% Taxonomy of Conflicts in network security policies

A \textit{security policy enforcement point} is a network element that controls the packet flows across network segments based on a given \textit{network security policy}~\cite{Taxonomy}.
These could be both host's element or middle-boxes as firewalls, VPN gateway or IPSec devices.

The Security Policy determinates the level of the packets protection on the network, each packet is usually identified by header fields of Level 3 and 4 of the ISO/OSI protocol stack, the so called \textit{5-tuple}. it is made up of source and destination IP addresses, IP protocol (usually TCP and UDP) and at the end source and destination ports.
The actual policy rule that matches the packets headers, decides the action to be performed on the packet.

There are two modes for the composition of a Network Security Policy for filtering packets.
\begin{itemize}
	\item 
	Access list, it is a ordered list of rules that are sequentially slided until a match is found with the current packet. The order is important and it leads to behave that a specific flow triggers the same rule. The matching rule determines what security action must be performed between:
	\begin{itemize}
		\item
		bypass: that means the packet is allowed to be forwarded and it is transmitted as it is;
		\item 
		discard: this action drops the packet;
		\item 
		protect: this last option is actuated by IPSec devices and the task is securely transmit the packet on the network.
	\end{itemize}
	\item 
	Map list, it is a set of rules that determinates how the packets selected from the access list, must be protected. Each rule in the set has a priority and the mapping is based on the high priority, this leads to applying the security transformation on the traffic.
\end{itemize}

Firewalls performs filtering actions on packets as \textit{bypass} which allows the traffic to enter or to leave the security network, or as \textit{discard} that blocks the traffic and drops all the packet related to that flow.

IPSec~\cite{IPSec} is a Security Protocol (Figure \ref{fig:IPSec Protocol}) used to provide a secure method to transmit packets on the open Internet.
It could be implemented in two different sub protocols that could be combined, based on what kind of protection we want to reach:
\begin{itemize}
	\item 
	Authentication Header (AH), this protocol provides data origin authentication, integrity for connectionless traffic and, as an option, protection on reply attacks;
	\item
	Encapsulation Security Payload (ESP), this other implementation provides all the CIA paradigms, Confidentiality using cryptography, Integrity and Authentication of data origin. It also has the same option of AH protocol on anti replay function.

\end{itemize}

\begin{figure}[H]
	\includegraphics[width=0.7\textwidth]
	{IPSec-01.png}
	\caption{IPSec Protocol.
		\label{fig:IPSec Protocol}}
\end{figure}

The Security Policy relies on what and where the traffic has to be protected, at the edge or at an intermediate point and, for both of them, IPSec offers two \textit{operation modes} (Figure \ref{fig:IPSec modes}).\newline
The former is \textit{Transport Mode} where the security protocol operates on source of the traffic and also on the destination entity, this allows to protect the end-to-end communication. This mode is going to work for ISO/OSI Layer upper then 3-level, so IP header is not changed.\newline
If we want to ensure a network-based or domain-based security, we need to adopt \textit{Tunnel Mode} that is performed on intermediate devices called Security Gateways. Unlike the previous mode, this one changes all the headers, because the protection is applied on the entire packet, so the output is to have a new packet with IP source and destination address changed.

\hfill
\begin{figure}[H]
	{\includegraphics[width=0.75\textwidth]
		{IPSec-02.png}}
	\caption{IPSec protocol: Transport and Tunnel Mode~\cite{IPSec-img-02}.
		\label{fig:IPSec modes}}
\end{figure}
