EAGER: A Logic-Based Security Framework for Wired and Mobile Perimeter

移动（无线）通信已经成为当今企业和政府机构必不可少的信息交流平台。他们需要像保护有线设备一样保护移动设备。今天，这些组织通常有多个外部移动和无线连接到外部世界，以提供高带宽和容忍连接故障。保护网络边界的一种方法是使用边界网关，对进入其边界的网络流量（有线和无线）施加统一的静态策略，并在移动设备本身上安装有效的安全方案和策略。虽然简单，但这种静态策略有许多缺点，可能无法为移动和有线边界提供必要的保护。它们(a)无法对外部环境的变化做出反应，(b)它们在信任关系中存在物理限制和差异，以及(c)在一组非通信策略之间的完整性存在问题。因此，为了提供对动态变化（在移动边界中相当频繁）做出反应并尊重组织目标（如优惠待遇），同时执行组织的总体安全目标的边界保护策略，要求在每个边界网关执行的单个策略必须(a)动态和灵活，并且(b)成为全球策略的一部分，以便在移动基础设施中共同执行安全目标。在本提案中，我们通过基于逻辑的安全框架来实现这一点。我们的解决方案有可能在降低管理成本的同时提高安全性。

Mobile (wireless) communication has become an essential information exchange platform for today's enterprise and government organizations. They need to secure mobile devices as they secure wired devices. Today, it is common for these organizations to have multiple external mobile and wireless connections to the outside world to provide high bandwidth and tolerate connection failures. One way to protect the network perimeter is to use border gateways that impose a uniform static policy on network traffic (wired and wireless) entering through its borders and by installing effective security schemes and policies on mobile devices itself. While being simple, such a static policy has many disadvantages and may not provide necessary protection to mobile and wired perimeter. They are (a) unable to react to changes in its external environment, (b) they have physical limitations and differences in trust relationships, and (c) completeness among a non- communicating set of policies is problematic. Therefore, in order to provide perimeter protection policies that react to dynamic changes (quite frequent in mobile perimeter) and respect organizational objectives such as preferential treatment, yet enforce overall security objectives of organizations, requires that individual policies enforced at each border gateway be (a) dynamic and flexible, and (b) be a part of a global policy such that taken together enforce common security objectives in mobile infrastructure. In this proposal we achieve this by a logic-based security framework. Our solution has the potential to improve the security while reducing the management costs.