CC BY
48
IMPROVING FIREWALL SECURITY PERFORMANCE
УДК 004.415(043)
Al Kaibi Eman Gabar Abdul Hasen
graduate student at Moscow State University of Economics, Statistics and Informatics Tel. 8(903) -279-31-91 E-mail: Eman [email protected]
Dr.Naufel Bahjat Mohammed
E-mail: nbm [email protected]
This research presents a new method of access control mechanism within firewall to prevent external attacks. Traffic analysis will be prevented by using Address Masking Operation (AMO), in which all the addresses of the end users transformed periodically by Address Transformation Matrix (ATM), All the process done by Address Changing Controller (ACC) .
Keywords: security, firewall, control methods.
Ал Каиби Еман Габар Абдул Хасен
аспирантка Московского государственного университета экономики, статистики и информатики Тел. 8(903) -279-31-91 Эл. почта: Eman [email protected]
Науфел Бахжат Мохаммед
Эл. почта: nbm [email protected]
СОВЕРШЕНСТВОВАНИЕ ЭФФЕКТИВНОСТИ БЕЗОПАСНОСТИ FIREWALL
Это исследование представляет новую методику механизма управления доступом в пределах брандмауэра, чтобы предотвратить внешние нападения. Транспортный анализ будет предотвращен при использовании маскирующей операции адреса в который все адреса конечных пользователей, преобразовываемых периодически матрицей преобразования адреса, весь процесс, сделанный диспетчером изменения адреса.
Ключевые слова: безопасность, брандмауэр, методы контроля.
1. Introduction: Firewall is a network security device controlling traffic flow between Two ports of a network [1]. Firewall don't protect against insider threats. Blocking services may create inconvenience for users. Network diagnostic May be harder. Some protocols are hard to support. Packet filtering firewalls don't provide any content-based filtering. Even application proxy firewalls may not perform through checks on content. Firewalls don't know about operating system or application vulnerabilities. A lot of services are today using http at port 80 so it becomes increasingly difficult to decide which traffic on this port is legitimate [2].
2. Firewall characteristic: This research follows the goals below for a firewall design [1].
1. All traffic from inside to outside, and vice versa, must pass through the firewall. This is achieved by physically blocking all access to the local network except via the firewall. Various configurations are possible, as explained later in this section.
2. Only authorized traffic, as defined by the local security policy, will be allowed to pass. Various types of firewalls are used, which implement various types of security policies, as explained later in this section.
3. The firewall itself is immune to penetration. This implies that use of a trusted system with a secure operating system.
3. Firewall control techniques: The four general techniques that firewalls use to control access and enforce the site's security policy. Originally, firewalls focused primarily on service control, but they have since evolved to provide all four [3]:
• Service control: Determines the types of Internet services that can be accessed, inbound or outbound. The firewall may filter traffic on the basis of IP address and TCP port number; may provide proxy software that receives and interprets each service request before passing it on; or may host the server software itself, such as a Web or mail service.
• Direction control: Determines the direction in which particular service requests may be initiated and allowed to flow through the firewall.
• User control: Controls access to a service according to which user is attempting to access it. This feature is typically applied to users inside the firewall perimeter (local users). It may also be applied to incoming traffic from external users; the latter requires some form of secure authentication technology.
• Behavior control: Controls how particular services are used. For example, the firewall may filter e-mail to eliminate spam, or it may enable external access to only a portion of the information on a local Web server.
4. Firewalls Types: There are three common types of firewalls: packet filters, application-level gateways, and circuit-level gateways. We examine each of these in turn [2].
