Academic Commons

Articles

Virtual Private Services: Coordinated Policy Enforcement for Distributed Applications

Ioannidis, Sotiris; Bellovin, Steven Michael; Ioannidis, John; Anagnostakis, Kostas G.; Keromytis, Angelos D.; Smith, Jonathan M.

Large scale distributed applications combine network access with multiple storage and computational elements. The distributed responsibility for resource control creates new security issues, caused by the complexity of the operating environment. In particular, policies at multiple layers and locations force conventional mechanisms such as firewalls and compartmented file storage into roles where they are clumsy and failure-prone. Our approach relies on two functional divisions. First, we split policy specification and policy enforcement, providing local autonomy within the constraints of the global security policy. Second, we create virtual security domains each with its own security policy. Every domain has an associated set of privileges and permissions restricting it to the resources it needs to use and the services it must perform. Virtual private services ensure security and privacy policies are adhered to through coordinated policy enforcement points.

Subjects

Files

Also Published In

Title
International Journal of Network Security

More About This Work

Academic Units
Computer Science
Published Here
July 5, 2011
Academic Commons provides global access to research and scholarship produced at Columbia University, Barnard College, Teachers College, Union Theological Seminary and Jewish Theological Seminary. Academic Commons is managed by the Columbia University Libraries.