A formal model of policy reconciliation

Proceedings - 23rd Euromicro International Conference on Parallel, Distributed, and Network-Based Processing, PDP 2015

Volumn , Issue , 2015, Pages 587-594

  Basile, Cataldo ^a   Lioy, Antonio ^a   Pitscheider, Christian ^a   Zhao, Shilong ^a  

^a POLITECNICO DI TORINO   (Italy)

Author keywords

Policy analysis; Policy reconciliation; Policy specification; Security policy

Indexed keywords

DEGREES OF FREEDOM (MECHANICS); SECURITY SYSTEMS;

APPLICATION LAYERS; DEGREE OF FREEDOM; FORMAL MODEL; PERFORMANCE ANALYSIS; POLICY ANALYSIS; POLICY SPECIFICATION; RECONCILIATION PROCESS; SECURITY POLICY;

SPECIFICATIONS;

EID: 84962914868     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/PDP.2015.42     Document Type: Conference Paper

References (29)

1. A. Wool, "Trends in Firewall Configuration Errors: Measuring the Holes in Swiss Cheese", IEEE Internet Computing, vol. 14, no. 4, pp. 58-65, July 2010.
2. Verizon Enterprise, "Data breach investigations report", 2009.
3. -, "Data breach investigations report", 2014.
4. 7Safe Limited, "Uk security breach investigations report", 2010.
5. Center for Strategic and International Studies, "Securing cyberspace for the 44th presidency", December 2008.
6. Forrester Research, "How to manage your information security policy framework", January 2006.
7. E. Al-Shaer and H. Hamed, "Discovery of policy anomalies in distributed firewalls", in INFOCOM 2004, Hong Kong, Cina, March 7-11 2004, pp. 2605-2616.
8. A. Mayer, A. Wool, and E. Ziskind, "Offline firewall analysis", International Journal of Information Security, vol. 5, no. 3, pp. 125-144, July 2006.
9. A. Khakpour and A. X. Liu, "Quarnet: A tool for quantifying static network reachability", IEEE/ACM Trans. Netw., vol. 21, no. 2, pp. 551-565, February 2009.
10. "http://www.secured-fp7.eu."
11. C. Basile, A. Cappadonia, and A. Lioy, "Geometric Interpretation of Policy Specification", in POLICY 2008: IEEE Workshop on Policies for Distributed Systems and Networks, Palisades, NY, June 2-4 2008, pp. 78-81.
12. -, "Network-Level Access Control Policy Analysis and Transformation", IEEE/ACM Transactions on Networking, vol. 20, no. 4, pp. 985-998, Aug. 2012.
13. A. Westerinen et al., "Terminology for Policy-Based Management", RFC-3198, 2001.
14. G. Szasz, Introduction to Lattice Theory. Academic Press, 1963.
15. A. X. Liu, E. Torng, and C. R. Meiners, "Firewall Compressor: An Algorithm for Minimizing Firewall Policies", in INFOCOM2008: The 27th Conference on Computer Communications, Phoenix, AZ, April 13-18 2008, pp. 176-180.
16. D. E. Taylor, "Survey and taxonomy of packet classification techniques", ACM Computing Surveys, vol. 37, no. 3, pp. 238-275, September 2005.
17. D. Taylor and J. Turner, "Scalable packet classification using distributed crossproducing of field labels", in 24th Annual Joint Conference of the IEEE Computer and Communications Societies., Miami, FL, March 13-17 2005, pp. 269-280.
18. E. Al-Shaer and H. Hamed, "Modeling and Management of Firewall Policies", IEEE Transactions on Network and Service Management, vol. 1, no. 1, pp. 2-10, April 2004.
19. C. Basile and A. Lioy, "Analysis of Application-Layer Filtering Policies With Application to HTTP", IEEE/ACM Transactions on Networking, vol. 99, no. PP, pp. 1-1, December 2014.
20. J. Zao, "Semantic model for ipsec policy interaction", Internet Draft, March 10, 2000.
21. P. M. Daniel and A. Prakash, "Methods and limitations of security policy reconciliation", in 2002 IEEE Symposium on Security and Privacy, Berkeley, CA, May 12-15 2002, pp. 73-87.
22. P. McDaniel and A. Prakash, "Methods and limitations of security policy reconciliation", in 2002 IEEE Symposium on Security and Privacy, Oakland, CA, May 12-15 2002, pp. 73-87.
23. S. Jhat, M. Livny, and P. McDaniel, "Security policy reconciliation in distributed computing environments", in POLICY 2004:5th IEEE International Workshop on Policies for Distributed Systems and Networks, Yorktown Heights, NY, June 7-9 2004, pp. 137-146.
24. M. Roe, "Reconciling Multiple IPsec and Firewall Policies", in 15th International Workshop on Security Protocols, Brno, Czech Republic, April 18-20 2007, pp. 98-103.
25. P. Bonatti, S. De Capitani di Vimercati, and P. Samarati, "An algebra for composing access control policies", ACM Transactions on Information and System Security, vol. 5, no. 1, pp. 1-35, February 2002.
26. G. Bruns, D. S. Dantas, and M. Huth, "A simple and expressive semantic framework for policy composition in access control", in FMSE07:2007 ACM workshop on Formal methods in security engineering, Arlington, VA, November 2 2007, pp. 12-21.
27. N. Li, Q. Wang, W. Qardaji, E. Bertino, P. Rao, J. Lobo, and D. Lin, "Access control policy combining", in SACMAT09:14th ACM symposium on Access control models and technologies, Stresa, Italy, June 2-5 2009, pp. 135-144.
28. P. Rao, D. Lin, E. Bertino, N. Li, and J. Lobo, "An algebra for finegrained integration of XACML policies", in SACMAT09:14th ACM symposium on Access control models and technologies, Stresa, Italy, June 2-5 2009, pp. 63-72.
29. J. Crampton and C. Morisset, "PTaCL: A language for attribute-based access control in open systems", pp. 390-409, March 24 - April 1 2012.