Improving Network Security Using Elliptic Curve Cryptosystem

Simple packet filters selectively controls the flow of packets in/out of a network or between networks. Control is based and enforced through a series of rules. These rules are based on information stored in the IP and TCP/UDP/ICMP headers.
Rule criteria can be based on the following characteristics of the IP packet:
➢    Source and/or destination addresses
➢    Protocol including TCP, UDP, ICMP, or all IP
➢    TCP or UDP source and/or destination ports
➢    ICMP message type
➢    TCP flags, especially ACK (to distinguish a new connection from a reply to an established connection)

ii.    Stateful inspection filter):
When a packet arrives on the outside interface, it could be one of the two things:
➢    A packet intended to start a new connection originating from the outside. This is risky because the packet may be inappropriate or malicious.
➢    A packet that is replying to the request initiated from inside. This is less likely to present a risk and more likely to be legitimate.
Both a brand new packet and a reply packet both appear similar because both have source IPs from the outside, destination IPs for inside, and appear to external interface. The only difference is in the TCP flag bit, that is:
➢    New traffic has SYN while return traffic for exiting connections has ACK.
➢    TCP flags can be crafted or manipulated so these are not good ways to track state.
➢    UDP, ICMP and other protocols do not have the flags.
Thus stateful inspection should be used whenever there is a need to differentiate between an incoming return/reply packet for an outgoing connection and an incoming packet for an incoming connection. This type of firewalls extracts state related information from the application layer, such as the FTP PORT, command that defines the data channel port and open that port for the life of the connection. The stately inspection filters maintain tables to track the state of each packet. The state tables stores source address, destination address, source port, destination port, and connection expiration time limit. Any packets that match a connection in the table is considered part of the same connection. Packets that did not match an existing connection in the table are considered new and are added to the table (assuming that the connection passes the filtering rules which have been defined).
iii.    Application Proxy