Static Analysis of Routing and Firewall Policy Configurations

Assessing network authorization policies via reachability analysis

“…The equality symbol (=) indicates that the proposed model has the same features and the plus symbol (+) indicates that our approach has this additional feature. Compared to [1,2,3], we support a broader range of security controls. Our model has an advantage over [4] because it has better performance, a more precise query language, and it supports also end-system firewall.…”

“…• firewalls, enforce a network access policy and many of them also provide application layer filtering(fw A2 ) 3 , NAT/NAPT (fw A3 and fw B3 ), and tunnelling capabilities (fw A1 , fw C1 , fw B1 and fw B2 );…”

“…Also in this case, performance analysis is absent. Another theoretical approach, used to compute the network-wide reachability was proposed in [3] where authors use traditional graph-based algorithms, such as Floyd-Warshall, whereas [1] and [2] require ad-hoc techniques to mimic routing protocols. Additionally, they describe how to represent both routing and filtering controls, but do not mention how to express packet transformations rules.…”

“…First, several approaches only take into account a subset of the security controls usually displaced in the network. For instance, Xie et al [1], Bandhakavi et al [2], or Sveda et al [3] provide limited or no support for transformation controls. This limitation seriously affects the applicability to real cases and the analysis accuracy.…”

“…Our purpose was to design the smallest network able to allow us to present all the interesting query cases we can deal with in order to define our reachability model. For instance, all the NAT rules would be practically unnecessary 3. More precisely, we assume that fw A2 is able to filter HTTP connections 4.…”