基于动态模板的策略翻译及配置方法

doi:10.11959/j.issn.1000-436x.2019236

Abstract

Abstract:

To solve the problem of complex,cumbersome and error-prone configuration of security devices caused by the heterogeneous configuration modes in complex networks,a dynamic template-based scheme for translating and configuring policy was proposed.In detail,considering the code’s features,the code-based template for translating policies was constructed to configure the command line conversion,and the keyword comparison method was used to ensure the accuracy of policy configuration.Experiments show that the scalability and the accuracy of the proposed scheme.

Key words: device configuration, security policy, policy translation, dynamic template

CLC Number:

TP311

Yunchuan GUO,Ling LI,Yongjun LI,Lin CHENG,Jun DU,Lingcui ZHANG. Policy translation and configuration using dynamic template[J]. Journal on Communications, 2019, 40(12): 138-148.

Figures/Tables 9

References 23

[1]	JOHNSON M , BRADSHAW J M , JUNG H ,et al. Policy management across multiple platforms and application domains[C]// IEEE Workshop on Policies for Distributed Systems and Networks. IEEE, 2008: 199-202.
[2]	HOLMES B L , . Heterogeneous systems:can they ever work together?[C]// Symposium Record Policy Issues in Information and Communication Technologies in Medical Applications. IEEE, 1988: 169-174.
[3]	DAMIANOU N , DULAY N , LUPU E,et.al . The ponder policy specification language[J]. Proc of policy, 2001,55(8): 18-38.
[4]	JANICKE H , CAU A , SIEWE F ,et al. Deriving enforcement mechanisms from policies[C]// IEEE International Workshop on Policies for Distributed Systems and Networks. IEEE, 2007: 161-172.
[5]	JANICKE H , CAU A , SIEWE F ,et al. A compositional event ＆time-based policy model[C]// IEEE International Workshop on Policies for Distributed Systems and Networks. IEEE, 2006: 173-182.
[6]	SIEWE F , CAU A , ZEDAN H . A compositional framework for access control policies enforcement[C]// The 2003 ACM workshop on Formal Methods in Security Engineering. ACM, 2003: 32-42.
[7]	JANICKE H , CAU A , SIEWE F ,et al. Dynamic access control policies:specification and verification[J]. The Computer Journal, 2012,56(4): 440-463.
[8]	LOBO J , BHATIA R , NAQVI S . A policy description language[C]// The 16th National Conference on Artificial Intelligence and the 11th Innovative Applications of Artificial Intelligence Conference. 1999: 291-298.
[9]	RIBEIRO C , ZUQUETE A , FERREIRA P ,et al. SPL:an access control language for security policies and complex constraints[C]// The Network and Distributed System Security Symposium. 2001,1.
[10]	DAMIANOU N , DULAY N , LUPU E ,et al. Tools for domain-based policy management of distributed systems[C]// IEEE/IFIP Network Operations and Management Symposium. IEEE, 2002: 203-217.
[11]	ABWNAWAR N , JANICKE H , SMITH R ,et al. Towards data privacy in heterogeneous cloud environments:an extension to the SANTA policy language[C]// 2017 Second International Conference on Fog and Mobile Edge Computing. IEEE, 2017: 14-19.
[12]	代向东 . 安全策略管理系统中策略描述及策略翻译关键技术研究[D]. 郑州:信息工程大学, 2007.
	DAI X D . Research on key technologies of policy description and policy translation in security policy management system[D]. Zhengzhou:Information Engineering University, 2007.
[13]	HALE J , GALIASSO P , PAPA M ,et al. Security policy coordination for heterogeneous information systems[C]// The 15th Annual Computer Security Applications Conference. IEEE, 1999: 219-228.
[14]	BEIGI M S , CALO S , VERMA D . Policy transformation techniques in policy-based systems management[C]// The 15th IEEE International Workshop on Policies for Distributed Systems and Networks. 2004: 13-22.
[15]	HAN W , FANG Z , YANG L T,et.al . Collaborative policy administration[J]. IEEE Transactions on Parallel and Distributed Systems, 2013,25(2): 498-507.
[16]	WANG R , ENCK W , REEVES D ,et al. EASEAndroid:automatic policy analysis and refinement for security enhanced android via large-scale semi-supervised learning[C]// 24th USENIX Security Symposium. 2015: 351-366.
[17]	LEIGHTON G , BARBOSA D . Access control policy translation,verification,and minimization within heterogeneous data federations[J]. ACM Transactions on Information and System Security, 2011,14(3): 1-28.
[18]	RUDOLPH M , FETH D , DOERR J,et.al . Requirements elicitation and derivation of security policy templates—an industrial case study[C]// The 24th International Requirements Engineering Conference. 2016.
[19]	YANG J , JEONG J P . An automata-based security policy translation for network security functions[C]// 2018 International Conference on Information and Communication Technology Convergence. IEEE, 2018: 268-272.
[20]	陈文惠 . 防火墙系统策略配置研究[D]. 合肥:中国科学技术大学, 2007.
	CHEN W H . Research on policy configuration of firewall system[D]. Hefei:University of Science and Technology of China, 2007.
[21]	LOBO J , MARCHI M , PROVETTI A . Firewall configuration policies for the specification and implementation of private zones[C]// 2012 IEEE International Symposium on Policies for Distributed Systems and Networks. IEEE, 2012: 78-85.
[22]	JILLEPALLI A , DE LEON D C , STEINER S ,et al. Hermes:a high-level policy language for high-granularity enterprise-wide secure browser configuration management[C]// 2016 IEEE Symposium Series on Computational Intelligence. IEEE, 2016: 1-9.
[23]	李福亮, 杨家海, 吴建平 ,等. 互联网自动配置研究[J]. 软件学报, 2014,25(1): 118-134.
	LI F L , YANG J H , WU J P ,et al. Research on Internet auto configuration[J]. Journal of Software, 2014,25(1): 118-134.

