Security policy reconciliation in distributed computing environments
- 1 January 2004
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
Abstract
A major hurdle in sharing resources between organizations is heterogeneity. Therefore, in order for two organizations to collaborate their policies have to be resolved. The process of resolving different policies is known as policy reconciliation, which in general is an intractable problem. This paper addresses policy reconciliation in the context of security. We present a formal framework and hierarchical representation for security policies. Our hierarchical representation exposes the structure of the policies and leads to an efficient reconciliation algorithm. We also demonstrate that agent preferences for security mechanisms can be readily incorporated into our framework. We have implemented our reconciliation algorithm in a library called the policy reconciliation engine or PRE. In order to test the implementation and measure the overhead of our reconciliation algorithm, we have integrated PRE into a distributed high-throughput system called Condor.Keywords
This publication has 17 references indexed in Scilit:
- Binder, a logic-based security languagePublished by Institute of Electrical and Electronics Engineers (IEEE) ,2005
- Firmato: a novel firewall management toolkitPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2003
- BANDS: An Inter-Domain Internet Security Policy Management System for IPSec/VPNPublished by Springer Nature ,2003
- Decentralized trust managementPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- The complexity and composability of secure interoperationPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Matchmaking: distributed resource management for high throughput computingPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Automatic Generation of IPSec/VPN Security Policies In an Intra-Domain EnvironmentPublished by University Library/University of Twente ,2001
- Security Architecture for the Internet ProtocolPublished by RFC Editor ,1998
- Role-based access control modelsComputer, 1996
- Access control: principle and practiceIEEE Communications Magazine, 1994