A service dependency modeling framework for policy-based response enforcement

Nizar Kheir (1, 2) , Hervé Debar (2) , Frédéric Cuppens (3) , Nora Cuppens-Boulahia (3) , Jouni Viinikka (2)

1 LUSSI - Département Logique des Usages, Sciences sociales et Sciences de l'Information
2 FT - France Télécom, Division R&D, Caen
3 Lab-STICC_TB_CID_SFIIS

The use of dynamic access control policies for threat response adapts local response decisions to high level system constraints. However, security policies are often carefully tightened during system design-time, and the large number of service dependencies in a system architecture makes their dynamic adaptation di±cult. The enforcement of a single re- sponse rule requires performing multiple con¯guration changes on multi- ple services. This paper formally describes a Service Dependency Frame- work (SDF) in order to assist the response process in selecting the pol- icy enforcement points (PEPs) capable of applying a dynamic response rule. It automatically derives elementary access rules from the generic access control, either allowed or denied by the dynamic response pol- icy, so they can be locally managed by local PEPs. SDF introduces a requires/provides model of service dependencies. It models the service architecture in a modular way, and thus provides both extensibility and reusability of model components. SDF is de¯ned using the Architecture Analysis and Design Language, which provides formal concepts for mod- eling system architectures. This paper presents a systematic treatment of the dependency model which aims to apply policy rules while minimizing con¯guration changes and reducing resource consumption.

Domaines: Réseaux et télécommunications [cs.NI]

Nizar Kheir, Hervé Debar, Frédéric Cuppens, Nora Cuppens-Boulahia, Jouni Viinikka. A service dependency modeling framework for policy-based response enforcement. DIMVA 09 : 6th international conference on Detection of Intrusions, Malware and Vulnerability Assessment, Jul 2009, Como, Italy. pp.176-195. ⟨hal-00433302v2⟩