An MTIDD Based Firewall Using Decision Diagrams for Packet Filtering

Mikkel Christiansen (1) , Emmanuel Fleury (2)

1 CISS - Center for Indlejrede Software Systemer
2 LaBRI - Laboratoire Bordelais de Recherche en Informatique

This paper explores the use of Multi-Terminal Interval Decision Diagrams (MTIDDs) as the central structure of a firewall packet filtering mechanism. This is done by first relating the packet filtering problem to predicate logic, then implementing a prototype which is used in an empirical evaluation. The main benefits of the MTIDD structure are that it provides access to Boolean algebra over filters, efficient classification time, and a compact representation. Results from the empirical evaluation shows that MTIDDs are scalable in terms of memory usage: a 50,000 rule filter requires only 3MB of memory, and efficient for packet classification: it is able to handle more rules than the schemes it was compared to without causing a degradation in performance.

Domaines: Réseaux et télécommunications [cs.NI]; Cryptographie et sécurité [cs.CR]

Mikkel Christiansen, Emmanuel Fleury. An MTIDD Based Firewall Using Decision Diagrams for Packet Filtering. Telecommunication Systems, 2004, 27 (2-4), pp.297-319. ⟨10.1023/B:TELS.0000041013.23205.0f⟩. ⟨hal-00350221⟩