4.1 Packet-Filtering Router: A packet-filtering router applies a set of rules to each incoming and outgoing IP packet and then forwards or discards the packet. The router is typically configured to filter packets going in both directions (from and to the internal network). Filtering rules are based on information contained in a network packet:
• Source IP address: The IP address of the system that originated the IP packet (e.g., 192.178.1.1)
• Destination IP address: The IP address of the system the IP packet is trying to reach (e.g., 192.168.1.2)
• Source and destination transport-level address: The transport level (e.g., TCP or UDP) port number, which defines applications such as SNMP or TELNET
• IP protocol field: Defines the transport protocol
• Interface: For a router with three or more ports, which interface of the router the packet came from or which interface of the router the packet is destined for the packet filter is typically set up as a list of rules based on matches to fields in the IP or TCP header. If there is a match to one of the rules, that rule is invoked to determine whether to forward or discard the packet. If there is no match to any rule, then a default action is taken. Two default policies are possible:
• Default = discard: That which is not expressly permitted is prohibited.
• Default = forward: That which is not expressly prohibited is permitted.
The default discard policy is more conservative. Initially, everything is blocked,
and services must be added on a case-by-case basis. This policy is more visible to users, who are more likely to see the firewall as a hindrance. The default forward policy increases ease of use for end users but provides reduced security; the security administrator must, in essence, react to each new security threat as it becomes known.
Table (1) gives some examples of packet-filtering rule sets. In each set, the rules are applied top to bottom. The "*" in a field is a wildcard designator that matches everything. We assume that the default = discard policy is in force.
A. Inbound mail is allowed (port 25 is for SMTP incoming), but only to a gateway host. However, packets from a particular external host, SPIGOT, are blocked because that host has a history of sending massive files in e-mail messages.
B. This is an explicit statement of the default policy. All rule sets include this rule implicitly as the last rule.
C. This rule set is intended to specify that any inside host can send mail to the outside. A TCP packet with a destination port of 25 is routed to the SMTP server on the destination machine. The problem with this rule is that the use of port 25 for SMTP receipt is only a default; an outside machine could be configured to have some other application linked to port 25. As this rule is written, an attacker could gain access to internal machines by sending packets with a TCP source port number of 25.
D. This rule set achieves the intended result that was not achieved in C. The
A action ourhost port theirhost port comment
block к X SPIGOT we don't trust these people
allow OUR-GW * TK connection to aur SMTP port
R action ourhost port theirho&t port comment
block йв w w W default
С action ourhost port theirhost port comment
allow TZ X ж 25 connection to their SMTP port
0 action 5ГС port de*t port flogs comment
allow -[our hosts} * * 25 our packets to their SMTP port
allow - 25 - * ACK their replies
E action 5ГС port dest port Hogs comment
allow {our hosts} r ж * qur outgoing calls
allow * * ■ ACK replies to our calls
-allow - * M >1024 traffic t» nonse-rvers
№4, 2011 ^^
П
Security peril lldlrif
filtering [
router
inj J'ntktfi-tllierii^ uMJitf Application-level
Hbi Application-level tuildttty
С irviikl level JiillCWLiy
libido hoel
(OCirtttil-tevd gatewty Figure 1. Firewall Types
Table 1. Packet-Filtering Examples
rules take advantage of a feature of TCP connections. Once a connection is set up, the ACK flag of a TCP segment is set to acknowledge segments sent from the other side. Thus, this rule set states that it allows IP packets where the source IP address is one of a list of designated internal hosts and the destination TCP port number is 25. It also allows incoming packets with a source port number of 25 that include the ACK flag in the TCP segment. Note that we explicitly designate source and destination systems to define these rules explicitly.
E. This rule set is one approach to handling FTP connections. With FTP, two TCP connections are used: a control connection to set up the file transfer and a data connection for the actual file transfer. The data connection uses a different port number that is dynamically assigned for the transfer. Most servers, and hence most attack targets, live on low-numbered ports; most outgoing calls tend to use a higher-numbered port, typically above 1023. Thus, this rule set allows : -Packets that originate internally -Reply packets to a connection initiated by an internal machine
-Packets destined for a high-numbered port on an internal machine
This scheme requires that the systems be configured so that only the appropriate port numbers are in use.
Rule set E points out the difficulty in dealing with applications at the packet-filtering level. Another way to deal with FTP and similar applications is an application-level gateway, described later in this section.
