A rule relation calculus for verification and validation of firewalls

Abstract

Rule based filter is a set of ordered filtering rules. Each rule is formed of a condition and an action. Condition is a set of network fields and can be seen as points in a topological space. Consequently each firewall rule can be seen as a region within the space of filtering fields. Anomalies are relations between rules that hint at possible misconfiguration of firewalls. In this paper, we put forward a calculus that analyzes the topological relationship between firewall rules. Anomalies are definable in the calculus. Within this framework, a constraint satisfaction technique is proposed to reconfigure an anomalous firewall.