Metrics

Recommended 0

No Suggested Reading articles found!

设备类别	设备类型	操作系统
服务器	物理机	CentOS
安全设备	天融信NGFW防火墙	NGTOS
	华为USG6000V模拟防火墙	eNSP模拟
	IPtables防火墙	Linux
交换机	CiscoSG200	—

Policy translation and configuration using dynamic template

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 9

References 23

Related Articles 9

Metrics

Recommended 0

[1]	Chunfu JIA,Guanxiong HA,Ruiqi LI. Data access control policy of encrypted deduplication system [J]. Journal on Communications, 2020, 41(5): 72-83.
[2]	Hongyu YANG,Zaiming WANG. Android collusion attack detection model [J]. Journal on Communications, 2018, 39(6): 27-36.
[3]	Rong WANG,Min ZHANG,Deng-guo FENG,Hao LI. Formal modeling and analyzing method for database security policy [J]. Journal on Communications, 2015, 36(9): 193-203.
[4]	Zhong-nan FU,Qun SHANG,Xu-xiao GONG. Design and implement of integrative access layer in campus network [J]. Journal on Communications, 2014, 35(Z1): 91-97.
[5]	. Design and implement of integrative access layer in campus network [J]. Journal on Communications, 2014, 35(Z1): 18-97.
[6]	Zhi-yong ZHANG,Chuan-qi YE,Ke-feng FAN,Li-li ZHANG,Dan-mei NIU. Fuzzy analytic hierarchy process-based utilities evaluation and adoption for DRM security policies [J]. Journal on Communications, 2009, 30(10A): 126-131.
[7]	Tian-han GAO,Nan GUO,Zhi-liang ZHU. Distributed security management scheme based on dynamic policies for mobile IPv6 [J]. Journal on Communications, 2009, 30(1): 50-57.
[8]	Li-ping LI,Si-han1 QING,Zhou-yi ZHOU,EJian-bo H,ENHong-zi W. Research on formal security policy model specification and its formal analysis [J]. Journal on Communications, 2006, 27(6): 94-101.
[9]	Li-ping LI,Si-han QING,Ye-ping HE,Qing-ni SHEN. Security architecture to support multiple security policies based on access control space [J]. Journal on Communications, 2006, 27(2): 107-112.