Firewall Compressor: An Algorithm for Minimizing Firewall Policies

Transcription

1 Firewall Compressor: An Algorithm for Minimizing Firewall Policies Alex Liu, Eric Torng, Chad Meiners Department of Computer Science Michigan State University

2 Introduction Internet Software Based ACL ` Packet TCP Rule SIP DIP S Port D Port Protocol Action / * * discard / * * discard / * 0 * discard / * * discard / [0,65535] [0,65535] TCP accept 6 * * * * * discard 2/20

3 Firewall Minimization Problem Given a firewall f1 as a sequence of rules Generate smallest equivalent firewall f2 r accept r discard r discard r accept r discard r discard r discard r discard Firewall Compressor r discard r accept r discard Rule order will change (r 1 is a discard) Rules will be merged (r 1 -r 4 => r 1 -r 2 ) 3/20

4 Motivation Improve performance by reducing per-packet delay Use cheaper hardware NetScreen-100 has a hard limit of 733 rules r accept r discard r discard r accept r discard r discard r discard r discard Firewall Compressor r discard r accept r discard 4/20

5 Solution Solve Firewall minimization problem for single field firewalls Optimal solution Generalize single field solution to multiple field firewalls Greedy non-optimal solution Related Work TCAM Based Solution TCAM Razor [ICNP 2007] Dong et. al. [SIGMETRICS 2006] Faster software classifiers Trade memory for speed Require specific classification algorithm 5/20

6 Single Field Firewalls decompose rescheduling (A) (B) (C) A. Our input is a series of intervals rules Each color is a decision B. Decompose rules into atomic intervals Rules can be any order now C. Reschedule intervals to merge them effectively Last rule is always the entire interval 6/20

7 Key Observation Possible Last Rules We can safely assume that the leftmost (or rightmost) interval is part of the last rule in an optimal rule list 7/20

8 Problem Decomposition We find a minimal list by discovering where the leftmost interval is paid for in the sub-solution(s) We have two cases to consider This can be done in polynomial time with DP Decisions can be weighted 8/20

9 Case 1 Leftmost interval is the only interval that is uniquely covered by the last rule The minimal rule list is the size of the of the minimal sub-solution plus the leftmost interval 9/20

10 Case 2 Leftmost interval is not the only interval that is uniquely covered by the last rule We need to find the sub-solution that cost shares with the leftmost interval We extend the correct sub-solution to cost share 10/20

11 From Single to Multiple Dimensions Break the problem into sub problems Decompose into 1-D problems Firewall Decision Diagrams Provides Decomposition hierarchy F 1 v v 2 v F 2 F a d d 11/20

12 Multi-Field Minimization Work from the bottom up Expand rules as we go r v discard r v accept v 2 r v discard v 3 r discard v 3 F r accept r discard r discard v 2 v F 2 F v a d d 12/20

13 Redundancy Removal We apply redundancy removal to finish r discard r accept r discard r discard r discard r accept r discard 13/20

14 Experimental Results Real-life Packet Classifiers 17 structurally distinct classifiers 42 actual classifiers A few rules to hundreds of rules Synthetic Packet Classifiers Test scalability Randomly generated set of field ranges Cross product of sets 14/20

15 Experimental Metrics For a set of classifiers S Average Compression ratio over S f S (FC(f)/ f ) / S Total Compression ratio over S f S (FC(f)) / f S ( f ) FC(f) is the number of rule produced by running firewall compression on f 15/20

16 Experimental Factors Field Ordering FDD field order results in a substantial difference 5! = 120 permutations Fortunately there are good permutations F 1 v v 2 v F 2 F a d d 16/20

17 Results for Real Classifiers For most classifiers FC has significant compression FDD ordering is DIP, SIP, DP, SP, Protocol 17/20

18 Compression Ratio Distribution Real Classifiers Average compression 52.3% Total Compression 69.4% Synthetic Classifiers Average Compression 32.2% Total Compression 7.4% 18/20

19 Concluding Remarks Firewall Compressor is not optimal Better algorithms are future work Firewall Compression can result in a significant reduction in policy size Average 47.7% reduction in policy rules No hardware modification Can be used to improve existing hardware 19/20

20 Questions? Thank you for your attention 20/20