Efficient Algorithms for Dynamic Detection and Resolution of IPSec/VPN Security Policy Conflicts

Present data sharing and integration among collaborating organizations requires a central and trusted authority to check the users' requests before allowing the request to pass to the centralized repository to collect data from all data sources and integrate the collected data. Heterogeneity and dynamic nature of ubiquitous computing environments makes critical to generate an integrated security policy set to govern the interactions among the collaborating organizations. Each organization manages its own resources and can function autonomously and a group of collaborating organizations can be formed and changed at runtime. As organizations are peers to each other. Normally, there is no organization to serve as an authority to manage the interactions among various collaborating organizations. Due to these characteristics, we have the three major challenges for providing security in such environments: ambiguous security policy specifications, dynamic set of users and conflicting security policies. To address the given challenges and specify the access control policies a Security Policy Integration and Conflict Reconciliation (SPICR) layer is introduced between the user application and the repository for security policy negotiation and conflict reconciliation in policy-based ubiquitous environment. With our proposed layer, data sharing services can control the access, limit the usage of their shared data, and improves data sharing and efficiency of the data-centralized repository making the system scalable with little human intervention. The proposed layer performs security policy integration based on similarity policy adaptation algorithm and negotiation policy.

The cloud networks managed by SDN can have multi-tier policy and rule conflicts. The application plane can have conflicting user-defined policies, and the infrastructure layer can have OpenFlow rules conflicting with each other. There is no scalable, and, automated programming framework to detect and resolve multi-tier conflicts in SDN-based cloud networks. We present an object-oriented programming framework - SDN Security Operation Center (SDNSOC), which handles policy composition at application plane, flow rule conflict detection and resolution at the control plane. We follow the design principles of object-oriented paradigm such as code-re-utilization, methods abstraction, aggregation for the implementation of SDNSOC on a multi-tenant cloud network. The key benefits obtained using this approach are (i) The network administrator is abstracted from complex-implementation details of SFC. The end-to-end policy composition of different network functions is handled by an object-oriented framework in an automated fashion. We achieve 37% lower latency in SFC composition compared to nearest competitors - SICS and PGA. (ii) Policy conflict detection between the existing traffic rules and incoming traffic is handled by SDNSOC in a scalable manner. The solution scales well on a large cloud network., and 18% faster security policy conflict detection on a cloud network with 100k OpenFlow rules compared to similar works - Brew, and Flowguard.

The complex tasks of air traffic control (ATC) and the various factors affecting its operation have shed light on the need to build a model to predict conflict detection and resolution (CDR) performance within a traffic situation. This study aimed at developing a fuzzy-hybrid framework for quantifying various aspects in ATC consisting of the software, hardware, environment, liveware and organisation (i.e. the SHELL model) to predict CDR performance. The proposed fuzzy-hybrid SHELL framework in this study was tested using metadata from 10 prior studies in ATC. The results showed a highly accurate prediction, as indicated by the RMSE and MAPE values of 0⋅09 and 5⋅36%, respectively, indicating a high consistency of 90⋅92% for predicting the CDR performance. This framework offers a promising approach for Air Navigation Service Providers (ANSPs) to maintain air traffic safety and improve ATC operations efficiency.

Chapter 45 - Detection of Conflicts in Security Policies

Abstract.— The effects of the distribution of the validities of the cues in the conflict task on policy conflict, as studied in Hammond's “lens model” interpersonal conflict paradigm, was investigated in a 2 (levels of task predictability) by 2 (levels of cue validity distribution: only one cue valid vs. two equally valid cues) factorial experiment. The results showed that the level of agreement was higher when only one cue was valid than when both cues were valid, but this effect was obtained only when task predictability was high. In the low predictability condition, there were no differences between the two levels of cue validity distribution. In agreement with earlier findings, the results also showed that agreement was a positive function of the predictability of the task. These results show that, to understand policy conflict, it is not sufficient to analyse only the characteristics of the parties to the conflict; it is also necessary to analyse the characteristics of the task facing the parties.

The phenomenon of policy conflicts that emerge in society and policy change requires an examination of the policies that are the focus of this research. With a focus on the dynamic nature and process of stakeholder-generated policies, identification is conducted over the long term, emphasizing conflict. The alcohol investment policy generated many pros and cons, prompting the government to intervene and later cancel the policy. When considering the identification of policy conflicts through the lens of the Advocacy Coalition Framework, it is important to examine the severity and speed of policy change. The findings of this study show that investment policies only fulfill economic requirements, ignoring all other considerations and standards. To support the social fabric of society, policy regulations are needed that accommodate all interests and produce win-win solutions. From upstream to downstream, alcohol circulation can be regulated using a comprehensive strategy. Policy conflicts are evaluated based on their nature, intensity, and causes through the lens of context and events.

