Implementing a Distributed Firewall
Conventional firewalls rely on topology restrictions and controlled network entry points to enforce traffic filtering. Furthermore, a firewall cannot filter traffic it does not see, so, effectively, everyone on the protected side is trusted. While this model has worked well for small to medium size networks, networking trends such as increased connectivity, higher line speeds, extranets, and telecommuting threaten to make it obsolete. To address the shortcomings of traditional firewalls, the concept of a "distributed firewall" has been proposed. In this scheme, security policy is still centrally defined, but enforcement is left up to the individual endpoints. IPsec may be used to distribute credentials that express parts of the overall network policy. Alternately, these credentials may be obtained through out-of-band means. In this paper, we present the design and implementation of a distributed firewall using the KeyNote trust management system to specify, distribute, and resolve policy, and OpenBSD, an open source UNIX operating system.
- ccs-df.pdf application/pdf 94.9 KB Download File
Also Published In
More About This Work
- Academic Units
- Computer Science
- Published Here
- June 24, 2010
Proceedings of the 7th ACM Conference on Computer and Communications Security: CCS 2000: Athens, Greece, November 1-4, 2000 (New York: ACM Press, 2000), pp. 190-199.