Transforming Security Policies in Firewalls Using the Shortest Editing Script Algorithm

In this paper, we propose a novel transformation of security policies of firewalls using the Shortest Edit Script (SES) algorithm that is employed in the widely known diff command. We here assume to configure a standby firewall in order to synchronize its security policies with one of an active firewall. Security policies in a standby firewall are transformed into those in an active firewall. We regard one security policy as a symbol, and entire security policies in a firewall are considered to be a sequence of these symbols. We have then attributed this transformation problem to the SES problem, and have solved it. Our prototype implementation has appeared to be able to transform security policies in a running firewall within 0.19 seconds where the number of security policies is about 500.