Formal validation of automated policy refinement in the management of network security systems

Policy hierarchies and automated policy refinement are powerful approaches to simplify administration of security services in complex network environments. A crucial issue for the practical use of these approaches is to ensure the validity of the policy hierarchy, i.e. since the policy sets for the lower levels are automatically derived from the abstract policies (defined by the modeller), we must be sure that the derived policies uphold the high-level ones. This paper builds upon previous work on Model-based Management, particularly on the Diagram of Abstract Subsystems approach, and goes further to propose a formal validation approach for the policy hierarchies yielded by the automated policy refinement process. We establish general validation conditions for a multi-layered policy model, i.e. necessary and sufficient conditions that a policy hierarchy must satisfy so that the lower-level policy sets are valid refinements of the higher-level policies according to the criteria of consistency and completeness. Relying upon the validation conditions and upon axioms about the model representativeness, two theorems are proved to ensure compliance between the resulting system behaviour and the abstract policies that are modelled.

Satellite Rainfall Estimates Over South America - Possible Applicability to the Water Management of Large Watersheds1

This work analyzes high-resolution precipitation data from satellite-derived rainfall estimates over South America, especially over the Amazon Basin. The goal is to examine whether satellite-derived precipitation estimates can be used in hydrology and in the management of larger watersheds of South America. High spatial-temporal resolution precipitation estimates obtained with the CMORPH method serve this purpose while providing an additional hydrometeorological perspective on the convective regime over South America and its predictability. CMORPH rainfall estimates at 8-km spatial resolution for 2003 and 2004 were compared with available rain gauge measurements at daily, monthly, and yearly accumulation time scales. The results show the correlation between satellite-derived and gauge-measured precipitation increases with accumulation period from daily to monthly, especially during the rainy season. Time-longitude diagrams of CMORPH hourly rainfall show the genesis, strength, longevity, and phase speed of convective systems. Hourly rainfall analyses indicate that convection over the Amazon region is often more organized than previously thought, thus inferring that basin scale predictions of rainfall for hydrological and water management purposes have the potential to become more skillful. Flow estimates based on CMORPH and the rain gauge network are compared to long-term observed average flow. The results suggest this satellite-based rainfall estimation technique has considerable utility. Other statistics for monthly accumulations also suggest CMORPH can be an important source of rainfall information at smaller spatial scales where in situ observations are lacking.

Critical, issues and needs in management of primary immunodeficiency diseases in Latin America

Experts from six Latin American countries met to discuss critical issues and needs in the diagnosis and management of primary immunodeficiency diseases (PIDD). The diagnosis of PIDD is generally made following referral to an immunology centre located in a major city, but many paediatricians and general practitioners are not sufficiently trained to suspect PIDD in the first place. Access to laboratory testing is generally limited, and only some screening tests are typically covered by government health programmes. Specialised diagnostic tests are generally not reimbursed. Access to treatment varies by country reflecting differences in healthcare systems and reimbursement policies. An online PIDD Registry Programme for Latin America has been available since 2009, which will provide information about PIDD epidemiology in the region. Additional collaboration across countries appears feasible in at least two areas: a laboratory network to facilitate the diagnosis of PIDD, and educational programmes to improve PIDD awareness. In total, these collaborations should make it possible to advance the diagnosis and management of PIDD in Latin America. (C) 2010 SEICAP. Published by Elsevier Espana, S.L. All rights reserved.

Two-level network design with intermediate facilities: An application to electrical distribution systems

We consider the two-level network design problem with intermediate facilities. This problem consists of designing a minimum cost network respecting some requirements, usually described in terms of the network topology or in terms of a desired flow of commodities between source and destination vertices. Each selected link must receive one of two types of edge facilities and the connection of different edge facilities requires a costly and capacitated vertex facility. We propose a hybrid decomposition approach which heuristically obtains tentative solutions for the vertex facilities number and location and use these solutions to limit the computational burden of a branch-and-cut algorithm. We test our method on instances of the power system secondary distribution network design problem. The results show that the method is efficient both in terms of solution quality and computational times. (C) 2010 Elsevier Ltd. All rights reserved.

Benders, metric and cutset inequalities for multicommodity capacitated network design

Solving multicommodity capacitated network design problems is a hard task that requires the use of several strategies like relaxing some constraints and strengthening the model with valid inequalities. In this paper, we compare three sets of inequalities that have been widely used in this context: Benders, metric and cutset inequalities. We show that Benders inequalities associated to extreme rays are metric inequalities. We also show how to strengthen Benders inequalities associated to non-extreme rays to obtain metric inequalities. We show that cutset inequalities are Benders inequalities, but not necessarily metric inequalities. We give a necessary and sufficient condition for a cutset inequality to be a metric inequality. Computational experiments show the effectiveness of strengthening Benders and cutset inequalities to obtain metric inequalities.

Scalable model-based configuration management of security services in complex enterprise networks

Security administrators face the challenge of designing, deploying and maintaining a variety of configuration files related to security systems, especially in large-scale networks. These files have heterogeneous syntaxes and follow differing semantic concepts. Nevertheless, they are interdependent due to security services having to cooperate and their configuration to be consistent with each other, so that global security policies are completely and correctly enforced. To tackle this problem, our approach supports a comfortable definition of an abstract high-level security policy and provides an automated derivation of the desired configuration files. It is an extension of policy-based management and policy hierarchies, combining model-based management (MBM) with system modularization. MBM employs an object-oriented model of the managed system to obtain the details needed for automated policy refinement. The modularization into abstract subsystems (ASs) segment the system-and the model-into units which more closely encapsulate related system components and provide focused abstract views. As a result, scalability is achieved and even comprehensive IT systems can be modelled in a unified manner. The associated tool MoBaSeC (Model-Based-Service-Configuration) supports interactive graphical modelling, automated model analysis and policy refinement with the derivation of configuration files. We describe the MBM and AS approaches, outline the tool functions and exemplify their applications and results obtained. Copyright (C) 2010 John Wiley & Sons, Ltd.