Firewall Rule Optimization Mechanism for IPv6-Based IoT Networks

As everything is connected to the Internet, the power and scale of cyber-attacks have become unprecedented and difficult to withstand. As the first line of defense, the number and types of filtering rules equipped in network firewalls have become increasingly large and complex due to the emergence of the Internet of Things (IoT). In order to ensure network security as well as the efficiency of online services, the number of firewall rules must be adjusted, organized, and simplified regularly or on time, whereas the tasks are always time-consuming and demanding for administrators owing to the occurrences of rule anomalies. In this study, a two-phased mechanism was developed to minimize the number of filtering rules equipped in firewalls without the loss of original filtering effects for the IPv6 traffic in high-speed IoT networks. To achieve the goal, with empirical observations, the mechanism includes a brand new split-and-merge method to effectively split and merge the traffic filtering areas of firewall rules to minimize the number of firewall rules. The system prototype has been implemented and runs on our IPv6 IoT networking environment. Comprehensive performance evaluations were conducted and comparisons between renowned systems. The results showed superior performance and effectiveness of the mechanism.