Policy-based Management Approach Research Articles

Verification and enforcement of access control policies

Access control mechanisms protect critical resources of systems from unauthorized access. In a policy-based management approach, administrators define user privileges as rules that determine the conditions and the extent of users' access rights. As rules become more complex, analytical skills are required to identify conflicts and interactions within the rules that comprise a system policy--especially when rules are stateful and depend on event histories. Without adequate tool support such an analysis is error-prone and expensive. In consequence, many policy specifications are inconsistent or conflicting that render the system insecure. The security of the system, however, does not only depend on the correct specification of the security policy, but in a large part also on the correct interpretation of those rules by the system's enforcement mechanism. In this paper, we show how policy rules can be formalized in Fusion Logic, a temporal logic for the specification of behavior of systems. A symbolic decision procedure for Fusion Logic based on Binary Decision Diagrams (BDDs) is provided and we introduce a novel technique for the construction of enforcement mechanisms of access control policy rules that uses a BDD encoded enforcement automaton based on input traces which reflect state changes in the system. We provide examples of verification of policy rules, such as absence of conflicts, and dynamic separation of duty and of the enforcement of policies using our prototype implementation (FLCheck) for which we detail the underlying theory.

Practical and analytical approaches for designing scalable on-demand policy-based resource allocation in stateless IP networks

Today the policy-based management (PBM) approach is recognized as an efficient solution to simplify the complex task of managing and controlling networks. To this end, the Internet Engineering Task Force (IETF) has introduced a reference framework to build PBM systems. However, this framework only addresses the provisioning of relatively long validity period services based on predefined service-level agreements. Furthermore, very little work addresses the scalability properties of the instantiation of this framework in a real network. This work aims to extend the IETF PBM framework in order to support dynamic provisioning of short-term services (end-system signalling) as well as an instantiation scheme that is scalable (distributed provisioning of edge routers). This instantiation scheme is based on the distribution of the provisioning process while keeping centralized only the parts that involve critical resources, namely bandwidth brokerage. The performance properties of the proposed scheme are then demonstrated throughout both extensive experimentation and an analytical study. The extension of this performance analysis to the case where multiple bandwidth brokers are used is also discussed. The results of this work are intended to be used as a guideline to help network operators to design a scalable PBM system in order to offer to their customers services with quality of service assurance on an on-demand basis. Copyright © 2011 John Wiley & Sons, Ltd.

A Policy-Based Autonomic Model Suitable for Quality of Service Management

The increased complexity resulting from computer networks technologies, devices and application diversity combined with the continuously growing service demands from users, requires a computer network that offers adequate treatment and support to multiservice (voice, video, web applications) and quality of service (QoS) requirements. This management scenario adds complexity to human administration even with the adoption of Policy- Based Management (PBM) systems. In effect, the effectiveness and efficiency of the management model is, typically, directly related with the knowledge and skills of the administrator in order to define a policy database that meets all possible states. In this paper is presented a model with autonomic capabilities that is able to manage quality of service in computer networks pushing towards an autonomic Full Policy-Based Management (FPBM) approach. The proposed model introduces a knowledge layer in a traditional Policy Based Management model so that policies are created in an autonomic way, replacing as such the human interaction in the process of defining the policy database.

Managing Layer 1 VPN services

Control Plane architectures enhance transport networks with distributed signaling and routing mechanisms which allow dynamic connection control. As a result, layer 1 switching networks enabled with a distributed control plane can support the provisioning of advanced connectivity services like Virtual Private Networks (VPNs). Such Layer 1 VPN (L1VPN) service allows multiple customer networks to share a single transport network in a cost-effective way. However, L1VPN deployment still faces many challenges. In this work, we are concerned on configuration management and interdomain provisioning of L1VPN services. We propose an L1VPN management architecture based on the Policy-Based Management (PBM) approach. First, we describe the architecture and how it allows a single service provider to support multiple L1VPNs while providing customers with some level of control over their respective service. Then we explain how the architecture was extended to support interdomain L1VPNs by using the Virtual Topology approach. We also discuss the prototype implementation and evaluation of the proposed architecture. Moreover, this work is a tentative note before raising a more deep discussion related to interdomain provisioning of L1VPN services and implications of a policy-based approach for L1VPN configuration management.

Policy-Based Management for Self-Managing Wireless Sensor Networks

SUMMARY In a wireless sensor network (WSN), a large number ofsensor nodes are deployed over a wide area and multi-hop communica-tions are required between the nodes. Managing numerous sensor nodesis a very complicated task, especially when the energy issue is involved.Even though a number of ad-hoc management and network structuring ap-proaches for WSNs have been proposed, a management framework cov-ering the entire network management infrastructure from the messagingprotocol to the network structuring algorithm has not yet been proposed. Inthis paper we introduce a management framework for WSNs called SNOW-MAN (SeNsOr netWork MANagement) framework. It employs the policy-based management approach for letting the sensor nodes autonomously or-ganize and manage themselves. Moreover, a new light-weight policy dis-tribution protocol called TinyCOPS-PR and policy information base (PIB)are also developed. To facilitate scalable and localized management ofsensor networks, the proposed SNOWMAN constructs a 3-tier hierarchyof regions, clusters, and sensor nodes. The effectiveness of the proposedframework is validated through actual implementation and simulation us-ing ns-2. The simulation results reveal that the proposed framework allowssmaller energy consumption for network management and longer networklifetime than the existing schemes such as LEACH and LEACH-C for prac-tical size networks.

X-FEDERATE: a policy engineering framework for federated access management

Policy-based management (PBM) has been considered as a promising approach for design and enforcement of access management policies for distributed systems. The increasing shift toward federated information sharing in the organizational landscape, however, calls for revisiting current PBM approaches to satisfy the unique security requirements of the federated paradigm. This presents a twofold challenge for the design of a PBM approach, where, on the one hand, the policy must incorporate the access management needs of the individual systems, while, on the other hand, the policies across multiple systems must be designed in such a manner that they can be uniformly developed, deployed, and integrated within the federated system. In this paper, we analyze the impact of security management challenges on policy design and formulate a policy engineering methodology based on principles of software engineering to develop a PBM solution for federated systems. We present X-FEDERATE, a policy engineering framework for federated access management using an extension of the well-known role-based access control (RBAC) model. Our framework consists of an XML-based policy specification language, its UML-based meta-model, and an enforcement architecture. We provide a comparison of our framework with related approaches and highlight its significance for federated access management. The paper also presents a federation protocol and discusses a prototype of our framework that implements the protocol in a federated digital library environment

Designing scalable on-demand policy-based resource allocation in IP networks

Today, the policy-based management approach is recognized as an efficient solution to simplify the complex task of managing and controlling networks. To this end, the IETF has introduced a reference framework to build PBM systems. However, this framework only addresses the provisioning of relatively long validity period services based on pre-defined service level agreements. Furthermore, very little work addresses the scalability properties of the instantiation of this framework in a real network. This work aims to extend the IETF PBM framework in order to support dynamic provisioning of short term services (end system signaling) as well as an instantiation scheme that is scalable (distributed provisioning of edge routers). This instantiation scheme is based on the distribution of the provisioning process while keeping centralized only the parts that involve critical resources, that is, the bandwidth brokerage. The performance properties of the proposed scheme are then demonstrated throughout both extensive experimentation and a short analytical study. The results of this work are intended to be used as a guideline to help network operators to design scalable PBM system in order to offer to their customers services with QoS assurance in an on-demand basis.