Mining a high level access control policy in a network with multiple firewalls. (February 2015)

• Record Type: Journal Article
• Authors: Hachana, Safaà; Cuppens-Boulahia, Nora; Cuppens, Frédéric
• Is Part Of: Journal of information security and applications. Volume 20(2015)
• Page Start: 61
• Page End: 73
• Publication Date: 2015-02
• Subjects: Access control -- Network security -- Policy mining -- Role mining -- Multiple firewalls -- Net-RBAC; Computer security -- Periodicals; Information technology -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.jisa.2014.10.010
• Languages: English
• ISSNs: 2214-2126

Abstract

Abstract: A policy mining approach that aims to automatically extract a high level of abstraction policy from the rules configured on a firewall has been recently proposed (Hachana et al., 2013). This technique is likely to considerably facilitate firewall management. However, protecting the information system of a business organization usually requires the enforcement of more than one firewall. In this paper, we augment the policy mining approach by an additional processing for a network access control policy mining. We develop the problem of integration of Net-RBAC (Hachana, 2014 ) policies resulting from policy mining over several firewalls in order to mine a high level network policy. Moreover, we show how to verify security properties related to the deployment consistency over the firewalls. We illustrate the network policy mining approach by a realistic example, and we experimentally evaluate the performance of our merger algorithms.