TY - GEN
T1 - Aggregating and deploying network access control policies
AU - Alfaro, Joaquín G.
AU - Cuppens, Frédéric
AU - Cuppens-Boulahia, Nora
PY - 2007/1/1
Y1 - 2007/1/1
N2 - The existence of errors or inconsistencies in the configuration of security components, such as filtering routers and/or firewalls, may lead to weak access control policies -potentially easy to be evaded by unauthorized parties. We present in this paper a proposal to create, manage, and deploy consistent policies in those components in an efficient way. To do so, we combine two main approaches. The first approach is the use of an aggregation mechanism that yields consistent configurations or signals inconsistencies. Through this mechanism we can fold existing policies of a given system and create a consistent and global set of access control rules - easy to maintain and manage by using a single syntax. The second approach is the use of a refinement mechanism that guarantees the proper deployment of such a global set of rules into the system, yet free of inconsistencies.
AB - The existence of errors or inconsistencies in the configuration of security components, such as filtering routers and/or firewalls, may lead to weak access control policies -potentially easy to be evaded by unauthorized parties. We present in this paper a proposal to create, manage, and deploy consistent policies in those components in an efficient way. To do so, we combine two main approaches. The first approach is the use of an aggregation mechanism that yields consistent configurations or signals inconsistencies. Through this mechanism we can fold existing policies of a given system and create a consistent and global set of access control rules - easy to maintain and manage by using a single syntax. The second approach is the use of a refinement mechanism that guarantees the proper deployment of such a global set of rules into the system, yet free of inconsistencies.
U2 - 10.1109/ARES.2007.34
DO - 10.1109/ARES.2007.34
M3 - Conference contribution
AN - SCOPUS:34548173265
SN - 0769527752
SN - 9780769527758
T3 - Proceedings - Second International Conference on Availability, Reliability and Security, ARES 2007
SP - 532
EP - 539
BT - Proceedings - The Second International Conference on Availability, Reliability and Security, ARES 2007
PB - IEEE Computer Society
T2 - 2nd International Conference on Availability, Reliability and Security, ARES 2007
Y2 - 10 April 2007 through 13 April 2007
ER -