A soft constraint-based approach to the cascade vulnerability problem

Abstract

The security of a network configuration is based not just on the security of its individual components and their direct interconnections, but also on the potential for systems to interoperate indirectly across network routes. Such interoperation has been shown to provide the potential for cascading paths that violate security, in a circuitous manner, across a network. In this paper we show how constraint satisfaction provides a natural approach to expressing the necessary constraints to ensure multilevel security across a network configuration. In particular, soft constraints are used to detect and eliminate the cascading network paths that compromise security. Taking this approach results in practical advancements over existing solutions to this problem. In particular, constraint satisfaction highlights the set of all cascading paths, which we can eliminate in polynomial time by breaking a minimal number of system links to ensure security.

An Optimization Approach using Soft Constraints for the Cascade Vulnerability Problem

“…The approach that is of particular interest to us is the work proposed by Bistarelli et al [1]. We are extending this approach, by associating weights to all connections between computer systems.…”

“…Taking into account these additional features (such as bandwidth) constitutes our improvement to the approach of Bistarelli et al [1].…”

“…Our approach is illustrated in Figure 1: Given a network composed by computers (A), the network in Figure 1 is modeled by the approach of Bistarelli et al [1]. In case a CVP is detected, we move to the next step (which is modeled as a graph).…”

“…Among them, the approach of [1]. is of particular interest to us, as it expresses a solution of the problem using Constraint Programming, and more specifically soft constraints.…”

“…Among them, the approach of Bistarelli et al [1] is of particular interest to us: it expresses a solution of the problem using Constraint Programming, and more specifically soft constraints [3], [4]. This approach not only enables to detect the vulnerable paths in a network, but also to eliminate appropriate elements of the network that provoke the security leakage.…”