Download - Academy Publisher

ISBN 978-952-5726-09-1 (Print)
Proceedings of the Second International Symposium on Networking and Network Security (ISNNS ’10)
Jinggangshan, P. R. China, 2-4, April. 2010, pp. 214-217
Research on Security Policy and Framework
Dongliang Jiao 1,2 , Lianzhong Liu 1 , Shilong Ma 2 , and Xiaoni Wang 1
1 Key Laboratory of Beijing Network Technology, Beihang University, Beijing, China
Email: {jiao_dl, lianzhong-liu, xiaoni_wang}@163.com
2 State Key Laboratory of Software Development Environment, Beihang University, Beijing, China
Email: slma@nlsde.buaa.edu.cn
Abstract—Policies are rules that govern the choices in
behaviors of a system. Security policies define what actions
are permitted or not permitted, for what or for whom, and
under what conditions. In this paper, the present situation
of research on policy is overviewed, including policy and
security policy definition, policy language, the conflict
detection of policy and policy framework. Finally, the
summary and the future trends of policy and security policy
study are given.
Index Terms—Policy, Security policy, Policy Framework,
Interval Temporal Logic (ITL), Ponder Language
Ⅰ. INTRODUCTION
As systems become increasingly complex, the
development of methodologies for their security and
effective management becomes more and more critical. One
important aspect of this general systems management
problem is that of being able to raise the level of abstraction
[1]. This requirement is commonly described as the ability
to deal with systems in terms of policies rather than
explicit controls.
Policy means different things to different people. For
our purposes, the term “policy” is defined as high-level
rules for implementing the goals, beliefs, and objectives
of an enterprise. There are three types of policies, and you
will use each type at different times in your information
security program and throughout the organization to
support the business process or mission. The three types
of policies include [2]:
1) Global policies. These are used to create the
organization’s overall vision and direction.
2) Topic-specific policies. These address particular
subjects of concern. We discuss the information security
architecture and each category.
3) Application-specific policies. These focus on
decisions taken by management to control particular
applications (financial reporting, payroll, etc.) or systems
(budgeting system).
Ⅱ. SECURITY POLICY
A security policy establishes what must be done to
protect information stored on computers. A well-written
policy contains sufficient definition of “what” to do so
that the “how” can be identified and measured or
evaluated [3].
Supported by Co-Funding Project of Beijing Municipal
Education Commission under Grant No. JD100060630
© 2010 ACADEMY PUBLISHER
AP-PROC-CS-10CN006
214
Policies lay
Global policies
Topic-specific
policies
Application-spe
cific policies
Figure 1.
Three kinds of
Policies describe
ways
Policy
specification
description
language
Rule-based
language
Logic-based
language
Three types of policies
The goal of a security policy is to maintain the integrity,
confidentiality, and availability of information resources
[4].Confidentiality requires that the information or
resources in a computer system only be disclosed to
authorized parties. Integrity includes data integrity (the
content of the information) and origin integrity (the
source of the data, often called authentication).
Availability is concerned with the ability to use the
information or resource desired. The aspect of
availability that is relevant to security is that someone
may deliberately arrange to deny access to data or to a
service by making it unavailable to legitimate parties.
To enforce the above requirements, authentication,
access control and auditing, three mutually supportive
technologies are used [5].
1) Authentication: deals with identification of users.
2) Access control: concerned with limiting the activity
of users who have been successfully authenticated by
ensuring that every access to information or resources is
controlled and that only authorized accesses can take
place.
3) Auditing: is the process of recording information
about accesses to resources so as to be able to establish
responsibilities in the event of a security breach.
Ⅲ. SECURITY POLICY REPRESENTATION
A. Policy Language
One of the main factors constrains the policy
applications is that policy description language is not
uniform. Each language can only support one or several
models. At present, the policy language of the research
Increasing degree of abstraction