MIRAGE: a management tool for the analysis and deployment of network security policies

Joaquin Garcia Alfaro (1) , Frédéric Cuppens (2) , Nora Cuppens-Boulahia (2) , Stere Preda (1)

1 LUSSI - Département Logique des Usages, Sciences sociales et Sciences de l'Information
2 Lab-STICC_TB_CID_SFIIS

We present the core functionality of MIRAGE, a management tool for the analysis and deployment of configuration policies over network security components, such as firewalls, intrusion detection systems, and VPN routers.We review the two main functionalities embedded in our current prototype: (1) a bottom-up analysis of already deployed network security configurations and (2) a top-down refinement of global policies into network security component configurations. In both cases, MIRAGE provides intra-component analysis to detect inconsistencies in single component deployments; and inter-component analysis, to detect multicomponent deployments which are not consistent. MIRAGE also manages the description of the security architecture topology, to guarantee the proper execution of all the processes.

Mots clés: Policy based network management; Policy anomalies; Policy instantiation; Policy consistency

Domaines: Cryptographie et sécurité [cs.CR]

Joaquin Garcia Alfaro, Frédéric Cuppens, Nora Cuppens-Boulahia, Stere Preda. MIRAGE: a management tool for the analysis and deployment of network security policies. 3rd SETOP International Workshop on Autonomous and Spontaneous Security (Co-located with ESORICS 2010), Sep 2010, Athens, Greece. pp.203-215, ⟨10.1007/978-3-642-19348-4_15⟩. ⟨hal-00623634⟩