Download - Academy Publisher

Ⅵ. CONCLUSION
Figure 6.
The Flask architecture
B. Evaluation criteria
Because of the diversity of policy, policy framework
should to support the characteristics of different policies,
the more features supported, the more policies to support.
Michael Carney and Brian Loe have proposed five
evaluation criteria of policy switching mechanism, we
quote as follow:
1) Policy Flexibility, because the current policy
description language is not uniform, a good policy
framework should be able to support multiple policy
language, so as not to limit its application in large-scale
systems.
2) Function Flexibility,Policy framework itself should
be configurable, and when it need other features, it can
be dynamically added.
3) Safety, The security of a policy framework is that
policies can be correctly stored and implementation, and
will not be tampered with.
4) Reliability, Policy framework should take into
account the different policy operating conditions change,
the framework itself should be able to adapt to this
change, rather than stop running, waiting for
administrators to manually manage.
5) Efficiency, Especially for smaller granularity of
time, must focus on the efficiency of policy enforcement,
if policy is not configured or implemented, the time has
passed.
C. Comparison of Policy Framework
We have the framework of the above-mentioned three
according to the evaluation criteria for comparison. We
compare mainly from the following three aspects:
support for policy flexibility, function flexibility,
efficiency, and reliability.
Ponder policy deployment model is the best model on
policy flexibility, but unable to adapt to environmental
change; FAM Framework can not support function
flexibility and unable to adapt to environmental change,
because the access policy is execute by hard-coded
language, but its efficiency and policy flexibility is good;
Flask Framework is very good at support function
flexibility and is better at efficiency, but can’t support
DAC and unable to adapt to environmental change.
Policy-based management is one of the latest developments,
and achieved some success. From the practical
application point of view, however, this is not enough.
Problems at this stage included as the following aspects:
1) Lack of standards
2) Lack of good policy management framework
3)Lack of policy conflict detection and policy
elimination of technical
4) Lack of a unified Policy description Language
Overall, currently the study of policy should focus on
the described in the policy specification, policy
framework development, as well as some key
technologies. Only in this way, the policy could be
applied more widely.
REFERENCES
[1] M.J. Maullo, S.B. Calo "Policy management: an architecture
and approach," Systems Management, vol., no., pp.13-26,
Apr 1993.
[2] S. S. Greene, "Security Policies and Procedures," PEARSON
Education, 2008.
[3] L. Cholvy, F. Cuppens, "Analyzing consistency of security
policies," Security and Privacy, IEEE Symposium on, p.
0103, 1997 IEEE Symposium on Security and Privacy,
1997 .
[4] M.Bishop, "Computer Security," Addison-Wesley, 2002.
[5] Francois Siewe, "A Compositional Framework for the
Development of Secure Access Control Systems" 2005
Ph.D.
[6] L. Jorge, B. Randeep and N. Shamim, "A policy Description
Language," Orlando, Florida: AAAI, 1999.
[7] N. Dulay, E. Lupu, M. Sloman, and N. Damianou, "A
Policy Deployment Model for the Ponder Language,"
Integrated Network Management Proceedings, IEEE/IFIP
International Symposium on , vol., no., pp.529-543, 2001.
[8] M. Winslett, C. Zhang, and P. A. Bonatti,"A logic for
distributed authorization," The ACM Conf. on Comput and
Communications Security. New York: ACM Press, 1993,
PP. 124-133.
[9] S. Jajodia, Pierangela. Samarati, V. S. Subrahmanian and
E. Bertino "A unified frame-work for enforcing multiple
access control policies," ACM transaction on Database
Systems. 2001, PP. 474 - 485 .
[10] S. D. Stoller, P. Yang "Efficient policy analysis for administrative
role based access control," The ACM Conf. on Computer
and Communications Security. New York: ACM Press,
2007, PP. 445-455.
[11] T. MOSES "eXtensible Access Control Markup Language
(XACML) Version 2.0,". OASIS Standard, 2005.
[12] E. C. Lupu and M. Sloman, "Conflicts in Policy-based
Distributed Systems Management," Software Engineering,
IEEE Transactions on , vol.25, no.6, pp.852-869, Nov/Dec
1999.
[13] Lu Shifeng, Liu Xuemin, Liu Taoying and Wang
Qin,"Overview on Policy-Based Management". Computer
Engineering and Applications, vol 9, pp.85-89. 2004(09).
[14] SHAN Zhiyong, "Research on the Framework for Multi-
Policies and Practice in Secure Operation System,"
Institute of Software Chinese Academy of Sciences, 2002.
217