Security checker architecture for policy-based security management

Abstract

Policy-based management systems are now the object of steadfast attention in network security theory and applications. Due to a complex structure of subject role hierarchies, target grouping, and action mutual dependence the security policy conflicts are complicated to detect and resolve. Moreover, an initially consistent policy ruleset may lead to inconsistent or unenforceable rules during the system lifecycle. The paper presents the architecture of Security Checker module (intended for disclosure and resolution of policy conflicts) and illustrates conflict detection based on event calculus. © Springer-Verlag Berlin Heidelberg 2005.