将策略映射到网络设备的数学基础（技术报告）
The Mathematical Foundations for Mapping Policies to Network Devices (Technical Report)
摘要：
策略规约语言中的一个常见需求是能够将策略映射到底层网络设备。在安全策略上下文中，以可证明正确的方式这样做非常重要，这样管理员就可以确信策略为其网络提供的保护级别。现有的策略语言允许策略组合，但缺乏将策略分配给网络设备的正式语义。我们的研究从第一原则解决这个问题：我们问网络策略如何可以在高层次上描述，独立于防火墙供应商和网络细节。我们确定的代数要求的政策映射过程中，并提出语义的基础，正式验证，如果一个政策是由正确的一组政策仲裁。我们展示了我们所提出的代数在保持简洁的网络设备配置中的价值，并将其应用于现实世界的网络。
英文摘要：
A common requirement in policy specification languages is the ability to map policies to the underlying network devices. Doing so, in a provably correct way, is important in a security policy context, so administrators can be confident of the level of protection provided by the policies for their networks. Existing policy languages allow policy composition but lack formal semantics to allocate policy to network devices. Our research tackles this from first principles: we ask how network policies can be described at a high-level, independent of firewall-vendor and network minutiae. We identify the algebraic requirements of the policy mapping process and propose semantic foundations to formally verify if a policy is implemented by the correct set of policy-arbiters. We show the value of our proposed algebras in maintaining concise network-device configurations by applying them to real-world networks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
