doi:10.1016/j.comcom.2007.01.019
Copyright © 2007 Elsevier B.V. All rights reserved.
Crosslayer firewall interaction as a means to provide effective and efficient protection at mobile devices
aIHP, Im Technologiepark 25, 15236 Frankfurt (Oder), Germany
bDFS Deutsche Flugsicherung GmbH, Langen, SH/IR, Am DFS-Campus 2, 63225 Langen, Germany
Available online 16 February 2007.
Abstract
In this paper, we discuss packet filtering firewalls and an application level gateway approach used to secure handheld devices. We propose a firewall management plane as a means for crosslayer interaction. In our approach the application level gateway updates the firewall rules based on its knowledge about whether or not a certain source is sending malicious packets. Hereby, we pursue a policy of removing malicious packets as close as possible to the network interface. We show that in case of secure web service such a crosslayer interaction can significantly decrease the CPU load in case of attacks, i.e., if many malicious packets arrive at the handheld device. Our measurement results show that our crosslayer approach can reduce the CPU load caused by the application layer gateway by about 10–30%. Finally, we propose an integrated firewall processing approach that promises further improvements. It integrates the application controlled firewall before the MAC and provides crosslayer mechanisms to reduce the performance issues of traditional firewall approaches.
Keywords: Firewall management plane; Crosslayer interaction; XML; MAC firewall; Mobile devices
Fig. 1. Current implementation of a Firewall Management Plane, displaying used software modules and crosslayer interaction.
Fig. 2. Measurement set-up.
Fig. 3. CPU usage in percent vs. size of the applied rules set for IP layer packet filtering using of IP tables and nf-HiPAC; measurements done on HP IPAQ h5550; using a wireless connection via 802.11b.
Fig. 4. CPU load of an iPAQ running our Web service client with diverse security settings applied for incoming Web service answers.
Fig. 5. CPU load in jiffies for diverse settings of our application level gateway running on an iPAQ h5550; measurements displayed for the following packet sizes: 1000, 100, 5, and 1 KB requests.
Fig. 6. CPU load caused by Web service provider with and without using crosslayer interaction in scenarios with different percentage of malicious request; measurements done on an iPAQ h5550.
Fig. 7. The idea of the MAC firewall.
Fig. 8. The throughput of the firewall solution depending on the number of rules and packet size.
Fig. 9. The CPU utilization depending on the number of rules and packet size.
Fig. 10. Schematic view of the proposed crosslayer architecture for a firewall management plane including content inspection on the application layer.
Fig. 11. The architecture of the proposed Integrated Layer firewall solution.
Table 1.
The CPU utilization while packed dropped depending on the layer


Corresponding author. Tel.: +49 335 56 25 350; fax: +49 335 56 25 671.