最新分布式防火墙技术研究

防火墙是网络安全保护中最常采用的技术,而随着网络技术和应用的发展,传统的防火墙面临巨大的挑战,其缺陷也日益显现,分布式防火墙技术正是应运而生的下一代防火墙技术。本文探讨了分布式防火墙的工作机制和体系结构,分布式防火墙的主要特点和功能,以及分布式防火墙之于网络安全的主要优势。     

DDFWS:一种新型分布式动态防火墙系统的研究与实现

文中对传统防火墙进行了深入的分析并指出了它们存在的问题和局限，在此基础上，提出了一种新型的分布式动态防火墙原型系统，并给出了系统的设计和实现，该原型系统具有广泛的适用性。     

A quantitative study of firewall configuration errors

The protection that firewalls provide is only as good as the policy they are configured to implement. Analysis of real configuration data show that corporate firewalls are often enforcing rule sets that violate well established security guidelines. Firewalls are the cornerstone of corporate intranet security. Once a company acquires a firewall, a systems administrator must configure and manage it according to a security policy that meets the company's needs. Configuration is a crucial task, probably the most important factor in the security a firewall provides.     

Firewalls – Are they enough protection for current networks?

Firewalls are widely deployed in most organizations connected to the Internet to implement their information security policy and to protect information from unauthorized access. Yet intruders still manage to attack systems and gain unauthorized access to information that is supposedly protected by these firewalls. This article examines some of the history and background of firewalls and what has led up to the current situation. Additionally this article will examine how any organization, even your home network, can be made a far safer place using readily available existing firewall technologies.     

Demystifying Cluster-Based Fault-Tolerant Firewalls

Firewalls are perimeter security solutions that are useful for addressing the unwanted traffic issue. However, designers must also appropriately address the network performance, availability, and complexity problems that firewalls introduce. The authors survey existing cluster-based fault-tolerant firewall architectures and discuss their trade-offs in these three areas. They present a preliminary evaluation of these architectures and discuss the need for state replication in stateful firewall clusters. They also discuss the difficulties of providing a simple, performance, and fault-tolerant cluster-based firewall solution.     

Protection of heterogeneous architectures on FPGAs: An approach based on hardware firewalls

Embedded systems are parts of our daily life and used in many fields. They can be found in smartphones or in modern cars including GPS, light/rain sensors and other electronic assistance mechanisms. These systems may handle sensitive data (such as credit card numbers, critical information about the host system and so on) which must be protected against external attacks as these data may be transmitted through a communication link where attackers can connect to extract sensitive information or inject malicious code within the system. This work presents an approach to protect communications in multiprocessor architectures. This approach is based on hardware security enhancements acting as firewalls. These firewalls filter all data going through the system communication bus and an additional flexible cryptographic block aims to protect external memory from attacks. Benefits of our approach are demonstrated using a case study and some custom software applications implemented in a Field-Programmable Gate Array (FPGA). Firewalls implemented in the target architecture allow getting a low-latency security layer with flexible cryptographic features. To illustrate the benefit of such a solution, implementations are discussed for different MPSoCs implemented on Xilinx Virtex-6 FPGAs. Results demonstrate a reduction up to 33% in terms of latency overhead compared to existing efforts.     

On the use of open-source firewalls in ICS/SCADA systems

ABSTRACT

Firewalls are one of the most widely used security devices to protect a communications network. They help secure it by blocking unwanted traffic from entering or leaving the protected network. Several commercial vendors have extended their firewall capabilities to support SCADA protocols or designed SCADA-specific firewalls. Although open-source firewalls are used successfully in IT networks, their use in SCADA networks has not been properly investigated. In this research we investigate the major open-source firewalls for their use in SCADA networks and identify Linux iptables’ potential as an effective SCADA firewall. Iptables is a powerful open-source firewall solution available as part of most Linux distributions in use today. In general, use of iptables as a network-level firewall for SCADA systems has been limited to basic port and host filtering, without further inspection of control messages. We propose and demonstrate a novel methodology to use iptables as an effective firewall for SCADA systems. This is achieved by utilizing advanced iptables features that allow for dynamic inspection of packet data. It is noteworthy to mention that the proposed solution does not require any modification to the netfilter/iptables framework, making it possible to turn a Linux system into an effective SCADA firewall. The approach has been tested by defining filtering rules for the Modbus TCP protocol and validating its ability to defend against various attacks on the protocol.     

