Integrated Management of Distributed Packet Filter Configurations in Carrier-Grade IP Networks

With the trend towards "triple play" and "next generation network" technologies running on IP-based multiservice networks, operators have to maintain increasingly complex IP management architectures which need tight protection as their in-band signaling and control protocols are inherently susceptible to attacks from outsiders. Operators therefore need an efficient management of local security functions distributed among network components that enforce a coherent global network security policy. In this paper, a flexible and scalable approach for the management of distributed packet filters in IP-based multi-vendor networks is presented that allows the operator to incorporate filter capability restrictions within nodes and the trade-off between operational risk and attack risk into their management decisions.