Policy enforcement point model

Yosra Ben Mustapha (1, 2, 3) , Hervé Debar (1, 2, 3) , Gregory Blanc (1, 2, 3)

1 TSP - RST - Département Réseaux et Services de Télécommunications
2 SAMOVAR - Services répartis, Architectures, MOdélisation, Validation, Administration des Réseaux
3 CNRS - Centre National de la Recherche Scientifique

As information systems become more complex and dynamic, Policy Decision Points (PDPs) and Policy Enforcement Points (PEPs) follow the same trend. It becomes thus increasingly important to model the capabilities of these PDPs and PEPs, both in terms of coverage, dependencies and scope. In this paper, we focus on Policy Enforcement Points to model the objects on which they may enforce security constraints. This model, called the PEP Responsibility Domain (RD(PEP)), is build based on the configuration of the PEP following a bottom-up approach. This model can then be applied to multiple use cases, three of them are shown as examples in this paper, including policy evaluation and intrusion detection assessment and alert correlation

Mots clés: Policy Enforcement Point; Approximation Accuracy; Alert correlation; Security policy

Domaines: Cryptographie et sécurité [cs.CR]

Yosra Ben Mustapha, Hervé Debar, Gregory Blanc. Policy enforcement point model. SECURECOMM 2014: 10th International Conference on Security and Privacy in Communication Networks, Sep 2014, Beijing, China. pp.278 - 286, ⟨10.1007/978-3-319-23829-6_20⟩. ⟨hal-01263380⟩