Security Policy Configuration Research Articles

Effectiveness of MAC Systems based on LSM and their Security Policy Configuration for Protecting IoT Devices

Effectiveness of MAC Systems based on LSM and their Security Policy Configuration for Protecting IoT Devices

The Evolution of the Regional Security Policy of Saudi Arabia and Turkey: Similarities and Differences

The authors analyse the configuration and major directions of the current regional security policies of Saudi Arabia and Turkey, as some of the leading players in the Middle East. The strategic location of the region, combined with high levels of conflict and a number of other factors, has turned the region into a real Gordian knot of global politics. The issue of security in this part of the world is a key item on both the Middle Eastern and global agenda. Most of the internal processes in the Middle East today depend on the balance of power among regional 'heavyweights', the most prominent of which are Iran, Israel, Turkey, and a number of Arab countries headed by Saudi Arabia. The authors examine the current regional security policies of Riyadh and Ankara as they, with their considerable resources, seek to realise their ambitions both internationally and regionally, resulting in direct competition for leadership in several overlapping areas between them. At the same time, due to geographical proximity and a number of other factors, the spheres of interest of Saudi and Turkish foreign policies often overlap. The authors draw parallels between the regional security policies of Saudi Arabia and Turkey in the Middle East, identifying overlapping areas of interest between the two countries that not only underpin their cooperation, but also create grounds for competition between them.

Risk Analysis of Information System Security Based on Distance of Information-State Transition

The configuration of information system security policy is directly related to the information asset risk, and the configuration required by the classified security protection is able to ensure the optimal and minimum policy in the corresponding security level. Through the random survey on the information assets of multiple departments, this paper proposes the relative deviation distance of security policy configuration as risk measure parameter based on the distance of information-state transition (DIT) theory. By quantitatively analyzing the information asset weight, deviation degree and DIT, we establish the evaluation model for information system. With example analysis, the results prove that this method conducts effective risk evaluation on the information system intuitively and reliably, avoids the threat caused by subjective measurement, and shows performance benefits compared with existing solutions. It is not only theoretically but also practically feasible to realize the scientific analysis of security risk for the information system.

A trustworthy and energy-aware routing protocol in software-defined wireless mesh networks

Hybrid Wireless Mesh Networks (HWMNs) were proposed to address the challenges in wireless communications to support mobile applications across different domains. Due to the multi-hop and decentralized network architecture, HWMNs are naturally susceptible to various security threats, especially internal attacks. Therefore, HWMNs must be able to detect anomalies, provide secure routing and protect user privacy through the cooperation among nodes. However, the existing routing protocols for HWMNs cannot ensure the security to protect the users privacy effectively. Moreover, traditional HWMNs are vertically integrated where the control and data planes of mesh routers are bundled together, which makes it complex and difficult to configure the network according to predefined security policies, and to adaptively respond to various dynamic security threats. Software-Defined Wireless Mesh Networks decouple the control plane and data plane of routers and thus enable a more flexible and efficient configuration of security policies. Taking up this opportunity to address the aforementioned challenges, this paper proposes a privacy-aware, secure and energy-aware green routing (PSGR) protocol that can defend against internal attacks, achieve stronger privacy protection and reduce energy consumption in Software-Defined HWMNs. The elaborate theoretical analysis verify that the PSGR protocol can implement the security and privacy protection against internal attacks effectively and efficiently. Simulation results demonstrate a superior performance of PSGR in terms of packet delivery ratio, network throughput and energy efficiency compared to the existing PA-SHWMP, PASER, and HWMP protocols in the presence of Blackhole/Grayhole attacks and wormhole attacks.

