Implementing a distributed firewall

By S. Ioannidis, Angelos Dennis Keromytis, Steven M. Bellovin, Jonathan M. Smith. Conference on Computer and Communications Security, 2000

402 citations recorded by the source corpus.

Conventional rewalls rely on topology restrictions and controlled network entry points to enforce traAEc ltering. Furthermore, a rewall cannot lter traAEc it does not see, so, e ectively, everyone on the protected side is trusted. While this model has worked well for small to medium size networks, networking trends such as increased connectivity, higher line speeds, extranets, and telecommuting threaten to make it obsolete. To address the shortcomings of traditional rewalls, the concept of a \distributed rewall" has been proposed. In this scheme, security policy is still centrally de ned, but enforcement is left up to the individual endpoints. IPsec may be used to distribute credentials that express parts of the overall network policy. Alternately, these credentials may be obtained through out-of-band means. In this paper, we present the design and implementation of a distributed rewall using the KeyNote trust management system to specify, distribute, and resolve policy, and OpenBSD, an open source UNIX operating system.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/1ceb6bc425c586641a10012db4bdd6cad328a58f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Electrical and Electronic Engineering

In Hardware and Architecture

Citations in the corpus

Ethane: taking control of the enterprise (2007, background): “In distributed firewalls [15], policy is declared centrally in a topology independent manner and enforced at each end-host.”
Optimizing the "one big switch" abstraction in software-defined networks (2013, background): “Distributing policy over the network perimeter: These works distribute a centralized firewall policy by placing rules for packets at their ingress switches [7, 17], or verify that the edge switch configurations realize the firewall policy [18].”
Discovery of policy anomalies in distributed firewalls (2004, background): “In terms of distributed firewall policy enforcement, a novel architecture is proposed in [14] where the authors suggest using a trust management system to enforce a centralized security policy at individual network endpoints based on”
A Virtual Machine Introspection Based Architecture for Intrusion Detection (2003, background): “[20] outside of the host seems like an obvious application for this mechanism.”
SANE: A Protection Architecture for Enterprise Networks (2006, background): “agement, and meaningful end-point identifiers has lead to the development of distributed firewalls [14, 26, 2].”
Conflict classification and analysis of distributed firewall policies (2005, background): “In terms of distributed firewall policy enforcement, a novel architecture is proposed in [17], where the authors suggest using a trust management system to enforce a centralized security policy at individual network endpoints based on access rights granted to users or hosts.”