A Security Policy Infrastructure for Tactical Service Oriented Architectures

Abstract

Abstract. Tactical networks are affected by multiple constraints related to the limited node characteristics and the availability of resources. These constraints within the highly dynamic tactical environment, impose significant limitations to the functionalities and efficiency of current generic security policy frameworks. Earlier studies have provided a risk analysis of tactical service oriented architectures (SOA), and a set of fine-grained protection goals in correspondence to the aforementioned constraints. Furthermore, web ontology language has been identified as a suitable mediator towards the requirements and opportunities imposed by tactical SOA. Thus, in this article we present a security policy framework dedicated to tactical networks, as it has been developed within the project TACTICS.

Security Infrastructure for Service Oriented Architectures at the Tactical Edge

“…According to the results of our experiments, it is important to note that the complexity and dynamic adaptability of the developed mechanism is situated at the structure of the ontological knowledge base, the governing policy rules, the fine grained definition of action requests and the detailed incorporation of the available semantics, as described earlier [6,5,7,8,3]. Contrary to that, the functionalities of the presented core security services are kept at a low complexity level aiming for clear separation of duties within the policy decision extraction process.…”

“…In this section we present these components (Figure 1), aiming to highlight the processes involved in the extraction of suitable policy decisions (Figures 2 and 3). It must be noted that the security policy framework developed within TACTICS for the accommodation of the requirements imposed by contemporary tactical SOA, has been presented earlier in detail [6] and is outside the scope of this article.…”

“…Furthermore, an extended state of the art review, revealed the weaknesses of existing mechanisms but also suitable adaptations that would satisfy the identified requirements under the imposed constraints [5]. These initial studies, allowed us to analyse, define and develop a suitable security policy framework [6], along with the corresponding distribution [7], reconciliation [8] and QoS (Quality of Service) interoperability [9] mechanisms.…”

RESPOnSE—A Framework for Enforcing Risk-Aware Security Policies in Constrained Dynamic Environments

“…Hence, the Current Value Matrices corresponding to the two subjects are respectively CV A = [5,5,4,1] and CV B = [6,8,4,7]. The same normalization technique and the same weights are applied also to these matrices as denoted in Equation ( 4).…”

“…Moreover, the fact that the edge nodes generally present substantial constraints, in terms related to the size of memory and buffers, computational power, battery life and available interfaces [2], can also be an obstruction in the policy enforcement. Thus, protecting and regulating access over the data, as mentioned above, becomes a challenging task [5][6][7][8]. Managing security policies in such an environment requires an effective and efficient access control mechanism to be in place in order to provide suitable monitoring, control and audit solutions for managing data flows across communication and control links but also access to services.…”