MDA-Based Framework for Automatic Generation of Consistent Firewall ACLs with NAT

Abstract

Abstract. The design and management of firewall ACLs is a very hard and error-prone task. Part of this complexity comes from the fact that each firewall platform has its own low-level language with a different functionality, syntax, and development environment. Although several high-level languages have been proposed to model firewall access control policies, none of them has been widely adopted by the industry due to a combination of factors: high complexity, no support of important features of firewalls, no common development process, etc. In this paper, a development process for Firewall ACLs based on the Model Driven Architecture (MDA) framework is proposed. The framework supports the market leaders firewall platforms and is user-extensible. The most important access control policy languages are reviewed, with special focus on the development of firewall ACLs. Based on this analysis a new DSL language for firewall ACLs, AFPL2, covering most features other languages do not cover, is proposed. The language is then used as the platform independent metamodel, the first part of the MDA-based framework.

Reasoning on the usage control security policies over data artifact business process models

“…To solve this, we specify them using OCL language. This is not a limitation since the transformation from informal models to specific formal models has been tackled in previous works [42] and using OCL as a formalism to specify U CON ABC policies has been considered in previous work [27].…”