Formal firewall conformance testing: an application of test and proof techniques

Firewalls are an important means to secure critical ICT infrastructures. As configurable off‐the‐shelf products, the effectiveness of a firewall crucially depends on both the correctness of the implementation itself as well as the correct configuration. While testing the implementation can be done once by the manufacturer, the configuration needs to be tested for each application individually. This is particularly challenging as the configuration, implementing a firewall policy, is inherently complex, hard to understand, administrated by different stakeholders and thus difficult to validate. This paper presents a formal model of both stateless and stateful firewalls (packet filters), including NAT , to which a specification‐based conformance test case generation approach is applied. Furthermore, a verified optimisation technique for this approach is presented: starting from a formal model for stateless firewalls, a collection of semantics‐preserving policy transformation rules and an algorithm that optimizes the specification with respect of the number of test cases required for path coverage of the model are derived. We extend an existing approach that integrates verification and testing, that is, tests and proofs to support conformance testing of network policies. The presented approach is supported by a test framework that allows to test actual firewalls using the test cases generated on the basis of the formal model. Finally, a report on several larger case studies is presented. Copyright © 2014 John Wiley & Sons, Ltd.     

Database Security

“Why do I need to secure my database server? No one can access it — it’s in a DMZ protected by the firewall!” This is often the response when it is recommended that such devices are included within a security health check. In fact, database security is paramount in defending an organizations information, as it may be indirectly exposed to a wider audience than realised.This is the first of two articles that will examine database security. In this article we will discuss general database security concepts and common problems. In the next article we will focus on specific Microsoft SQL and Oracle security concerns.Database security has become a hot topic in recent times. With more and more people becoming increasingly concerned with computer security, we are finding that firewalls and Web servers are being secured more than ever (though this does not mean that there are not still a large number of insecure networks out there). As such, the focus is expanding to consider technologies such as databases with a more critical eye.     

计算机网络的安全防护与发展

网络安全性是一个涉及面很广泛的问题,详细描述了网络安全的解决方案,目的在于为用户提供信息的保密、认证和完整性保护机制,使网络中的服务、数据以及系统免受侵扰和破坏。防火墙、权限以及加密等都是当今常用的方法,从这些方法入手深入研究解决网络安全问题,可以使读者对网络安全技术的有更深刻的了解。     

A novel three-tiered visualization approach for firewall rule validation

Firewall is one of the most critical elements of the current Internet, which can protect the entire network against attacks and threats. While configuring the firewalls, rule configuration has to conform to, or say be consistent with, the demands of the network security policies such that the network security would not be flawed. For the security consistency, firewall rule editing, ordering, and distribution must be done very carefully on each of the cooperative firewalls, especially in a large-scale and multifirewall-equipped network. Nevertheless, a network operator is prone to incorrectly configure the firewalls because there are typically thousands or hundreds of filtering/admission rules (i.e., rules in the Access Control List file, or ACL for short), which could be set up in a firewall; not mentioning these rules among firewalls affect mutually and can make the matter worse. Under this situation, the network operator would hardly know his/her misconfiguration until the network functions beyond the expectation. For this reason, our work is to build a visualized validation system for facilitating the check of security consistency between the rule configuration of firewalls and the demands of network security policies. To do so, the developed validation system utilizes a three-tiered visualization hierarchy along with different compound viewpoints to provide users with a complete picture of firewalls and relationships among them for error debugging and anomaly removal. In addition, in this paper, we also enumerate the source of security inconsistency while setting ACLs and make use of it as a basis of the design of our visualization model. Currently, part of the firewall configuration of our campus network has been used as our system's input to demonstrate our system's implementation.     

