Privacy Preserving Firewall Optimization Over Cross Domains

Abstract

Firewalls are the most deployed medium on the Internet for securing private networks from unwanted intruders. The volume of traffic moving over the Internet, as well as corporate networks, is expanding exponentially every day. As social dependence on such information systems continues to grow exponentially, a similar growth in threats is concurrently taking place. A firewall checks each incoming or outgoing packet to decide whether to accept or discard the packet based on its assigned policy. Optimizing these policies is crucial phase to enhance the performance of the network. Existing work on firewall optimization focuses on either intrafirewall or interfirewall optimization within one administrative domain where the privacy of firewall policies is not a concern and cross domains where when used with various network address translation devices made it a problem. This project explores interfirewall optimization across administrative domains along with NAT devices for the first time. The key technical challenge is that firewall policies cannot be shared across domains because a firewall policy contains confidential information and even potential security holes, which can be exploited by attackers. Here, we propose the first cross-domain privacy preserving cooperative firewall policy optimization protocol along with Network Address Translation devices. Particularly, for any two adjacent firewalls belonging to two different administrative domains, our protocol can identify in each firewall the rules that can be removed because of the other firewall and optimization process involves cooperative computation between the two firewalls without any party disclosing its policy to the other.