TY - GEN
T1 - BANDS
T2 - IFIP/IEEE 8th International Symposium on Integrated Network Management, IM 2003
AU - Yang, Yanyan
AU - Fu, Zhi (Judy)
AU - Felix Wu, S.
PY - 2003
Y1 - 2003
N2 - IPSec/VPN is widely deployed for users to remotely access their corporate data. IPSec policies must be correctly set up for VPN to provide anticipated protection. Manual policy setup is unscalable, inefficient and error-prone. Automated policy generation to comply with and enforce high-level security policies is desired but difficult, especially in an inter-domain environment when a VPN traverse multiple domains. This paper presents a distributed framework and protocol, BANDS, for inter-domain policy negotiation and generation. The BANDS architecture consists of two phases: AS (Autonomous System) route path discovery and an inter-domain collaborative protocol for policy negotiation among the autonomous systems discovered in the first phase. Each AS conceptually has one security requirement server responsible for the task of inter-domain policy negotiation. Following this two-step process in BANDS, a set of distributed security policies (for the implementation of policy enforcement) will be automatically negotiated/generated based on decentralized and predefined security requirements.
AB - IPSec/VPN is widely deployed for users to remotely access their corporate data. IPSec policies must be correctly set up for VPN to provide anticipated protection. Manual policy setup is unscalable, inefficient and error-prone. Automated policy generation to comply with and enforce high-level security policies is desired but difficult, especially in an inter-domain environment when a VPN traverse multiple domains. This paper presents a distributed framework and protocol, BANDS, for inter-domain policy negotiation and generation. The BANDS architecture consists of two phases: AS (Autonomous System) route path discovery and an inter-domain collaborative protocol for policy negotiation among the autonomous systems discovered in the first phase. Each AS conceptually has one security requirement server responsible for the task of inter-domain policy negotiation. Following this two-step process in BANDS, a set of distributed security policies (for the implementation of policy enforcement) will be automatically negotiated/generated based on decentralized and predefined security requirements.
UR - https://www.scopus.com/pages/publications/84904312147
UR - https://www.scopus.com/pages/publications/84904312147#tab=citedBy
U2 - 10.1007/978-0-387-35674-7
DO - 10.1007/978-0-387-35674-7
M3 - Conference contribution
AN - SCOPUS:84904312147
SN - 9781475755213
T3 - IFIP Advances in Information and Communication Technology
SP - 231
EP - 244
BT - Integrated Network Management VIII
PB - Springer New York LLC
Y2 - 24 March 2003 through 28 March 2003
ER -