A Quadratic, Complete, and Minimal Consistency Diagnosis Process for Firewall ACLs

— Developing and managing firewall Access Control Lists (ACLs) are hard, time-consuming, and error-prone tasks for a variety of reasons. Complexity of networks is constantly increasing, as it is the size of firewall ACLs. Networks have different access control requirements which must be translated by a network administrator into firewall ACLs. During this task, inconsistent rules can be introduced in the ACL. Furthermore, each time a rule is modified (e.g. updated, corrected when a fault is found, etc.) a new inconsistency with other rules can be introduced. An inconsistent firewall ACL implies, in general, a design or development fault, and indicates that the firewall is accepting traffic that should be denied or vice versa. In this paper we propose a complete and minimal consistency diagnosis process which has worst-case quadratic time complexity with the number of rules in a set of inconsistent rules. There are other proposals of consistency diagnosis algorithms. However they have...

• Type: Conference
• Year: 2010
• Where: AINA
• Authors: Sergio Pozo, A. J. Varela-Vaca, Rafael M. Gasca
• Keywords: Access Control, AINA 2010, Computer Networks, Firewall Acl, Inconsistent Rules