BINARY DECISION DIAGRAM REPRESENTATIONS OF FIREWALL AND ROUTER ACCESS LISTS
Scott Hazelhurst, Anton Fatti, Andrew Henwood · 1998
Network firewalls and routers can use a rule database to decide which packets will be allowed from one network onto another. By filtering packets the firewalls and routers can improve security and performance -- by excluding packets which may pose a security risk to a network or are not relevant to it. However, as the size of the rule list increases, it becomes difficult to maintain and validate the rules, and the cost of rule lookup may add significantly to latency. Ordered binary decision diagrams (BDDs) -- a compact method of representing and manipulating boolean expressions -- are a potential method of representing the rules. This paper explores how BDDs can be used to develop methods that help analysis of rules to validate them and changes to them, to improve performance, and facilitate hardware support. 1 Introduction The growth of network and internet communication creates several challenges for network design. Two important issues are security and performance. As the volume o...