Review: Firewall Privacy Preservation By Packet Filtering Management

Firewalls are core elements in network security. A firewall checks each incoming or outgoing packet to decide whether to accept or discard the packet based on its policy. A firewall is a security guard placed at the point of entry between a private network and the outside Internet such that all incoming and outgoing packets have to pass through it. However, managing firewall rules, particularly in multi-firewall enterprise networks, has become a complex and error-prone task. Prior work on firewall optimization focuses on either intra-firewall or inter-firewall optimization within one administrative domain where the privacy of firewall policies is not a concern. Firewall filtering rules have to be written, ordered and distributed carefully in order to avoid firewall policy anomalies that might cause network vulnerability. Therefore, inserting or modifying filtering rules in any firewall requires thorough intra- and inter-firewall analysis to determine the proper rule placement and ordering in the firewalls. It has been observed that most firewall policies on the Internet are poorly designed and have many errors. Therefore, how one can design firewall policies correctly is an important issue. In the comparison phase, the resulting multiple versions are compared with each other to detect all functional discrepancies between them.