loading...
 This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
11th IEEE Symposium on Computers and Communications (ISCC'06)
Balancing Trie-Based Policy Representations for Network Firewalls
Cagliari, Sardinia, Italy
June 26-June 29
ISBN: 0-7695-2588-1
Stephen J. Tarsa, Wake Forest University, USA
Errin W. Fulp, Wake Forest University, USA
Firewalls inspect arriving packets according to a security policy. The complexity of these policies can cause significant delays in the processing of packets, resulting in degraded performance, traffic bottlenecks, and ultimately violating Quality of Service (QoS) constraints. As network capacities continue to increase, the improvement of firewall performance is a main concern.

One technique that dramatically reduces required processing is the representation of security policies in software with n-ary tries. This paper describes trie balancing methods that further improve performance by placing more frequently used rules in high precedence positions which require fewer tuple comparisons. A proof of sorted trie integrity is presented along with experimental results showing that on average, sorting reduces the number of comparisons by 27% as compared to the original trie and by 83% as compared to a list representation. Sorting methods are described in detail and their benefits are demonstrated empirically.

Citation:
Stephen J. Tarsa, Errin W. Fulp, "Balancing Trie-Based Policy Representations for Network Firewalls," iscc, pp.755-760, 11th IEEE Symposium on Computers and Communications (ISCC'06), 2006
Usage of this product signifies your acceptance of the Terms of Use.