Abstract:Efforts of this paper focus on the issues about management and throughput of firewalls (or screening routers) applied in transit networks. On the one hand, manual configuration of large amount of firewalls distributed in many access points can not meet the global security requirements in the open and dynamic environment. On the other hand, the ordinal lookup of filtering rules in each individual firewall results in great decrease of throughput. Aimed at a typical transit network and its security policy requirements, a policy-based access control framework (PACF) is proposed in this paper. This framework is based on three levels of abstract access control policy: organizational access control policy (OACP), global access control policy (GACP) and local access control policy (LACP). The GACP, which comes from the results of IDSes and search engines according to OACP, is automatically and dynamically distributed to firewalls as LACPs. Each LACP is then enforced by an individual firewall. Some key algorithms for distribution of GACP and enforcement of LACP are described. A hash-based algorithm is proposed, for lookup of filtering rules in LACP. Under the environment with policy requirements described in this paper, the new algorithm reduces the time complexity of lookup from O (N) of traditional sequential algorithm to O (1), which therefore increases largely the throughput of firewalls.

A Network Access Control Architecture Using State-Transfer-Based Dynamic Policy

An Architecture Approach To Dynamic Policy In Rbac

Dynamic Security Access Control Model Based on System Reliability

A state-transfer-based dynamic policy approach for constraints in RBAC

Proactive Security Defense of Dynamic Network

Multi-level Access Control for Collaborative CAD

Access Control in New Network Environment

Policy Based Access Control Framework for Large Networks

Control in New Network Environment

Dynamic Role-based Access Control for Web Services Using Context and Trust

A dynamic solution for fine-grained policy conflict resolution

Control Framework for Large Networks

A Trust-Role Based Context Aware Access Control Model

Model for access control policy refinement based on domain and its implementation

A Game Theoretic Approach Based Access Control Mechanism

Dynamic-Scheduling Mechanism of Controllers Based on Security Policy in Software-Defined Network

A policy tree-based architecture for web services authorization

New Study and Implementation of Policy Based Network Management System

A Novel Architecture for Enterprise Network Security

A Model Based on Domain for Access Control Policy Refinement and Its Implementation

Analysis method for internet architecture security