QoSS Hierarchical NoC-Based Architecture for MPSoC Dynamic Protection

As electronic systems are pervading our lives, MPSoC (multiprocessor system-on-chip) security is becoming an important requirement. MPSoCs are able to support multiple applications on the same chip. The challenge is to provide MPSoC security that makes possible a trustworthy system that meets the performance and security requirements of all the applications. The network-on-chip (NoC) can be used to efficiently incorporate security. Our work proposes the implementation of QoSS (quality of security service) to overcome present MPSoC vulnerabilities. QoSS is a novel concept for data protection that introduces security as a dimension of QoS. QoSS takes advantage of the NoC wide system visibility and critical role in enabling system operation, exploiting the NoC components to detect and prevent a wide range of attacks. In this paper, we present the implementation of a layered dynamic security NoC architecture that integrates agile and dynamic security firewalls in order to detect attacks based on different security rules. We evaluate the effectiveness of our approach over several MPSoCs scenarios and estimate their impact on the overall performance. We show that our architecture can perform a fast detection of a wide range of attacks and a fast configuration of different security policies for several MPSoC applications.

Security Policy Configuration Analysis for Web Services on Heterogeneous Platforms

With the rapid development of web services, message security of web services between heterogeneous platforms is increasingly prominent. As two popular web services platforms, Apache Axis2 and Microsoft .Net, have their own security module respectively (Rampart, WSE). Due to differences in platform security mechanisms, it is difficult to build a secure web services communications between different platforms. This paper firstly introduces the Apache Axis2 and. Net platforms, and then analyzes their differences of security mechanism on these two platforms. Finally, followed by a typical secure case, a series of steps are designed and tested in order to realize secure web service invocation on heterogeneous platforms.

Management of security policy configuration using a Semantic Threat Graph approach

Managing the configuration of heterogeneous enterprise security mechanisms is a complex task. The effectiveness of a configuration may be constrained by poor understanding and/or management of the overall security policy requirements, which may, in turn, unnecessarily expose the enterprise to known threats. This paper proposes a threat management based approach, whereby knowledge about the effectiveness of mitigating countermeasures is used to guide the autonomic configuration of security mechanisms. This knowledge is modeled in terms of Semantic Threat Graphs, a variation of the traditional Threat/Attack Tree, extended in order to relate semantic information about security configuration with threats, vulnerabilities and countermeasures. An ontology-based approach to representing and reasoning over this knowledge is taken. A case study based on Network Access Controls demonstrates how threats can be analysed and how automated configuration recommendations can be made based on catalogues of countermeasures. These countermeasures are drawn from best-practice standards, including NIST, IETF and PCI-DSS recommendations for firewall configuration.

Distributed Automatic Configuration of Complex IPsec-Infrastructures

The Internet Protocol Security Architecture IPsec is hard to deploy in large, nested, or dynamic scenarios. The major reason for this is the need for manual configuration of the cryptographic tunnels, which grows quadratically with the total amount of IPsec gateways. This way of configuration is error-prone, cost-intensive and rather static. When private addresses are used in the protected subnetworks, the problem becomes even worse as the routing cannot rely on public infrastructures. In this article, we present a fully automated approach for the distributed configuration of IPsec domains. Utilizing peer-to-peer technology, our approach scales well with respect to the number of managed IPsec gateways, reacts robust to network failures, and supports the configuration of nested networks with private address spaces. We analyze the security requirements and further desirable properties of IPsec policy negotiation, and show that the distribution of security policy configuration does not impair security of transmitted user data in the resulting virtual private network (VPN). Results of a prototype implementation and simulation study reveal that the approach offers good characteristics for example with respect to quick reconfiguration of all gateways after a central power failure (robustness), or after insertion of new gateways (scalability and agility).

A policy flexible architecture for secure operating system

As the fundamental software to guarantee information security, operating system is desired to support various security policies flexibly and to control the propagation and revocation of access rights efficiently. This paper presents a design and implementation of Policy Flexible Architecture (PFA) for secure operating system to achieve the coordination, extensibility, consistency and dynamic configuration of security policies. Through a thorough analysis of all related facilities, PFA classifies policy constructions into several levels according to their effects on security status; PFA emphasizes on centralized management of security policy as well as on centralized maintainability of security attributes; for the first time PFA gives revocation rules to specify how and when to revoke permissions. PFA has been applied to our Secure Enhanced Linux Operating System, and the experiment shows that the system holds at least three advantages. First, it helps users to choose intended security policies flexibly. Besides it supports users to add new security policies according to specific security requirements easily. Finally it sets permission revocations immediately and gets no significant performance penalty.