Optimal Deployment of High-Level Access Control Policies in Heterogeneous Enforcement Infrastructures

Formal high-level network access control policy languages allow the modeling of security requirements of a network deployment with respect to the properties confidentiality and authenticity while being abstracted from particular network infrastructures. Normally, this is done to allow verification of the configuration deployed on the network elements against the model.This paper presents an approach to automate placement of high-level network access control rules on a given substrate network by reducing the problem to a virtual network embedding problem. With an SMT solver, first placeability is verified, i.e., the given substrate network supports the model, and secondly, a distribution of rules onto network entities like gateways or firewalls can be generated, that optimizes a given cost function such as path length, latency, or priority of certain network parts.The evaluation of our prototypical implementation for the FaVe Policy Language (FPL) shows the feasibility of our approach as well as reasonable performance for common network sizes with runtimes below a minute.