Inconsistency Detecting and Resolving for Security Policy and IPv6 Firewall Policy

Firewall is the first defense line for network security. Packet filtering is a basic function in firewall, it filter network packets according to a series of rules, which is called firewall policy. The design of firewall policy should be observe the regulations of security policy, which is a generic guideline that lists the basic requirements for network access permissions. However, even for IPv4 firewall policy, it is extremely hard to keep the consistency between firewall policy and security policy. Some inconsistency decision methods of security policy and IPv4 firewall policy were proposed. However, the address space of IPv6 address is a very large, the existing inconsistency decision methods could not be directly used to handle IPv6 firewall policy. To resolve the above problem, in this work, we use a formal technique to find and eliminate the inconsistencies between security policy and IPv6 firewall policy. We also build a prototype system and test the effectiveness of the proposed method through experiments.