Automated Firewall Analytics by Ehab Al-Shaer

Author:Ehab Al-Shaer
Language: eng
Format: epub
Publisher: Springer International Publishing, Cham

Proof.

From rule distribution algorithm, we can see that each rule can only be distributed along the firewall in its path. And the policy sequence is maintained by deploy rules based on the policy graph from root to leaf. Thus, the more detail rules of subdomain will be put on top of each firewalls. Without losing generality, suppose we have two policy domain . Suppose D 1 is applied with policy P 1 and D 2 with P 2. If only single firewall f 2 exists for D 2, then the policy deployed on f 2 should be . If there are two firewalls f 2 for D 2 and f 1 for D 1, then after distribution, the rules for D 1 will be distributed to both f 1 and f 2 first, then the rules for D 2 will be distributed to f 2. Then the aggregated policy for d 1 will be .

This guarantees that no accept packets to subdomain will be blocked by more general rules of parent domain. Let R f represent the rules deployed in firewall f, then we can get the following:

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.