ACLA: A Framework for Access Control List (ACL) Analysis and Optimization

Abstract

It is a challenging task for network administrators to correctly implement corporate security policies in a large network environment Much of the security policy enforcement at the network level involves configuring the packet classification strategies using Access Control List (ACL). A gateway device performing traffic filtering can deploy ACLs with thousands of rules. Due to the difficulties of ACL configuration language, large ACLs can easily become redundant, inconsistent, and difficult to optimise or even understand. This problem is augmented by extrinsic factors such as administrator turnovers, unstructured and ill-planned topology changes. With multiple routers in the topology, all of the ACLs need to be configured in a consistent manner to enforce the corporate security policy. In such an environment, manual examination of ACLs to ensure security policy is implemented correctly is a nearly impossible task. In this paper, we propose a novel framework to automate ACL analysis, thus greatly simplifying the network administrator'S task of implementing and verifying corporate security policies. A set of algorithms is introduced to detect and remove redundant rules, discover and repair inconsistent rules, merge overlapping or adjacent rules, map an ACL with complex interleaving permit/deny rules to a more readable form consisting of all permits or denies, and finally compute a meta-ACL profile based on all ACLs along a network path. When applied to traffic filtering ACLs, the meta-profile provides insights to the administrator as to what traffic will flow successfully from source to destination. Based on the ideas presented in this paper, weve developed a generic library called ACLA (ACL Analyser).

On the Safety and Efficiency of Firewall Policy Deployment

“…This work has formalized types of conflicts in firewall policies and provided a variety of fast and efficient algorithms to detect them. Going one step further, researchers have proposed optimization algorithms to generate more concise and efficient firewall policies, using techniques like address/port combination and performance tuning based on traffic analysis [31,22,11]. All this research is orthogonal to our work, and can be applied to improve the quality of firewall policies before they are deployed.…”

“…To address the policy specification problem, policy provisioning and management have received a great deal of attention [16,26,21], as have conflict detection [13,20,15,14,38] and optimization [31,22,11]. In parallel with this academic research, firewall management tools such as Cisco Security Manager [4], Juniper Networks' Netscreen-Security Manager [8], and Check Point SmartCenter [1] have gained popularity with network administrators.…”

Dynamic counter-measures for risk-based access control systems: An evolutive approach

“…For this proposal instantiation, the following features will be considered in the assessment of a candidate solution CM i : (i) type 1]). Each one of these aspects has an associated weight w ∈ [0, 1] in the general candidate fitness Eq.…”

“…We define the measured risk level value as RL(A i , T j ) ∈ [1,10], where 1 is the lowest risk value and 10 the highest risk value that can be measured.…”

Sharing and access right delegation for confidential documents: A practical solution

“…At a first glance, this problem is related to access control, one of the common techniques is to make use of an Access Control List (ACL) (Barkley 1997, Li et al 2002, Qian 2001, Stiegler 1979) which states clearly which user is allowed to access which resources (documents) together with the allowable operations (e.g. read, write, delete) in the form of a data structure (e.g.…”