Master thesis : Firewall polymorphism prototype architecture

Abstract

Modern firewall clusters provide redundancy against hardware failure but not against implementation-level attacks: a cluster of N identical instances is no harder to bypass than a single one. This thesis proposes firewall polymorphism, an architecture that addresses availability, throughput, and software diversity simultaneously.

The design encloses a set of heterogeneous, unmodified firewall instances inside a demilitarised zone bounded by two purpose-built components: a load balancer on the client side and a controller on the server side. The load balancer duplicates each incoming packet, forwarding a full copy to a hash-selected primary firewall and headers-only copies to all remaining instances. The controller collects the returning copies and implements a unanimity vote: a packet reaches the protected server only when every alive firewall has independently forwarded it. Because the firewalls share no state and may run different software or vendor implementations, an attacker must simultaneously bypass every instance to reach the server.

A heartbeat protocol detects firewall failures within a configurable timeout, adjusts the vote threshold dynamically, and reassigns flows to surviving instances without resetting connections. For established flows, an XDP kernel-level fast path bypasses AF_XDP userspace entirely, forwarding packets directly to the server interface via bpf_redirect.

The system is implemented using Linux XDP and AF_XDP and evaluated in a containerised topology. Correctness tests confirm that the voting and failover mechanisms behave as specified. Throughput measurements show the pipeline tracks a direct-path baseline closely up to approximately 500Mbit/s, a limit imposed by the single-threaded AF_XDP architecture of the prototype, with negligible overhead at lower rates.