Binary decision diagram representations of firewall and router access lists

Abstract

The growth of network and internet communication creates several challenges for network design. Two important issues are security and performance. As the volume of communication increases together with the importance of availability and the criticality of network applications to organisational goals, the demands of performance and security will become more important. Network routers and firewalls can play an important role in improving performance and security. First, by filtering out packets that are not relevant to a subnet, congestion on a network can be reduced. This increases subnet performance due to reduction of network traffic and load on the computers in the subnet. Second, firewalls can prevent packets which are not authorised to enter an internal network from doing so. Routers and firewalls (hereinafter, for simplicity just called 'filters') typically have a set of rules (the 'rule set') to determine whether packets should be accepted. When a packet arrives, the filter compares the packet (commonly only the packet header) against the filter rules and then either accepts or rejects the packet.