A Data Flow Oriented Specification Method for Analyzing Network Security Configurations - Archive ouverte HAL Accéder directement au contenu
Article Dans Une Revue International Journal of Internet Protocol Technology Année : 2014

A Data Flow Oriented Specification Method for Analyzing Network Security Configurations

Résumé

The implementation of a network security policy requires the configuration of heterogeneous and complex security mechanisms (IPsec gateways, ACLs on routers, statefull firewalls, proxies, etc.). The complexity of this task resides in the number, the nature, and the interdependence of these mechanisms. Although several researchers have proposed different analysis tools, achieving this task requires experienced and proficient security administrators who can handle all these parameters. A generic formal theory that allows to reason about network data flows and security mechanisms is missing. In previous articles, we have proposed a formal data-flow-oriented model to detect network security conflicts. In this article, we supplement it with a generic model of equipment configuration constructed on our attribute-based approach. Network security services will be represented by specific atomic abstract functions called 'basic commands' that can modify the data flow. Based on this representation, we define an abstract model of configuration. Therefore, we specify our approach in coloured Petri networks to automate the conflicts detection analysis and test it on NAPT/IPsec scenario.
Fichier non déposé

Dates et versions

hal-03252288 , version 1 (07-06-2021)

Identifiants

Citer

Hicham El Khoury, Romain Laborde, François Barrère, Abdelmalek Benzekri, Maroun Chamoun. A Data Flow Oriented Specification Method for Analyzing Network Security Configurations. International Journal of Internet Protocol Technology, 2014, 8 (2/3), pp.58-76. ⟨10.1504/IJIPT.2014.066378⟩. ⟨hal-03252288⟩
40 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More