Scalable model-based configuration management of security services in complex enterprise networks

Security administrators face the challenge of designing, deploying and maintaining a variety of configuration files related to security systems, especially in large-scale networks. These files have heterogeneous syntaxes and follow differing semantic concepts. Nevertheless, they are interdependent due to security services having to cooperate and their configuration to be consistent with each other, so that global security policies are completely and correctly enforced. To tackle this problem, our approach supports a comfortable definition of an abstract high-level security policy and provides an automated derivation of the desired configuration files. It is an extension of policy-based management and policy hierarchies, combining model-based management (MBM) with system modularization. MBM employs an object-oriented model of the managed system to obtain the details needed for automated policy refinement. The modularization into abstract subsystems (ASs) segment the system-and the model-into units which more closely encapsulate related system components and provide focused abstract views. As a result, scalability is achieved and even comprehensive IT systems can be modelled in a unified manner. The associated tool MoBaSeC (Model-Based-Service-Configuration) supports interactive graphical modelling, automated model analysis and policy refinement with the derivation of configuration files. We describe the MBM and AS approaches, outline the tool functions and exemplify their applications and results obtained. Copyright (C) 2010 John Wiley & Sons, Ltd.

Formal validation of automated policy refinement in the management of network security systems

Policy hierarchies and automated policy refinement are powerful approaches to simplify administration of security services in complex network environments. A crucial issue for the practical use of these approaches is to ensure the validity of the policy hierarchy, i.e. since the policy sets for the lower levels are automatically derived from the abstract policies (defined by the modeller), we must be sure that the derived policies uphold the high-level ones. This paper builds upon previous work on Model-based Management, particularly on the Diagram of Abstract Subsystems approach, and goes further to propose a formal validation approach for the policy hierarchies yielded by the automated policy refinement process. We establish general validation conditions for a multi-layered policy model, i.e. necessary and sufficient conditions that a policy hierarchy must satisfy so that the lower-level policy sets are valid refinements of the higher-level policies according to the criteria of consistency and completeness. Relying upon the validation conditions and upon axioms about the model representativeness, two theorems are proved to ensure compliance between the resulting system behaviour and the abstract policies that are modelled.

Basic oxygen furnace slag as a treatment material for pathogens: Contribution of inactivation and attachment in virus attenuation

Basic oxygen furnace (BOF) slag media were studied as a potential treatment material in on-site sanitation systems. Batch and column studies were conducted to evaluate attenuation of the bacteriophage PR772 and 0.190 mu m diameter microspheres by BOF media, and to delineate the relative contributions of two principle processes of virus attenuation: inactivation and attachment. In the batch studies, conducted at 4 degrees C, substantial inactivation of PR772 did not occur in the pH 7.6 and 9.5 suspensions. At pH 11.4, bimodal inactivation of PR772 was observed, at an initial rate of 2.1 log C/C(0) day(-1) for the first two days, followed by a much slower rate of 0.124 log C/C(0) day(-1) over the following 10 days. Two column studies were conducted at 4 degrees C at a flow rate of 1 pore volume day(-1) using two slag sources (Stelco, Ontario; Tubarao, Brazil) combined with sand and pea gravel. In both column experiments, the effluent microsphere concentration approached input concentrations over time (reductions of 0.1-0.2 log C/C(0)), suggesting attachment processes for microspheres were negligible. Removal of PR772 virus was more pronounced both during the early stages of the experiments, but also after longer transport times (0.5-1.0 log C/C(0)). PR772 reduction appeared to be primarily as a result of virus inactivation in response to the elevated pH conditions generated by the BOF mixture (10.6-11.4). On-site sanitation systems using BOF media should be designed to maintain sufficient contact time between the BOF media and the wastewater to allow sufficient residence time of pathogens at elevated pH conditions. (C) 2009 Published by Elsevier Ltd.

Covalent attachment of 3,4,9,10-perylenediimides onto the walls of mesoporous molecular sieves MCM-41 and SBA-15

This work describes the covalent grafting of 3,4,9,10-perylenediimides (PDI), which are fluorescent dyes with very interesting optical properties, onto the walls of mesoporous molecular sieves MCM-41 and SBA-15. The mesoporous materials were first treated with 3-aminopropyltriethoxysilane (APTES) in anhydrous toluene, generating amine-containing surfaces. The amine-containing materials were then reacted with 3,4,9,10-perylenetetracarboxylic dianhydride (PTCA), generating surface-grafted PDI. Infrared spectra of the materials showed that the reaction with amino groups took place at both anhydride ends of the PTCA molecule, resulting in surface attached diimides. No sign of unreacted anhydride groups were found. The new materials, designated as MCMN2PDI and SBAN(2)PDI, presented absorption and emission spectra corresponding to weakly coupled PDI chromophores, in contrast to the strongly coupled rings usually found in solid PDI samples. The materials showed a red fluorescence, which could be observed by the naked eye under UV irradiation or with a fluorescence microscope. The PDI-modified mesoporous materials showed electrical conductivity when pressed into a pellet. The results presented here show that the new materials are potentially useful in the design of nanowires. (C) 2007 Elsevier Inc. All rights reserved.