Conf. on Distributed Systems: Operations and Management (DSOM 2001)

"Automatic Generation of IPSec/VPN Security Policies in an Intra-Domain Environment"

			       Z. Fu and S. F. Wu

IPSec policies are widely deployed in firewalls or security gateways to protect
information property.  The security treatment (e.g., deny, allow or encyrpt, etc.)
of all inbound or outbound traffic will be determined by the security policies, 
and thus it is critical for policies to be specified and configured correctly.  
IPSec policies are manually configured to individual security gateway in current 
practice, which could be very inefficient and error-prone.  In this research, 
we focus on two questions: 1) How to ensure polciy correctness? 2) How to 
systematically specify correct policies instead of manually configuring them?  
Apparently, policies are correct if they do what they are intended to do.  
However, there is a vague relationship between what they are intended to do 
and what they really do.  In our research, we clearly defined a higher level
policy, called security requirment, and clearly defined their satisfaction.  
Therefore, policies are correct only if they satisfy all requirements.  
Furthermore, we designed algorithms to automatically generate correct policies, 
given security requirements.  People can specify their requirements at a high level 
without concerning specific low level parameters, and then correct low level 
policies will be automatically generated.  The automation cannot only save tremendous 
administrative labor but also guarantee the policies are correct.