Improving the Configuration Management of Large Network Security Systems

Albuquerque, João Porto de; Isenberg, Holger; Krumm, Heiko; Geus, Paulo Lício de

doi:10.1007/11568285_4

Cited by 9 publications

(15 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…This validation builds upon a formalism for the modelling framework that appeared in previous works [7,8], in order to establish general conditions that a given system and policy model must uphold to assure the correctness of the policy refinement, i.e. general validation conditions for ensuring that the generated lower-level policies uphold the abstract policies defined by the user.…”

Section: Resultsmentioning

confidence: 99%

“…A comprehensive covering of these application cases lies outside the scope of the present paper as it is done elsewhere [7,8,10]. To give a flavour of the results achieved, though, Fig.…”

Section: Practical Application and Use Examplementioning

confidence: 97%

“…The approach has shown its practical relevance in a series of case studies [7,8,10]. A supporting tool was implemented and has been employed for the integrated configuration management of packet filters and VPN gateways of realistic network environments, with different number of network elements and growing security policy complexity.…”

Section: Practical Application and Use Examplementioning

confidence: 99%

“…After the model is complete, an automated policy refinement process takes place that generates policy sets for the lower levels, ultimately achieving the derivation of configuration parameters for all the security mechanisms of the system. In a further development, the scalability of the approach was improved by means of an additional layer, the Diagram of Abstract Subsystems (DAS), in order to cope with large-scale, complex network environments [7][8][9].…”

Section: Previous Workmentioning

confidence: 99%

See 3 more Smart Citations

Formal validation of automated policy refinement in the management of network security systems

Albuquerque

Krumm

Geus

2010

Int. J. Inf. Secur.

Self Cite

View full text Add to dashboard Cite

Policy hierarchies and automated policy refinement are powerful approaches to simplify administration of security services in complex network environments. A crucial issue for the practical use of these approaches is to ensure the validity of the policy hierarchy, i.e. since the policy sets for the lower levels are automatically derived from the abstract policies (defined by the modeller), we must be sure that the derived policies uphold the high-level ones. This paper builds upon previous work on Model-based Management, particularly on the Diagram of Abstract Subsystems approach, and goes further to propose a formal validation approach for the policy hierarchies yielded by the automated policy refinement process. We establish general validation conditions for a multi-layered policy model, i.e. necessary and sufficient conditions that a policy hierarchy must satisfy so that the lower-level policy sets are valid refinements of the higher-level policies according to the criteria of consistency and completeness. Relying upon the validation conditions and upon axioms about the model representativeness, two theorems are proved to ensure compliance between the resulting system behaviour and the abstract policies that are modelled.

show abstract

Section: Resultsmentioning

confidence: 99%

“…A comprehensive covering of these application cases lies outside the scope of the present paper as it is done elsewhere [7,8,10]. To give a flavour of the results achieved, though, Fig.…”

Section: Practical Application and Use Examplementioning

confidence: 97%

Section: Practical Application and Use Examplementioning

confidence: 99%

Section: Previous Workmentioning

confidence: 99%

See 2 more Smart Citations

Formal validation of automated policy refinement in the management of network security systems

Albuquerque

Krumm

Geus

2010

Int. J. Inf. Secur.

Self Cite

View full text Add to dashboard Cite

show abstract

“…These models define policies in a higher level of abstraction relying upon roles. Policies at this level are defined by object manipulation in a graphical interface, similar to the one used by [4], [5].…”

Section: Introductionmentioning

confidence: 99%

A Policy-Based Framework for Interoperable Digital Content Management

Filho¹,

Albuquerque²,

Geus³

et al. 2007

2007 4th IEEE Consumer Communications and Networking Conference

Self Cite

View full text Add to dashboard Cite

Through the past years, several digital rights management (DRM) solutions for controlled dissemination of digital information have been developed using cryptography and other technologies. Within so many different solutions, however, interoperability problems arise, which increase the interest on integrated design and management of these technologies. Pursuing these goals, this paper presents a framework which aims at promoting interoperability among DRM systems, using a serviceoriented architecture (SOA) and a high-level policy modeling approach.

show abstract

Scalable model‐based configuration management of security services in complex enterprise networks

et al. 2010

Self Cite

View full text Add to dashboard Cite

Security administrators face the challenge of designing, deploying and maintaining a variety of configuration files related to security systems, especially in large‐scale networks. These files have heterogeneous syntaxes and follow differing semantic concepts. Nevertheless, they are interdependent due to security services having to cooperate and their configuration to be consistent with each other, so that global security policies are completely and correctly enforced. To tackle this problem, our approach supports a comfortable definition of an abstract high‐level security policy and provides an automated derivation of the desired configuration files. It is an extension of policy‐based management and policy hierarchies, combining model‐based management (MBM) with system modularization. MBM employs an object‐oriented model of the managed system to obtain the details needed for automated policy refinement. The modularization into abstract subsystems (ASs) segment the system—and the model—into units which more closely encapsulate related system components and provide focused abstract views. As a result, scalability is achieved and even comprehensive IT systems can be modelled in a unified manner. The associated tool MoBaSeC (Model‐Based‐Service‐Configuration) supports interactive graphical modelling, automated model analysis and policy refinement with the derivation of configuration files. We describe the MBM and AS approaches, outline the tool functions and exemplify their applications and results obtained. Copyright © 2010 John Wiley & Sons, Ltd.

show abstract

Improving the Configuration Management of Large Network Security Systems

Cited by 9 publications

References 11 publications

Formal validation of automated policy refinement in the management of network security systems

Formal validation of automated policy refinement in the management of network security systems

A Policy-Based Framework for Interoperable Digital Content Management

Scalable model‐based configuration management of security services in complex enterprise networks

Contact Info

Product

Resources

About