PurposeThis paper aims to manage access control tasks to satisfy the user privacy needs of online information resources according to social relations and tags.Design/methodology/approachThe study proposes a method for access control management in the online social context. The proposed method includes the access control policy management process, metadata of access control policies, the data of ontologies, tags, and social relations, and conflict detection rules.FindingsOnline information sharing and hiding, which needs to consider social relations and mentioned topics, is a unique context and needs a novel access control mechanism. Ontologies are powerful and expressive enough to identify conflicts in access control policies. The paper provides a method using ontologies to control the access control activities based on social relations and tags on web content. The effectiveness of the method's conflict detection rules is validated through several scenarios.Research limitations/implicationsTo make the proposed method suitable for widespread usage, further work is required to develop an access control policy specification and conflict detection tool. The proposed method introduces relatively novel usage scenarios, which consider social relationships, and tags compared with existing access control methods for online information sharing.Practical implicationsThe proposed access control mechanism can be integrated into existing web sites. Online users can use this method to share information more easily than at present.Originality/valueThe method enables flexible access control in social contexts and handles unavoidable conflicts. It also opens the way to new access control scenarios in online social activities. The method can be used to keep secrets hidden from selected people.

Policy conflicts in home automation

To support advanced network services, Internet routers must perform packet classification based on a set of rules called packet filters. If two or more filters overlap, a filter conflict will occur and lead to ambiguity in packet classification. Further, it may affect network security or even the correctness of packet routing. Hence, it is necessary to detect conflicts to avoid the above problems. In recent years, many conflict detection algorithms have been proposed, but most of them detect conflicts for only prefix fields (i.e., source/destination IP address fields) of filters. For greater practicality, conflict detection must include non-prefix fields such as source/destination IP port fields and the protocol field. In this study, we propose an efficient conflict detection algorithm for five-dimensional filters, which include both prefix and non-prefix fields. In the proposed algorithm, a tiny lookup table is created for quickly filtering out a large portion of non-conflicting filter pairs, thereby reducing the overall conflict detection time. Experimental results show that our algorithm reduces the detection time by 10% to 28% compared with other conflict detection algorithms for 20 K filter databases. More importantly, our algorithm can be used to extend any existing conflict detection algorithms for two-dimensional filters to support fast conflict detection for five-dimensional filters.

We designed a Network Exfiltration Detection System (NEDS) to detect data exfiltration as occurring in ransomware attacks. The NEDS operates on aggregated metadata, which is more privacy-friendly and allows analysis of large volumes of high-speed network traffic. The NEDS aggregates metadata from multiple, sequential sessions between pairs of hosts in a network, which captures exfiltration by both stateful and stateless protocols. The aggregated metadata include averages per session of both packet count, request entropy, duration, and payload size, as well as the average time between sequential sessions and the amount of aggregated sessions. The NEDS applies a number of autoencoder models with unsupervised learning to detect anomalies, where each autoencoder model targets different protocols. We trained the autoencoder models with real-life data collected at network sensors in the National Detection Network as operated by the National Cyber Security Centre in the Netherlands, and configured the detection threshold by varying the false positive rate. We evaluated the detection performance by injecting exfiltration over different channels, including DNS tunnels and uploads to FTP servers, web servers, and cloud storage. Our experimental results show that aggregation significantly increases detection performance of exfiltration that happens over longer time, most notably, DNS tunnels. Our NEDS can be applied to detect exfiltration either in near-real-time data analysis with limited false positive rates, or in captured data to aid in post-incident analysis.

Network security polices are essential elements in Internet security devices that provide traffic filtering, integrity, confidentiality, and authentication. Network security perimeter devices such as firewalls, IPSec, and IDS/IPS devices operate based on locally configured policies. However, configuring network security policies remains a complex and error-prone task due to rule dependency semantics and the interaction between policies in the network. This complexity is likely to increase as the network size increases. A successful deployment of a network security system requires global analysis of policy configurations of all network security devices in order to avoid policy conflicts and inconsistency. Policy conflicts may cause serious security breaches and network vulnerability such as blocking legitimate traffic, permitting unwanted traffic, and insecure data transmission. This article presents a comprehensive classification of security policy conflicts that might potentially exist in a single security device (intrapolicy conflicts) or between different network devices (interpolicy conflicts) in enterprise networks. We also show the high probability of creating such conflicts even by expert system administrators and network practitioners.

Changes in policy, institutional and competitive environments have led to increased trade and a rise in trade tensions in the Canada-U.S. barley market. These tensions stem from policies and marketing institutions that have evolved independently in these two countries. Results from a detailed spatial equilibrium model of the Canada-U.S. barley market are presented in this article. Simulations are used to quantify effects of U.S. import restrictions; removal of Canadian rail subsidies, different Export Enhancement Program (EEP) subsidy levels, restoration of Conservation Reserve Program (CRP) acres to U.S. production, and retention of Canadian Wheat Board control over Canadian barley sales-all of which affect trade flows in the barley sector.

Stochastic optimal control for aircraft conflict resolution under wind uncertainty

Disruptive crises are generally conducive to policy conflict between multiple stakeholders. Following the potentially adversarial nature of crisis resolution, there is a need for theoretical approaches to advance the understanding of the political context in which such disputes evolve. This article explains how the advocacy coalition framework (ACF) can be applied as a theoretical basis for understanding the development and effects of policy conflicts in crisis resolution. Illustrating the ACF as a tool for descriptive policy analysis in this context, the article conducts a case study of the European response to the 2010 volcanic ash cloud crisis, focusing on the nature of the policy subsystem, the role of scientific information, competing crisis narratives, exploitation of resources and venues, and policy change. The concluding section identifies a set of theoretical implications and specifies how the framework can be used by practitioners to mitigate the effects of policy conflicts on crisis resolution.

A multilevel Bit Vector minimization method for fast online detection of conflicting flow entries in OpenFlow table