Network reachability analysis evaluates the actual connectivity of an IT infrastructure. It can be performed by active network probing or examining a formal model of a target IT infrastructure. The latter approach is preferrable as it does not interfere with the normal network behaviour and can be easily used during development and change management phases. In this paper we propose a novel modelling approach, based on a geometric representation of device configurations (i.e. the policies) which permits the computation of the reachability using the concept of equivalent firewall. An equivalent firewall is a fictitious device, ideally connected directly to the communication endpoints, that summarizes the network behaviour between them. Our model supports routing, filtering and address translation devices in a computationally effective way. In fact, the experimental results show that the computation of equivalent firewalls is performed in a negligible time and that afterwards the reachability queries are answered in few seconds.

Improved reachability analysis for security management / Basile, Cataldo; Canavese, Daniele; Lioy, Antonio; Pitscheider, Christian. - STAMPA. - (2013), pp. 534-541. (Intervento presentato al convegno PDP-2013: 21st Euromicro International Conference on Parallel, Distributed, and Network-Based Processing tenutosi a Belfast (UK) nel February 27 - March 1, 2013) [10.1109/PDP.2013.86].

Improved reachability analysis for security management

BASILE, CATALDO;CANAVESE, DANIELE;LIOY, ANTONIO;PITSCHEIDER, CHRISTIAN
2013

Abstract

Network reachability analysis evaluates the actual connectivity of an IT infrastructure. It can be performed by active network probing or examining a formal model of a target IT infrastructure. The latter approach is preferrable as it does not interfere with the normal network behaviour and can be easily used during development and change management phases. In this paper we propose a novel modelling approach, based on a geometric representation of device configurations (i.e. the policies) which permits the computation of the reachability using the concept of equivalent firewall. An equivalent firewall is a fictitious device, ideally connected directly to the communication endpoints, that summarizes the network behaviour between them. Our model supports routing, filtering and address translation devices in a computationally effective way. In fact, the experimental results show that the computation of equivalent firewalls is performed in a negligible time and that afterwards the reachability queries are answered in few seconds.
2013
9781467353212
File in questo prodotto:
Non ci sono file associati a questo prodotto.
Pubblicazioni consigliate

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/11583/2504319
 Attenzione

Attenzione! I dati visualizzati non sono stati sottoposti a validazione da parte dell'ateneo