One advantage of a packet-filtering router is its simplicity. Also, packet filters typically are transparent to users and are very fast. Also the following weaknesses of packet filter firewalls:
• Because packet filter firewalls do not examine upper-layer data, they cannot prevent attacks that employ application-specific vulnerabilities or functions. For example, a packet filter firewall cannot block specific application commands; if a packet filter firewall allows a given application, all functions available within that application will be permitted.
• Because of the limited information available to the firewall, the logging functionality present in packet filter firewalls is limited. Packet filter logs normally contain the same information used to make access control decisions (source address, destination address, and traffic type).
• Most packet filter firewalls do not support advanced user authentication schemes. Once again, this limitation is mostly due to the lack of upper-layer functionality by the firewall.
• They are generally vulnerable to attacks and exploits that take advantage of problems within the TCP/IP specification and protocol stack, such as network layer address spoofing. Many packet filter firewalls cannot detect a network packet in which the OSI Layer 3 addressing information has been altered. Spoofing attacks are generally employed by intruders to bypass the security controls implemented in a firewall platform.
• Finally, due to the small number of variables used in access control decisions, packet filter firewalls are susceptible to security breaches caused by improper configurations. In other words, it is easy to accidentally configure a packet filter firewall to allow traffic types, sources, and destinations that should be denied based on an organization's information security policy.
Some of the attacks that can be made on packet-filtering routers and the appropriate countermeasures are the following:
• IP address spoofing: The intruder transmits packets from the outside with a source IP address field containing an address of an internal host. The attacker hopes that the use of a spoofed address will allow penetration of systems that employ simple source address security, in which packets from specific trusted internal hosts are accepted. The counter-measure is to discard packets with an inside source address if the packet arrives on an external interface.
• Source routing attacks: The source station specifies the route that a packet should take as it crosses the Internet, in the hopes that this will bypass security measures that do not analyze the source routing information. The countermeasure is to discard all packets that use this option.
• Tiny fragment attacks: The intruder uses the IP fragmentation option to create extremely small fragments and force the TCP header information into a separate packet fragment. This attack is designed to circumvent filtering rules that depend on TCP header information. Typically, a packet filter will make a filtering decision on the first fragment of a packet. All subsequent fragments of that packet are filtered out solely on the basis that they are part of the packet whose
first fragment was rejected. The attacker hopes that the filtering router examines only the first fragment and that the remaining fragments are passed through. A tiny fragment attack can be defeated by enforcing a rule that the first fragment of a packet must contain a predefined minimum amount of the transport header. If the first fragment is rejected, the filter can remember the packet and discard all subsequent fragments.
A traditional packet filter makes filtering decisions on an individual packet basis and does not take into consideration any higher layer context. To understand what is meant by context and why a traditional packet filter is limited with regard to context, a little background is needed. Most standardized applications that run on top of TCP follow a client/ server model. For example, for the Simple Mail Transfer Protocol (SMTP), e-mail is transmitted from a client system to a server system. The client system generates new e-mail messages, typically from user input. The server system accepts incoming e-mail messages and places them in the appropriate user mailboxes. SMTP operates by setting up a TCP connection between client and server, in which the TCP server port number, which identifies the SMTP server application, is 25. The TCP port number for the SMTP client is a number between 1024 and 65535 that is generated by the SMTP client.
In general, when an application that uses TCP creates a session with a remote host, it creates a TCP connection in which the TCP port number for the remote (server) application is a number less than 1024 and the TCP port number for the local (client) application is a number between 1024 and 65535. The numbers less than 1024 are the "well-known" port numbers and are assigned permanently to particular applications (e.g., 25 for server SMTP). The numbers between 1024 and 65535 are generated dynamically and have temporary significance only for the lifetime of a TCP connection.
A simple packet-filtering firewall must permit inbound network traffic on all these high-numbered ports for TCP-based traffic to occur. This creates a vulnerability that can be exploited by unauthorized users.
A stateful inspection packet filter tightens up the rules for TCP traffic by creating a directory of outbound TCP connections, as shown in Tabl2 (2) There is an entry for each currently established
connection. The packet filter will now allow incoming traffic to high-numbered ports only for those packets that fit the profile of one of the entries in this directory.
