Towards Policy Enforcement Point as a Service (PEPS)

Arash Shaghaghi; Mohamed Ali Kaafar; Sandra Scott-Hayward; Salil S. Kanhere; Sanjay Jha

doi:10.1109/NFV-SDN.2016.7919475

Towards Policy Enforcement Point as a Service (PEPS)

Arash Shaghaghi, Mohamed Ali Kaafar, Sandra Scott-Hayward, Salil S. Kanhere, Sanjay Jha

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding contribution › peer-review

5 Citations (Scopus)

Abstract

In this paper, we coin the term Policy Enforcement as a Service (PEPS), which enables the provision of innovative inter-layer and inter-domain Access Control. We leverage the architecture of Software-Defined-Network (SDN) to introduce a common network-level enforcement point, which is made available to a range of access control systems. With our PEPS model, it is possible to have a 'defense in depth' protection model and drop unsuccessful access requests before engaging the data provider (e.g. a database system). Moreover, the current implementation of access control within the 'trusted' perimeter of an organization is no longer a restriction so that the potential for novel, distributed and cooperative security services can be realized. We conduct an analysis of the security requirements and technical challenges for implementing Policy Enforcement as a Service. To illustrate the benefits of our proposal in practice, we include a report on our prototype PEPS-enabled location-based access control.

Original language	English
Title of host publication	NFV-SDN 2016
Subtitle of host publication	2016 IEEE Conference on Network Function Virtualization and Software Defined Networks
Place of Publication	Piscataway, NJ
Publisher	Institute of Electrical and Electronics Engineers (IEEE)
Pages	50-55
Number of pages	6
ISBN (Electronic)	9781509009336
DOIs	https://doi.org/10.1109/NFV-SDN.2016.7919475
Publication status	Published - 2016
Externally published	Yes
Event	2016 IEEE Conference on Network Function Virtualization and Software Defined Networks, NFV-SDN 2016 - Palo Alto, United States Duration: 7 Nov 2016 → 10 Nov 2016

Conference

Conference	2016 IEEE Conference on Network Function Virtualization and Software Defined Networks, NFV-SDN 2016
Country/Territory	United States
City	Palo Alto
Period	7/11/16 → 10/11/16

Access to Document

10.1109/NFV-SDN.2016.7919475

Cite this

@inproceedings{4bde529f6c644dc1a45c046127d4e359,

title = "Towards Policy Enforcement Point as a Service (PEPS)",

abstract = "In this paper, we coin the term Policy Enforcement as a Service (PEPS), which enables the provision of innovative inter-layer and inter-domain Access Control. We leverage the architecture of Software-Defined-Network (SDN) to introduce a common network-level enforcement point, which is made available to a range of access control systems. With our PEPS model, it is possible to have a 'defense in depth' protection model and drop unsuccessful access requests before engaging the data provider (e.g. a database system). Moreover, the current implementation of access control within the 'trusted' perimeter of an organization is no longer a restriction so that the potential for novel, distributed and cooperative security services can be realized. We conduct an analysis of the security requirements and technical challenges for implementing Policy Enforcement as a Service. To illustrate the benefits of our proposal in practice, we include a report on our prototype PEPS-enabled location-based access control.",

author = "Arash Shaghaghi and Kaafar, {Mohamed Ali} and Sandra Scott-Hayward and Kanhere, {Salil S.} and Sanjay Jha",

year = "2016",

doi = "10.1109/NFV-SDN.2016.7919475",

language = "English",

pages = "50--55",

booktitle = "NFV-SDN 2016",

publisher = "Institute of Electrical and Electronics Engineers (IEEE)",

address = "United States",

note = "2016 IEEE Conference on Network Function Virtualization and Software Defined Networks, NFV-SDN 2016 ; Conference date: 07-11-2016 Through 10-11-2016",

}

Shaghaghi, A, Kaafar, MA, Scott-Hayward, S, Kanhere, SS & Jha, S 2016, Towards Policy Enforcement Point as a Service (PEPS). in NFV-SDN 2016: 2016 IEEE Conference on Network Function Virtualization and Software Defined Networks. Institute of Electrical and Electronics Engineers (IEEE), Piscataway, NJ, pp. 50-55, 2016 IEEE Conference on Network Function Virtualization and Software Defined Networks, NFV-SDN 2016, Palo Alto, United States, 7/11/16. https://doi.org/10.1109/NFV-SDN.2016.7919475

Towards Policy Enforcement Point as a Service (PEPS). / Shaghaghi, Arash; Kaafar, Mohamed Ali; Scott-Hayward, Sandra et al.
NFV-SDN 2016: 2016 IEEE Conference on Network Function Virtualization and Software Defined Networks. Piscataway, NJ: Institute of Electrical and Electronics Engineers (IEEE), 2016. p. 50-55.

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding contribution › peer-review

TY - GEN

T1 - Towards Policy Enforcement Point as a Service (PEPS)

AU - Shaghaghi, Arash

AU - Kaafar, Mohamed Ali

AU - Scott-Hayward, Sandra

AU - Kanhere, Salil S.

AU - Jha, Sanjay

PY - 2016

Y1 - 2016

N2 - In this paper, we coin the term Policy Enforcement as a Service (PEPS), which enables the provision of innovative inter-layer and inter-domain Access Control. We leverage the architecture of Software-Defined-Network (SDN) to introduce a common network-level enforcement point, which is made available to a range of access control systems. With our PEPS model, it is possible to have a 'defense in depth' protection model and drop unsuccessful access requests before engaging the data provider (e.g. a database system). Moreover, the current implementation of access control within the 'trusted' perimeter of an organization is no longer a restriction so that the potential for novel, distributed and cooperative security services can be realized. We conduct an analysis of the security requirements and technical challenges for implementing Policy Enforcement as a Service. To illustrate the benefits of our proposal in practice, we include a report on our prototype PEPS-enabled location-based access control.

AB - In this paper, we coin the term Policy Enforcement as a Service (PEPS), which enables the provision of innovative inter-layer and inter-domain Access Control. We leverage the architecture of Software-Defined-Network (SDN) to introduce a common network-level enforcement point, which is made available to a range of access control systems. With our PEPS model, it is possible to have a 'defense in depth' protection model and drop unsuccessful access requests before engaging the data provider (e.g. a database system). Moreover, the current implementation of access control within the 'trusted' perimeter of an organization is no longer a restriction so that the potential for novel, distributed and cooperative security services can be realized. We conduct an analysis of the security requirements and technical challenges for implementing Policy Enforcement as a Service. To illustrate the benefits of our proposal in practice, we include a report on our prototype PEPS-enabled location-based access control.

UR - http://www.scopus.com/inward/record.url?scp=85019976948&partnerID=8YFLogxK

U2 - 10.1109/NFV-SDN.2016.7919475

DO - 10.1109/NFV-SDN.2016.7919475

M3 - Conference proceeding contribution

AN - SCOPUS:85019976948

SP - 50

EP - 55

BT - NFV-SDN 2016

PB - Institute of Electrical and Electronics Engineers (IEEE)

CY - Piscataway, NJ

T2 - 2016 IEEE Conference on Network Function Virtualization and Software Defined Networks, NFV-SDN 2016

Y2 - 7 November 2016 through 10 November 2016

ER -

Towards Policy Enforcement Point as a Service (PEPS)

Abstract

Conference

Access to Document

Other files and links

Fingerprint

Cite this