alex X. Liu Firewall Design p.16

17 Firewall Simplification A firewall rule of the form F 0 S 0 F n 1 S n 1 decision is called simple iff every S i in the rule is either the ALL mark or a single interval. r = ( F 0 [4, 7] [2, 3] [5, 7] a, F 0 ALL [0, 9] d, ) r = ( F 0 [4, 7] [2, 3] a, F 0 [4, 7] [5, 7] d, F 0 ALL [0, 9] d, ) Alex X. Liu Firewall Design p.17

18 Summary of Firewall Design PSfrag replacements A user specified FDD f Algorithm 1 A reduced FDD f Algorithm 2 A marked FDD f Algorithm 3 A generated firewall r Algorithm 4 A compact firewall r Algorithm 5 Algorithm 6 A simple firewall r Alex X. Liu Firewall Design p.18