[Paper Review] The Mathematical Foundations for Mapping Policies to Network Devices (Technical Report)

Dinesha Ranathunga, Matthew Roughan+2 more|arXiv (Cornell University)|May 30, 2016

Access Control and Trust4 citations

TL;DR

This paper proposes a formal algebraic framework to map high-level security policies to network devices, ensuring correct and verifiable deployment. By modeling policies using the Zone-Conduit model and applying provably correct algebraic semantics, the approach eliminates configuration errors—demonstrated by zero incorrect ACL rule mappings in seven real-world SCADA networks—while maintaining computational efficiency.

ABSTRACT

A common requirement in policy specification languages is the ability to map policies to the underlying network devices. Doing so, in a provably correct way, is important in a security policy context, so administrators can be confident of the level of protection provided by the policies for their networks. Existing policy languages allow policy composition but lack formal semantics to allocate policy to network devices. Our research tackles this from first principles: we ask how network policies can be described at a high-level, independent of firewall-vendor and network minutiae. We identify the algebraic requirements of the policy mapping process and propose semantic foundations to formally verify if a policy is implemented by the correct set of policy-arbiters. We show the value of our proposed algebras in maintaining concise network-device configurations by applying them to real-world networks.

Motivation & Objective

• To address the lack of formal semantics in existing policy languages that prevent accurate, verifiable mapping of high-level policies to network devices.
• To decouple security policies from network-specific details like IP addresses and vendor configurations, enabling policy intent to be preserved.
• To provide a mathematically rigorous foundation that ensures policies are correctly enforced by the intended firewalls and interfaces.
• To reduce configuration complexity and error rates in mission-critical networks such as SCADA by enabling automated, correct policy deployment.
• To support 'what-if' analysis and policy compliance verification through formal reasoning over policy abstractions.

Proposed method

• The authors define a Zone-Conduit model to abstract network topology, separating policy intent from device-specific configurations.
• They introduce algebraic operations for sequential and parallel composition of policies, preserving semantics during mapping to devices.
• A formal verification framework ensures that policy mappings are correct by construction, using mathematical semantics to validate assignments to firewalls, interfaces, and directions.
• The system uses Algorithm 1 to compute optimal mappings based on zone and conduit structures, with worst-case complexity O(21⁴) in tested cases.
• The approach supports automated validation by checking ACL rule allocations against formal policy specifications to detect incorrect firewall, interface, or direction assignments.
• The framework is evaluated using seven real SCADA network case studies with historical firewall configurations.

Experimental results

Research questions

• RQ1 How can high-level security policies be formally mapped to network devices in a way that guarantees correctness and verifiability?
• RQ2 What algebraic structures are required to preserve policy semantics—especially for sequential and parallel compositions—during device mapping?
• RQ3 Can a formal policy-mapping framework reduce configuration errors in real-world, mission-critical networks such as SCADA systems?
• RQ4 To what extent does the proposed method improve configuration maintainability and support policy compliance and change analysis?
• RQ5 How does the computational complexity of the mapping algorithm scale with network size, particularly in terms of zones versus hosts?

Key findings

• The proposed algebraic framework achieved zero incorrect ACL rule mappings across seven real-world SCADA case studies, eliminating errors in firewall, interface, and direction assignments.
• The average runtime for policy-to-device mapping was 53 seconds per case study on a standard desktop computer, demonstrating practical efficiency.
• The worst-case computational complexity was O(21⁴) when using zones, compared to O(67580⁴) when mapping by individual hosts, proving tractability at scale.
• On average, 10 ACL rules per case study were incorrectly assigned in original configurations—highlighting the prevalence of deployment errors in real networks.
• The framework successfully identified and corrected 15 incorrect direction assignments and 8 interface-level misconfigurations per case study on average.
• The approach enables accurate 'what-if' analysis and supports compliance checking by decoupling policy intent from network-specific implementation details.