基于防火墙与入侵检测系统联动的校园网GSN全局部署

本文介绍了校园网的安全现状和校园网面临的主要威胁,分析了防火墙、入侵检测系统存在的不足,结合学院校园网实际情况给出GSN全局安全网络部署方案,并针对GSN全局安全网络第三阶段部署中存在的网络安全问题,提出基于开放端口的防火墙与入侵检测系统的联动模式,并给出具体实现方案。实践证明这种联动可以有效提升防火墙的机动性和实时反应能力,增强了入侵检测系统的阻断功能。     

基于硬件的防火墙实现技术

目前占主流的防火墙都是基于软件来实现的,通过各种技术组合可以达到比较高的安全级别。但是软件防火墙始终存在着一些避免的安全性问题,而基于硬件实现的防火墙则可以比较好地解决这些问题。该文将详细介绍一种基于硬件的防火墙技术－Ｈａｒｄｗａｌｌ。     

浅谈校园信息网络安全

网络安全是一门涉及计算机科学、网络技术、通信技术、密码技术、信息安全技术、应用数学、数论、信息论等多种学科的综合性学科.网络的生命在于其安全性.因此,在现有的技术条件下,如何构建相对可靠的校园网络安全体系,就成了校园网络管理人员的一个重要课题.     

基于云桌面实现网络安全隔离的应用

网络安全隔离技术是保护企业内部信息安全的重要手段,一般通过传统网络设备,如防火墙、网闸等实现隔离,但安全规则相对固化,无法较好满足灵活多变的业务需求。对实际外联需求进行分析,利用云桌面技术,结合合理的网络规划,设计并实现一种能够普遍推广的网络安全隔离应用方式。通过灵活运用更多安全手段,在确保网络安全隔离的基础上,进一步提升内外网使用体验。     

浅谈校园信息网络安全

网络安全是一门涉及计算机科学、网络技术、通信技术、密码技术、信息安全技术、应用数学、数论、信息论等多种学科的综合性学科。网络的生命在于其安全性。因此,在现有的技术条件下,如何构建相对可靠的校园网络安全体系,就成了校园网络管理人员的一个重要课题。     

浅谈计算机网络防火墙的安全技术

防火墙作为保护网络安全的主要设施,它通过在受信与非受信网络间建立网络障碍,来实现相应的安全技术和战略。主要通过对防火墙的定义、分类以及计算机网络安全与防火墙技术的讨论,分析数据包过滤型,代理服务器和监测型这3类防火墙技术,来探讨未来计算机防火墙的安全设计。     

Protecting Your Internal Resources with Intranet Application Firewalls

Abstract

Web application firewalls (WAFs) are rapidly becoming a key component of end-to-end network security. Although the market is still struggling to move beyond the early adopter stages, WAF placement in the network is now well known and generally accepted as a necessary requirement. When looking at total security architecture, securing public Web applications over ports 80 and 443 is the next logical step to perimeter security: the concept of restricting access from the outside to the resources on the inside. Coupled with network firewalls, HTTP application firewalls can close perimeter security holes opened by allowing unrestricted access to public Web servers. Bui focusing solely on external, public application security is only half of the solution. Internal Web-based applications, such as corporate intranets, HR systems, CRM systems, HTTP-based databases, and report management applications, can also be al risk for the same open-access reasons, but from trusted internal attackers.     

网络监控审计系统的设计与实现

防火墙是传统的网络安全产品,部署防火墙也是最常用的安全解决方案。但是随着网络入侵和攻击手段越来越先进,传统防火墙的缺点越来越明显。该文以朗新网络安全监控审计系统(NetshieNIA)为基础,介绍了新一代网络安全产品的设计实现。