An Interval Decision Diagram Based Firewall

Mikkel Christiansen (1) , Emmanuel Fleury (2)

1 BRICS - Department of Computer Science
2 LaBRI - Laboratoire Bordelais de Recherche en Informatique

This paper explores the use of Interval Decision Diagrams (IDDs) as the central structure of a firewall packet filtering mechanism. This is done by first relating the packet filtering problem to predicate logic, then implementing a prototype which is used in an empirical evaluation. The main benefits of the IDD structure are that it provides access to boolean algebra over filters, efficient classification time, and potentially a compact representation. Results from the empirical evaluation shows that IDDs are scalable in terms of memory usage: a 50,000 rule filter requires only 3MB of memory, and efficient for packet classification: it is able to handle more rules than the schemes it was compared to without causing a degradation in performance.

Mots clés: decision diagrams; packet classification; firewall; traffic filtering; decision diagrams.

Domaines: Cryptographie et sécurité [cs.CR]

Mikkel Christiansen, Emmanuel Fleury. An Interval Decision Diagram Based Firewall. 3rd IEEE International Conference on Networking (ICN '04), 2004, Point-à-Pitre, Guadeloupe. ⟨hal-00353641⟩