Compliance Checking and IPSEC Policy Management

Document Type Expired Internet-Draft (individual)
Authors John Ioannidis  , Angelos Keromytis  , Matt Blaze 
Last updated 2000-03-15
Stream (None)
Intended RFC status (None)
Expired & archived
pdf htmlized bibtex
Stream Stream state (No stream defined)
Consensus Boilerplate Unknown
RFC Editor Note (None)
IESG IESG state Expired
Telechat date
Responsible AD (None)
Send notices to (None)

This Internet-Draft is no longer active. A copy of the expired Internet-Draft can be found at


This draft describes an architecture for security policy management for IPSEC based on the principle of ``compliance checking.'' We describe a two-level policy hierarchy, in which security association policy is managed by a highly flexible policy language, which in turn provides input to packet policies that are managed by a fast packet filtering language. We provide a sample SA policy language, based on KeyNote, and describe interoperability issues for this architecture.


John Ioannidis (
Angelos Keromytis (
Matt Blaze (

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)