Tools for domain-based policy management of distributed systems

Damianou, Nicodemos; Dulay, Naranker; Lupu, Emil; Sloman, Morris; Tonouchi, Toshio

doi:10.1109/noms.2002.1015565

Cited by 74 publications

(69 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…This could prove to be a viable approach in applications that are not time critical, but it still requires manual intervention. B Another approach found in the literature ( [5,8]) is to enforce only the policy with the highest priority in the set -assuming policies have been assigned priorities. This scheme is often mentioned in the context of quality of service policy, and its usefulness may be constrained to that niche.…”

Section: Strategies For Conflict Resolutionmentioning

confidence: 99%

See 1 more Smart Citation

Generic Policy Conflict Handling Using a priori Models

Kempter

Danciu²

2005

Ambient Networks

View full text Add to dashboard Cite

Abstract. The promise of policy-based management is lessened by the risk of conflicts between policies. Even with careful conception of the policies it is difficult if not impossible to avoid conflicts completely. However, it is in principle possible to detect and resolve conflicts either statically or at runtime. Taking advantage of existing managed systems models it is even possible to detect and resolve policy conflicts not addressed until now. In this paper we present a generic approach to automated policy conflict detection based on existing knowledge about a managed system. We describe a methodology to derive conflict definitions from invariants of managed systems models, and show how these can be used to detect and resolve policy conflicts automatically.

show abstract

Section: Strategies For Conflict Resolutionmentioning

confidence: 99%

“…Damianou [5] uses so called meta policies, which are part of the Ponder specification, to formalize policy conflicts. A meta policy specifies constraints regarding a set of policies.…”

Section: Related Workmentioning

confidence: 99%

Generic Policy Conflict Handling Using a priori Models

Kempter

Danciu²

2005

Ambient Networks

View full text Add to dashboard Cite

show abstract

“…al. also add to the concepts of policy and Pbnm by incorporating the concept of "Domains" into the semantics ( [11,12,13]). Domains are a collection of managed objects that are under one administrative control and are related by "subject".…”

Section: Policy Abstractionmentioning

confidence: 99%

“…The formal specification from Imperial College ( [15,14]). Ponder is a declarative, object-oriented language that supports events, constraints, roles, templates and other useful language features.…”

Section: Pondermentioning

confidence: 99%

Policy Interoperability and Network Autonomics

Magrath

Braun

Cuervo³

2005

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Autonomic behaviours in network operations will alleviate much of the labour intensive and error prone interventions of today's complex networks. The Service Provider must be able to manage the infrastructure and services at an abstract level, focusing on what the desired behaviour should be rather than how it might be specifically achieved. Policy-Based Network Management (Pbnm) appears as one of the leading mechanisms to describe desired behaviours and abstract the programmability of an autonomic network infrastructure to the Service Provider. For massive-scale and complex networks, the current understanding of the Higher Level to Lower Level (HL→LL) refinement process commonly used in Pbnm today is not completely effective. One problem encountered is the need to provide a bind mechanism between Higher Level and Lower Level policy specifications such that cross-layer policy requests in the policy continuum can be made by lower policy layers in a dynamic policy refinement cycle (LL→HL→LL). In this paper, we illustrate the problem with a policy-based simple admission control (SAC) application. We then show that policy specifications with a join operator ( ) simplify the SAC specification. We also investigate the performance considerations of this enhancement in Internet size applications. Our future goal is to provide a policy inference engine that can support complex specifications appropriate for Pbnm systems that support autonomic behaviours in large networks, made of Network elements with realistic memory and processing constraints.

show abstract

“…Most prior work in the policy field can be divided into three major categories: policy specification [3,5], resolving policy conflicts [6,7], and distributed enforcement [8,9].…”

Section: Related Workmentioning

confidence: 99%

Path-Based Access Control for Enterprise Networks

Burnside

Keromytis

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Enterprise networks are ubiquitious and increasingly complex. The mechanisms for defining security policies in these networks have not kept up with the advancements in networking technology. In most cases, system administrators define policies on a per-application basis, and subsequently, these policies do not interact. For example, there is no mechanism that allows a web server to communicate decisions based on its ruleset to a firewall in front of it, even though decisions being made at the web server may be relevant to decisions at the firewall. In this paper, we describe a path-based access control system for serviceoriented architecture (SOA)-style networks which allows services to pass access-control-related information to neighboring services, as the services process requests from outsiders and from each other. Path-based access control defends networks against a class of attacks wherein individual services make correct access control decisions but the resulting global network behavior is incorrect. We demonstrate the system in two forms, using graph-based policies and by leveraging the KeyNote trust management system.

show abstract

Tools for domain-based policy management of distributed systems

Cited by 74 publications

References 17 publications

Generic Policy Conflict Handling Using a priori Models

Generic Policy Conflict Handling Using a priori Models

Policy Interoperability and Network Autonomics

Path-Based Access Control for Enterprise Networks

Contact Info

Product

Resources

About