Using argumentation logic for firewall configuration management

  • Authors:
  • Arosha K. Bandara;Antonis C. Kakas;Emil C. Lupu;Alessandra Russo

  • Affiliations:
  • Centre for Research in Computing, Dept. of Computing, The Open University, Milton Keynes, UK;Department of Computing, University of Cyprus, Nicosia, Cyprus;Department of Computing, Imperial College London, London, UK;Department of Computing, Imperial College London, London, UK

  • Venue:
  • IM'09 Proceedings of the 11th IFIP/IEEE international conference on Symposium on Integrated Network Management
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

Firewalls remain the main perimeter security protection for corporate networks. However, network size and complexity make firewall configuration and maintenance notoriously difficult. Tools are needed to analyse firewall configurations for errors, to verify that they correctly implement security requirements and to generate configurations from higher-level requirements. In this paper we extend our previous work on the use of formal argumentation and preference reasoning for firewall policy analysis and develop means to automatically generate firewall policies from higher-level requirements. This permits both analysis and generation to be done within the same framework, thus accommodating a wide variety of scenarios for authoring and maintaining firewall configurations. We validate our approach by applying it to both examples from the literature and real firewall configurations of moderate size (≅ 150 rules).