1 Diverse Firewall Design Alex X. Liu The University of Texas at Austin, U.S.A. July 1, 2004 Co-author: Mohamed G. Gouda

2 Alex X. LiuThe University of Texas at Austin Firewall  It is a sequence of rules to decide to accept or discard any packet.  Example: packet(F1, F2)  Firewall Design is error-prone.

3 Alex X. LiuThe University of Texas at Austin How to reduce firewall design errors?  Solution: Diverse Firewall Design  Motived by N-version programming (Avizienis 1977) and back-to-back testing (Vouk 1988)  Differ from N-version programming: only one version deployed  Differ from back-to-back testing: all discrepancies discovered

4 Alex X. LiuThe University of Texas at Austin Diverse Firewall Design  Design phase: Same specification given to multiple teams to design firewalls  Comparison phase: Compare multiple firewalls to discover all discrepancies

5 Alex X. LiuThe University of Texas at Austin How to compare two firewalls?  Step 1: construct an equivalent ordered FDD for each firewall  Step 2: make two ordered FDDs semi-isomorphic  Step 3: compare two semi-isomorphic FDDs for discrepancies

6 Alex X. LiuThe University of Texas at Austin Firewall Decision Diagram (FDD)  Consistency: labels of any two siblings are non-overlapping  Completeness: union of labels of all siblings is the domain of the field F1F1 F2F2 F2F2 ad ad [31,100] [1,30] [41,100] [1,40] [21,100] [1,20]

7 Alex X. LiuThe University of Texas at Austin Step 1  Construct an equivalent ordered FDD for each firewall  (An FDD is ordered if the labels along every path in the FDD are consistent with the same total order.)

8 Alex X. LiuThe University of Texas at Austin Applying Step 1 F1F1 F2F2 F2F2 ad ad [31,100] [1,30] [1,40] [21,100] [1,20] F1F1 F2F2 a [1,30] [1,20] F1F1 F2F2 ad [1,30] [21,100] [1,20] F1F1 F2F2 F2F2 ad a [31,100] [1,30] [1,40] [21,100] [1,20][41,100] (1) (2) (4)(3)

9 Alex X. LiuThe University of Texas at Austin Step 2  Make two ordered FDDs semi-isomorphic  Semi-isomorphic FDDs: exactly same except labels of terminal nodes  Example: make these FDDs semi-isomorphic F1F1 F2F2 ad d [51,100] [1,50] [61,100] [1,60] F1F1 F2F2 F2F2 ad ad [31,100] [1,30] [41,100][1,40][21,100] [1,20]

10 Alex X. LiuThe University of Texas at Austin Applying Step 2: F1F1 F2F2 F2F2 ad ad [31,100] [1,30] [1,40] [21,100] [1,20] F1F1 F2F2 ad d [51,100] [1,50] [61,100] [1,60] [41,100] F1F1 F2F2 F2F2 ad ad [51,100] [1,30] [1,40] [21,100] [1,20][41,100] F2F2 ad [1,40] [31,50] F1F1 F2F2 ad d [51,100] [1,30] [61,100] [1,60] F2F2 ad [61,100] [1,60] [31,50]

11 Alex X. LiuThe University of Texas at Austin Results of Step 2 F1F1 F2F2 F2F2 ad ad [51,100] [1,30] [1,40] [61,100] [1,20] F2F2 ad [61,100] [1,40] [31,50] dd [41,100] [21,60] [41,60] F1F1 F2F2 F2F2 ad dd [51,100] [1,30] [1,40] [61,100] [1,20] F2F2 ad [61,100] [1,40] [31,50] aa [21,60] [41,60] [41,100]

12 Alex X. LiuThe University of Texas at Austin Step 3:  Compare two semi-isomorphic FDDs for discrepancies

13 Alex X. LiuThe University of Texas at Austin Applying Step 3: F1F1 F2F2 F2F2 ad ad [51,100] [1,30] [1,40] [61,100] [1,20] F2F2 ad [61,100] [1,40] [31,50] [21,60] [41,60] F1F1 F2F2 F2F2 ad dd [51,100] [1,30] [1,40] [61,100] [1,20] F2F2 ad [61,100] [1,40] [31,50] [21,60] [41,60] [41,100] aa d d

14 Alex X. LiuThe University of Texas at Austin Example  1. Design A of firewall:  2. Design B of firewall:  3. Comparison: F1F1 F2F2 ad d [51,100] [1,50] [61,100] [1,60]

15 Alex X. LiuThe University of Texas at Austin Experimental Results  Three algorithms implemented in Java JDK 1.4  Experiments carried out on SunBlade 2000 (OS: Solaris 9, CPU:1Ghz, memory: 1 GB)

16 Alex X. LiuThe University of Texas at Austin Conclusions  Three contributions: –Propose diverse firewall design method –Present a suite of algorithms to enable diverse firewall design FDD Construction Algorithm FDD Shaping Algorithm FDD Comparison Algorithm method –FDD construction algorithm can be used to convert aconflict infested firewall to a conflict free firewall