IEEE Paper Template in A4 (V1)
Total Page：16
File Type：pdf, Size：1020Kb
ISSN 2319 – 1953 International Journal of Scientific Research in Computer Science Applications and Management Studies Data Security in Local Network Using Distributed Firewall N.Kohila 1, R.Gowthami 2, 1Assistant Professor, Department of Computer Science and Computer Applications, 2M.Phil full time research Scholar, Department of Computer Science, 1,2* Vivekananda College of Arts and Sciences for women,Namakkal,TamilNAdu,India [email protected] [email protected] Abstract— The firewall is one of the central technologies allowing read, "We are currently under attack from an Internet VIRUS! high-level access control to organization networks. Packet It has hit Berkeley, UC San Diego, Lawrence Livermore, matching in firewalls involves matching on many fields from the Stanford, and NASA Ames." TCP and IP packet header. At least five fields (protocol number, The Morris Worm spread itself through multiple source and destination IP addresses, and ports) are involved in vulnerabilities in the machines of the time. Although it was the decision which rule applies to a given packet. With available bandwidth increasing rapidly, very efficient matching algorithms not malicious in intent, the Morris Worm was the first large need to be deployed in modern firewalls to ensure that the scale attack on Internet security; online community was firewall does not become a bottleneck Since firewalls need to neither expecting an attack nor prepared to deal with one. filter all the traffic crossing the network perimeter, they should The firewall is one of the central technologies allowing be able to sustain a very high throughput, or risk becoming a highlevel access control to organization networks. Packet bottleneck. Thus, algorithms from computational geometry can matching in firewalls involves matching on many fields from be applied. In this paper we consider a classical algorithm that the TCP and IP packet header. At least five fields (protocol we adapted to the firewall domain. We call the resulting number, source and destination IP addresses, and ports) are algorithm ―Geometric Efficient Matching‖ (GEM). The GEM involved in the decision which rule applies to a given packet. algorithm enjoys a logarithmic matching time performance. However, the algorithm’s theoretical worst-case space With available bandwidth increasing rapidly, very efficient complexity is O (n4) for a rule-base with n rules. Because of this matching algorithms need to be deployed in modern firewalls perceived high space complexity, GEM-like algorithms were to ensure that the firewall does not become a bottleneck. rejected as impractical by earlier works. Contrary to this Modern firewalls all use ―first match‖ semantics : The firewall conclusion, this paper shows that GEM is actually an excellent rules are numbered from 1 to n, and the firewall applies the choice. Based on statistics from real firewall rule-bases, we policy (e.g., pass or drop) associated with the first rule that created a Perimeter rules model that generates random, but non- matches a given packet. uniform, rule bases. We evaluated GEM via extensive simulation Firewall packet matching is reminiscent of the well studied using the Perimeter rules model. router packet matching problem. However, there are several Keywords— Firewall, Protection, GEM, Virus, Bottleneck, TCP, crucial differences which make the problems quite different. Protocol, Intranets A firewall is a system or group of systems (router, proxy, or gateway) that implements a set of security rules to enforce I. INTRODUCTION access control between two networks to protect "inside" The term firewall originally referred to a wall intended to network from "outside" network. It may be a hardware device confine a fire or potential fire within a building. Later uses or a software program running on a secure host computer. In refer to similar structures, such as the metal sheet separating either case, it must have at least two network interfaces, one the engine compartment of a vehicle or aircraft from the for the network it is intended to protect, and one for the passenger compartment. network it is exposed to. A firewall sits at the junction point or Firewall technology emerged in the late 1980s when the gateway between the two networks, usually a private network Internet was a fairly new technology in terms of its global use and a public network such as the Internet. and connectivity. The predecessors to firewalls for network Distributed firewalls are host-resident security software security were the routers used in the late 1980s: applications that protect the enterprise network's servers and Clifford Stoll's discovery of German spies tampering with end-user machines against unwanted intrusion. They offer the his system[3] advantage of filtering traffic from both the Internet and the Bill Cheswick's "Evening with Berferd" 1992 in which he internal network. This enables them to prevent hacking attacks set up a simple electronic "jail" to observe an attacker that originate from both the Internet and the internal network. In 1988, an employee at the NASA Ames Research Center This is important because the most costly and destructive in California sent a memo by email to his colleagues[4] that attacks still originate from within the organization. They are IJSRCSAMS Volume 3, Issue 6 (November 2014) www.ijsrcsams.com ISSN 2319 – 1953 International Journal of Scientific Research in Computer Science Applications and Management Studies like personal firewalls except they offer several important they cannot make more complex decisions based on what advantages like central management, logging, and in some stage communications between hosts have reached. cases, access-control granularity. These features are necessary Newer firewalls can filter traffic based on many packet to implement corporate security policies in larger enterprises. attributes like source IP address, source port, destination IP Policies can be defined and pushed out on an enterprise-wide address or port, destination service like WWW or FTP. They basis. can filter based on protocols, TTL values, netblock of First, unlike firewalls, routers use ―longest prefix match‖ originator, of the source, and many other attributes. semantics. Next, the firewall matching problem is 4- or 5- Commonly used packet filters on various versions of Unix dimensional, whereas router matching is usually 1- or 2- are IPFilter (various), ipfw (FreeBSD/Mac OS X), NPF dimensional: A router typically matches only on IP addresses, (NetBSD), PF (OpenBSD, and some other BSDs), and does not look deeper, into the TCP or UDP packet iptables/ipchains (Linux). headers. Finally, major firewall vendors support rules that utilize IP address ranges, in addition to subnets or CIDR blocks: this is the case for Check Point and Juniper—the main exception is Cisco, that only supports individual IP addresses or subnets. Therefore, firewalls require their own special algorithms. A firewall is a system designed to prevent unauthorized access to or from a private network. Firewalls can be implemented in both hardware and software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria. Figure 1 Screened Host Firewall II TYPES A. Application-layer There are different types of firewalls depending on where Application-layer firewalls work on the application level of the communication is taking place, where the communication the TCP/IP stack (i.e., all browser traffic, or all telnet or ftp is intercepted and the state that is being traced. traffic), and may intercept all packets traveling to or from an III NETWORK LAYER OR PACKET FILTERS application. They block other packets (usually dropping them without acknowledgment to the sender). Network layer firewalls, also called packet filters, operate On inspecting all packets for improper content, firewalls at a relatively low level of the TCP/IP protocol stack, not can restrict or prevent outright the spread of networked allowing packets to pass through the firewall unless they computer worms and trojans. The additional inspection match the established rule set. The firewall administrator may criteria can add extra latency to the forwarding of packets to define the rules; or default rules may apply. The term "packet their destination. Application firewalls function by filter" originated in the context of BSD operating systems. determining whether a process should accept any given Network layer firewalls generally fall into two sub- connection. Application firewalls accomplish their function by categories, stateful and stateless. Stateful firewalls maintain hooking into socket calls to filter the connections between the context about active sessions, and use that "state information" application layer and the lower layers of the OSI model. to speed packet processing. Any existing network connection Application firewalls that hook into socket calls are also can be described by several properties, including source and referred to as socket filters. Application firewalls work much destination IP address, UDP or TCP ports, and the current like a packet filter but application filters apply filtering rules stage of the connection's lifetime (including session initiation, (allow/block) on a per process basis instead