Published Articles >> Table of Contents >> Abstract

16th Annual Computer Security Applications Conference (ACSAC'00)   p. 100
Policy mediation for multi-enterprise environments
P. Galiasso, Center for Inf. Security, Tulsa Univ., OK, USA
O. Bremer, Center for Inf. Security, Tulsa Univ., OK, USA
J. Hale, Center for Inf. Security, Tulsa Univ., OK, USA
S. Shenoi, Center for Inf. Security, Tulsa Univ., OK, USA
D. Ferraiola, Center for Inf. Security, Tulsa Univ., OK, USA
V. Hu, Center for Inf. Security, Tulsa Univ., OK, USA

Full Article Text:

DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/ACSAC.2000.898863
Send link to a friend

Abstract
Existing software infrastructures and middleware provide uniform security services across heterogeneous information networks. However few, if any, tools exist that support access control policy management for and between large enterprise information networks. Insiders often exploit gaps in policies to mount devastating attacks. This paper presents a Policy Machine and Policy Mediation Architecture for coordinating diverse policies in large information networks. The language-based approach adopted by each of these technologies permits local and global access control policy validation with static analysis and other formal techniques. Together the Policy Machine and Policy Mediation Architecture comprise an effective system for closing policy gaps in multi-enterprise environments.
Back to Top Additional Information
Index Terms- information networks; authorisation; business data processing; software architecture; policy mediation; multi-enterprise environments; software infrastructures; middleware; uniform security services; heterogeneous information networks; access control policy management; large enterprise information networks; Policy Machine; Policy Mediation Architecture; static analysis; formal techniques Citation:  P. Galiasso, O. Bremer, J. Hale, S. Shenoi, D. Ferraiola, V. Hu, "Policy mediation for multi-enterprise environments," acsac, p. 100,  16th Annual Computer Security Applications Conference (ACSAC'00),  2000