An Answer Set Programming Approach For Analysing Firewall Policies

Firewall is one of the most widely adopted technology which are designed to block unauthorized access. The single most important factor of firewall's security is how to configure firewall policies. However, it's a tedious and error-prone job to config-ure firewall policies, because the semantics of firewall policies is hard to judge. Any configuration flaw causes security problems.In this paper, I propose three approaches to analyze firewall policies:an approach to query firewall policies, an approach to compare firewall policies and an approach to verify firewall policies.First of all, I present two reasons why firewall policies are difficult to understand. One is that rules of firewall policies are sensitive to rule order, and the other is that the environment that firewalls are deployed is complex. According to two reasons, I propose an approach to query firewall policies based on answer set programming(ASP). Firstly, ASP is a non-monotonic logic which can reason about rule order. Secondly, Asp is capable of representing all kinds of knowledge which means ASP can describe firewall environment. I represent firewall polices and network topology with answer set programs, and compute semantics of them. Further more, I transform the predicates of the semantics into relation models which can be queried by means of SQL. This approach can not only query single firewall, but also diverse firewall; not only simple chain, but also multiple chains; not only query a single packet, but also query overall access control policies.Secondly, I present three purposes of comparing firewall policies:verifying consis-tency, learning from experts, checking policies update. And then, I present two com-paring problems:the simple firewall policies comparing problem and the routing paths comparing problem The former one is to find the differences between the semantics of firewall policies, and the later one is to find the differences between access control policies of different routing paths from source to destination. In this paper, I propose a comparing approach which is based on the querying approach and adds rules about comparing firewall policies and routing paths to the answer set programs. The approach not only can find differences between the semantics of firewall policies, but also can lo-cate the rules which cause the differences; not only can find the differences between access control policies of different routing paths, but also can list the net nodes in the routing paths.Thirdly, firewall policies are codes compared to security polices which are designs, so verifying the consistency between them is the most concerned problem for adminis-trators. In this paper, I point out that the kernel of consistency is the consistency of access control policies'semantics between firewall policies and security polices. I pro-pose a approach to verify the semantics consistency based on the comparing approach. First of all, I use answer set programs to represent security policies, firewall policies and network topology. Then, I compute the semantics of both and verify the consistency by comparing the semantics of them.At last, I sum the whole article and propose the future research direction.