Network-level access control policies are often specified by various people (network, application, and security administrators), and this may result in conflicts or suboptimal policies. We have defined a new formal model for policy representation that is independent of the actual enforcement elements, along with a procedure that allows the easy identification and removal of inconsistencies and anomalies. Additionally, the policy can be translated to the model used by the target access control element to prepare it for actual deployment. In particular, we show that every policy can be translated into one that uses the "First Matching Rule" resolution strategy. Our policy model and optimization procedure have been implemented in a tool that experimentally demonstrates its applicability to real-life cases.

The actual implementation of a policy on real devices must be done by providing a "set of rules". Nevertheless, no extensive studies were performed to completely model this crucial process. This paper provides a formal geometric interpretation of the policy specification focusing on the role of three factors: the detection, the resolution and the default behavior. The resulting model allows for the definition of new resolution strategies and the definition of "morphisms" between rule sets where conflicts are managed using different resolution methods. Additionally, it provides a mean to classify conflicts and anomalies for the "generic" resolution strategy. The effectiveness of the theory is proven by means of experimental results.

No abstract