Context-based access control

Context-based access control (CBAC) intelligently filters TCP and UDP packets based on application layer protocol session information and can be used for intranets, extranets and internets. CBAC can be configured to permit specified TCP and UDP traffic through a firewall only when the connection is initiated from within the network needing protection. (In other words, CBAC can inspect traffic for sessions that originate from the external network.) However, while this example discusses inspecting traffic for sessions that originate from the external network, CBAC can inspect traffic for sessions that originate from either side of the firewall. This is the basic function of a stateful inspection firewall.

Without CBAC, traffic filtering is limited to access list implementations that examine packets at the network layer, or at most, the transport layer. However, CBAC examines not only network layer and transport layer information but also examines the application-layer protocol information (such as FTP connection information) to learn about the state of the TCP or UDP session. This allows support of protocols that involve multiple channels created as a result of negotiations in the FTP control channel. Most of the multimedia protocols as well as some other protocols (such as FTP, RPC, and SQL*Net) involve multiple control channels.

CBAC inspects traffic that travels through the firewall to discover and manage state information for TCP and UDP sessions. This state information is used to create temporary openings in the firewall's access lists to allow return traffic and additional data connections for permissible sessions (sessions that originated from within the protected internal network).

CBAC does the deep packet inspection and hence it is termed to be a IOS Firewall.

CBAC also provides the following benefits:

• Denial-of-Service prevention and detection
• Real-time alerts and audit trails

See also

• Role hierarchy
• Role-Based Access Control
• Cisco Secure Integrated Software

This computer networking article is a stub. You can help Wikipedia by expanding it.v · Categories: Computer access control Computer network security Firewall software Packets (information technology) Data security Computer network stubs Wikimedia Foundation. 2010. Игры ⚽ Нужно сделать НИР? Softpress Randy Jackson (baseball) Look at other dictionaries: Context Based Access Control — Als Context Based Access Control (CBAC) bezeichnet man in der Netzwerktechnik einen intelligenten Filter für TCP und UDP Pakete zur Zugriffssteuerung und kontrolle auf Dateien oder Dienste, der verbindungsspezifische Protokoll Informationen… …   Deutsch Wikipedia Context based access control — Als Context Based Access Control (CBAC) bezeichnet man in der Netzwerktechnik einen intelligenten Filter für TCP und UDP Pakete zur Zugriffssteuerung und kontrolle auf Dateien oder Dienste, der verbindungsspezifische Protokoll Informationen… …   Deutsch Wikipedia Context-Based Access Control — Als Context Based Access Control (CBAC) bezeichnet man in der Netzwerktechnik einen intelligenten Filter für TCP und UDP Pakete zur Zugriffssteuerung und kontrolle auf Dateien oder Dienste, der verbindungsspezifische Protokoll Informationen… …   Deutsch Wikipedia Role-based access control — In computer systems security, role based access control (RBAC) [cite conference author = Ferraiolo, D.F. and Kuhn, D.R. title = Role Based Access Control booktitle=15th National Computer Security Conference year = 1992 month = October pages=554… …   Wikipedia Organisation-based access control — In computer security, organization based access control (OrBAC) is an access control model first presented in 2003. The current approaches of the access control rest on the three entities (subject, action, object) to control the access the policy …   Wikipedia Access control list — In computer security, an access control list (ACL) is a list of permissions attached to an object. The list specifies who or what is allowed to access the object and what operations are allowed to be performed on the object. In a typical ACL,… …   Wikipedia Mandatory access control — In computer security, mandatory access control (MAC) refers to a type of access control by which the operating system constrains the ability of a subject or initiator to access or generally perform some sort of operation on an object or target.… …   Wikipedia Context aware delegation — Use of contextual information (location, time) of a delegatee to mitigate this violation, which helps to achieve a higher level of practical security in nomadic environments used by nomadic user . Delegation in access control domain is not… …   Wikipedia Context-dependent memory — refers to improved recall of specific episodes or information when the context present at encoding and retrieval are the same. One particularly common example of context dependence at work occurs when an individual has lost an item (e.g. lost car …   Wikipedia ConTeXt — Not to be confused with ConTEXT. ConTeXt Original author(s) Mainly Hans Hagen and Pragma ADE …   Wikipedia 18+ © Academic, 2000-2024 Contact us: Technical Support, Advertising Dictionaries export, created on PHP, Joomla, Drupal, WordPress, MODx. Mark and share Search through all dictionaries Translate… Search Internet Share the article and excerpts Direct link … Do a right-click on the link above and select “Copy Link”