Minimizing Range Rules for Packet Filtering Using a Double Mask Representation

Ahmad Abboud (1) , Abdelkader Lahmadi (1) , Michaël Rusinowitch (2) , Miguel Couceiro (3) , Adel Bouhoula (4)

1 RESIST - Resilience and Elasticity for Security and ScalabiliTy of dynamic networked systems
2 PESTO - Proof techniques for security protocols
3 ORPAILLEUR - Knowledge representation, reasonning
4 SUP'COM [TUNIS] - Ecole supérieure des communications de Tunis

In this work, we introduce a novel representation of packet filtering rules, so called double masks, where the first mask is used as an inclusion prefix and the second one for exclusion. An efficient algorithm is developed to compute a set of double masks for a given range.

Domaines: Informatique [cs]

Ahmad Abboud, Abdelkader Lahmadi, Michaël Rusinowitch, Miguel Couceiro, Adel Bouhoula. Minimizing Range Rules for Packet Filtering Using a Double Mask Representation. IFIP Networking 2019, May 2019, Varsovie, Poland. ⟨hal-02393008⟩