Firewall Configuration based on Specifications of Access Policy and Network Environment

A network firewall is a widespread means to enforce a security policy, however it remains a network device. Such a duality has caused a somewhat independent way of firewall development from other security management methods. Following the way firewall vendors are focused on performance problems while management issues don’t receive enough attention. Firewalls have grown to complicated computer systems, but there is no general highlevel programming language for them. This problem becomes more and more urgent due to the increasing complexity of modern security policies, which must be enforced by firewalls. In this paper we 1) propose the basic idea of firewall configuration based on specifications of an access policy and a network environment; 2) describe Organization Based Access Control (ORBAC) model, which is used to specify an access policy; 3) propose a model to specify a network environment, and 4) the method of integration of an access policy with a network environment.