Issue No. 03 - May-June (2017 vol. 14)

ISSN: 1545-5971

pp: 339-349

Ehab S. Elmallah , Department of Computing Science, University of Alberta, Edmonton, AB, Canada

Mohamed G. Gouda , Department of Computing Science, University of Texas at Austin, Austin, TX

ABSTRACT

We identify 13 problems whose solutions can significantly enhance our ability to design and analyze firewalls and other packet classifiers. These problems include the firewall equivalence problem, the firewall redundancy problem, the firewall verification problem, and the firewall completeness problem. The main result of this paper is to prove that every one of these problems is NP-hard. Our proof of this result is interesting in the following way. Only one of the 13 problems, the so called slice probing problem, is shown to be NP-hard by a reduction from the well-known 3-SAT problem. Then, the remaining 12 problems are shown to be NP-hard by reductions from the slice probing problem. This proof suggests that the slice probing problem plays an important role in the design and analysis of firewalls. The negative results of this paper suggest that firewalls designers may need to rely on SAT solvers to solve instances of these 13 problems or may be content with probabilistic solutions of these problems. On the positive side, we show that each of the 13 firewall analysis problems presented in this paper is polynomially reducible to the slice probing problem. Thus any algorithm, that can effectively solve the slice probing problem, can also be employed to effectively solve any of these 13 problems.

INDEX TERMS

Firewalls (computing), Algorithm design and analysis, Polynomials, Redundancy, Time complexity, Internet, Electronic mail

CITATION

E. S. Elmallah and M. G. Gouda, "Hardness of Firewall Analysis," in

*IEEE Transactions on Dependable and Secure Computing*, vol. 14, no. 3, pp. 339-349, 2017.

doi:10.1109/TDSC.2015.2455532

CITATIONS