4.2 Application-Level Gateway (proxy server): An application-level gateway, also called a proxy server, acts as a relay of application-level traffic (Figure 2b). The user contacts the gateway using a TCP/IP application, such as Telnet or FTP, and the gateway asks the user for the name of the remote host to be accessed. When the user responds and provides a valid user ID and authentication information, the gateway contacts the application on the remote host and relays TCP segments containing the application data between the two endpoints. If the gateway does not implement the proxy code for a specific application, the service is not supported and cannot be forwarded across the firewall. Further, the gateway can be configured to support only specific features of an application that the network administrator considers acceptable while denying all other features . Application-level gateways tend to be more secure than packet filters. Rather than trying to deal with the numerous possible combinations that are to be allowed and forbidden at the TCP and IP level, the application-level gateway need only scrutinize a few allowable applications. In addition, it is easy to log and audit all incoming traffic at the application level . A prime disadvantage of this type of gateway is the additional processing overhead on each connection. In effect, there are two spliced connections between the end users, with the gateway at the splice point, and the gateway must examine and forward all traffic in both directions.
4.3 Circuit-Level Gateway: A third type of firewall is the circuit-level gateway (Figure 2c). This can be a standalone system or it can be a specialized function performed by an application-level gateway for certain applications. A circuit-level gateway does not permit an end-to-end TCP connection; rather, the gateway sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host. Once the two connections are established, the gateway typically relays TCP segments from one connection to the other without examining the contents. The security function consists of determining which connections will be allowed.
Table 2. Example Stateful Firewall Connection State Table
Source Address Source Port Destination Address Destination Port Connection State
192. 16E. 1.10D 1030 BO Established
192.168 ..1.102 1031 216,32.42.123 80 Established
192.163.1.101 1033 173-65 32-122 25 Established
192.166.1.106 103 Б 177.231,32.12 79 Established
223.43.21.231 1990 192-160-1-6 60 Established
219.22,123 2112 102.160,1.6 00 Established
210.99,212,18 3321 192,168,1.6 00 Established
24. 102.3223 1025 192-160.1.6 BO Established
223.212.212 1046 192.160,1.6 00 Established
Figure 2. Firewall Configurations
A typical use of circuit-level gateways is a situation in which the system administrator trusts the internal users. The gateway can be configured to support application-level or proxy service on inbound connections and circuit-level functions for outbound connections. In this configuration, the gateway can incur the processing overhead of examining incoming application data for forbid-
den functions but does not incur that overhead on outgoing data.
An example of a circuit-level gateway implementation is the SOCKS package : version 5 of SOCKS is defined in RFC 1928. The RFC defines SOCKS in the following fashion:
The protocol described here is designed to provide a framework for clientserver applications in both the TCP and
UDP domains to conveniently and securely use the services of a network firewall. The protocol is conceptually a "shim-layef' between the application layer and the transport layer, and as such does not provide network-layer gateway services, such as forwarding of ICMP messages.
SOCKS consists of the following components:
• The SOCKS server, which runs on a UNIX-based firewall.
• The SOCKS client library, which runs on internal hosts protected by the firewall.
• SOCKS-ified versions of several standard client programs such as FTP and TELNET. The implementation of the SOCKS protocol typically involves the recompilation or relinking of TCP-based client applications to use the appropriate encapsulation routines in the SOCKS library.
When a TCP-based client wishes to establish a connection to an object that is reachable only via a firewall (such determination is left up to the implementation), it must open a TCP connection to the appropriate SOCKS port on the SOCKS server system. The SOCKS service is located on TCP port 1080. If the connection request succeeds, the client enters a negotiation for the authentication method to be used, authenticates with the chosen method, and then sends a relay request. The SOCKS server evaluates the request and either establishes the appropriate connection or denies it. UDP exchanges are handled in a similar fashion. In essence, a TCP connection is opened to authenticate a user to send and receive UDP segments, and the UDP segments are forwarded as long as the TCP connection is open.
