TC: Small: An Algorithmic Framework for Distributed Network Security Policies Management

创建网络以提供可达性;然而，由于在网络设备上配置的许多复杂的网络安全策略以出于安全和隐私目的限制可达性以及诸如路由的各种因素可能以意想不到的方式影响可达性，因此网络可达性没有得到很好的理解。由于缺乏分布式的网络安全策略管理工具，网络运营商一直使用原始的工具来管理日益复杂的可达性问题，遵循“试错”的方法，这导致许多策略和可达性错误。虽然提供比必要的更多的可达性打开了不必要的流量的大门，但提供比必要的更少的可达性可能会破坏正常的业务运营。该项目采用主动方法进行可达性管理，并帮助运营商设计、验证、分析、故障排除和优化分布式网络安全策略。在这个项目中开发的新概念，模型，定理和算法推进了我们对网络可达性的认识和理解，并且在这个项目中开发的全面的网络可达性工具包显着提高了网络的安全性和可靠性。严格的模型和数学公式的网络可达性作为未来工作的理论基础，这一基本的网络安全问题。用于网络可达性量化、验证、查询、监控、分析和优化的综合工具包可供网络运营商用于故障排除和调试可达性问题。该技术实现了分布式网络安全策略的无缝协作，并确保实施适当的可达性。为了促进学习，这项工作积极吸收高中生、本科生、研究生，特别是代表性不足的少数民族的学生参加。

Networks are created to provide reachability; yet, network reachability is not well understood due to the many sophisticated network security policies configured on network devices to limit reachability for security and privacy purposes and the various factors such as routing that may affect reachability in unexpected ways. Due to the lack of distributed network security policy management tools, network operators have been using primitive tools to manage the increasingly complex reachability issues following a ``trial and error'' approach, which leads to many policy and reachability errors. While providing more reachability than necessary opens doors to unwanted traffic, providing less reachability than necessary may disrupt normal business operations. This project employs proactive approaches to reachability management and helps operators to design, verify, analyze, troubleshoot, and optimize distributed network security policies. The new concepts, models, theorems, and algorithms developed in this project advance our knowledge and understanding of network reachability, and the comprehensive network reachability toolkits developed in this project significantly improve network security and reliability. The rigorous models and mathematical formulations of network reachability serves as the theoretical foundation of future work on this fundamental network security issue. The comprehensive toolkit for network reachability quantification, verification, query, monitoring, analysis, and optimization can be used by network operators to troubleshoot and debug reachability problems. This technology enables the seamless collaboration of distributed network security policies and ensure the right amount of reachability is enforced. To promote learning, this effort actively involves high school, undergraduate, graduate students, especially students from under-represented minorities.