5. Firewall Configurations: In addition to the use of a simple configuration consisting of a single system, such as a single packet-filtering router or a single gateway (Figure 1), more complex configurations are possible and indeed more common. (Figure 2) illustrates three common firewall configurations. We examine each of these in turn[4].
In the screened host firewall, single-homed bastion configuration (Figure 2a), the firewall consists of two systems: a packet-filtering router and a bastion host. Typically, the router is configured so that
1. For traffic from the Internet, only IP packets destined for the bastion host are allowed in.
Figure 3. Basic Structure of address masking process
2. For traffic from the internal network, only IP packets from the bastion host are allowed out.
The bastion host performs authentication and proxy functions. This configuration has greater security than simply a packet-filtering router or an application-level gateway alone, for two reasons. First, this configuration implements both packet-level and application-level filtering, allowing for considerable flexibility in defining security policy. Second, an intruder must generally penetrate two separate systems before the security of the internal network is compromised.
This configuration also affords flexibility in providing direct Internet access. For example, the internal network may include a public information server, such as a Web server, for which a high level of security is not required. In that case, the router can be configured to allow direct traffic between the information server and the Internet.
In the single-homed configuration just described, if the packet-filtering router is completely compromised, traffic could flow directly through the router between the Internet and other hosts on the private network. The screened host firewall, dual-homed bastion configuration physically prevents such a security breach (Figure 2b). The advantages of dual layers of security that were present in the previous configuration are present here as well. Again, an information server or other hosts can be allowed direct
communication with the router if this is in accord with the security policy.
The screened subnet firewall configuration of Figure 2c is the most secure of those we have considered. In this configuration, two packet-filtering routers are used, one between the bastion host and the Internet and one between the bastion host and the internal network. This configuration creates an isolated sub network, which may consist of simply the bastion host but may also include one or more information servers and modems for dial-in capability. Typically, both the Internet and the internal network have access to hosts on the screened subnet, but traffic across the screened subnet is blocked. This configuration offers several advantages[5] :
• There are now three levels of defense to thwart intruders.
• The outside router advertises only the existence of the screened subnet to the Internet; therefore, the internal network is invisible to the Internet.
• Similarly, the inside router advertises only the existence of the screened subnet to the internal network; therefore, the systems on the inside network cannot construct direct routes to the Internet.
6. Address Transformation Matrix: There are two fundamental options to state who is in charge of setting security policies:
• discretionary: in which access control is at at the discretion of the owner .
• Mandatory: a system wide policy de-
crees who is allowed to have access [4].
To decide which access operations are permitted, we have to decide on the structures to use for capturing security policies, All these above done and decided by either Access Control Matrix (ACM) or Access Control List (ACL) [5]. For executing a demand of access, the operating system use the destination address to decide the route. This research used the Address Transformation Matrix (ATM) to mask and unmask of all the addresses of inter layer of the network , the masking process is a time variant process without the association of the end user and the process is controlled by address masking controller.
8. Address Masking Controller: The
aim of this process is to prevent attacker to reach the address of end user , the base address of each user is stored in address matrix and the address masked periodically using the Address Transformation Matrix (ATM) , this process will push the attacker to find the new address of his target each time the address had been masked , that will prevent the completion of the attacking process. fig.( 3 ) show the structure of the system.
7. Conclusion: The principle characteristic and types of firewall was presented , limitations and problems of firewall was discussed , solution by using address masking methodology was presented . A delay time was added to the system against the benefit of improving
firewall performance.
References
1. Dieter Gollmann , " Computer Security " , 2nd Edition , John wiley & sons , England, 2006
2. Chey Cobb , " Network Security For Dummies " , Wiley publishing Inc. , New York , 2003
3. Ross Anderson ," Security Engineering " , John Wiley & sons New York ,2001.
4. C. Alberts and A. Dorofee , " Managing Information Security Risks " , Pearson Education Inc. , Boston, 2003 .
5. J.Viega and C.McGraw," Building Secure Software ", Addison-Wesley , Boston , 2001.
П
