Meta-policies for Distributed Role-based Access Control Andrs - PowerPoint PPT Presentation

Meta-policies for Distributed Role-based Access Control András Belokosztolszki, Ken Moody {ab374,km}@cl.cam.ac.uk University of Cambridge, Computer Laboratory, OPERA Policy 2002 1

Outline • Role-Based Access Control • OASIS • Meta-Policies – Meta-Policy Types – Compliance • Summary Policy 2002 2

Role-Based Access Control Authorization Activation Roles Privileges Sessions Activation Policy 2002 3

OASIS Rules (Open Architecture for Secure Interworking Services) Activation Rule MC MC MC Prerequisite Environmental Appointment Role Predicates Parameters Parameters Parameters Authorization Rule Policy 2002 4

Administrative Domains Users Admin Policy SLA SLA SLA Policy 2002 5

Problems • SLA maintenance – New domain, change to a domain, … • Policy evolution • Information hiding • Information about the policy • Local Autonomy Policy 2002 6

Meta-Policies • Data types • Objects (privileges) • Functions and Predicates • Roles (parameters) • Appointment Certificates (parameters) • Rules (membership conditions) • Explicit / Implicit • Negation • Constraints (SSoD, …) Policy 2002 7

Meta-Policy Types • Compliance • Interface – For a single domain – Communication with other Domains – Information for users Meta-Pol – Higher level policies – Policy evolution Exp Imp Policy 2002 8

Mappings • Meta-Policies are mapped to Policies – Data-types (one-to-one, one directional) – Functions / Environmental Predicates – Roles / Appointments – Rules – Other Constraints (SSOD, …) • Policy or subset of a policy is considered • Direction of Mappings • Parameters (and constants) Policy 2002 9

Compliance Check • Existence of the mappings • Prerequisite services? • Rules: 1. Translating into policy context 2. Checking explicit rules 3. Checking Implicit rules • Negation (entire policy is considered) 4. Other Constraints • Result: Certificate Policy 2002 10

SLA generation • For Interface Meta-Policies: • Automatic generation Meta-Policy Importing Exporting SLA Policy 2002 11

Implementation Desert: Mapping Editor SLA generator Policy 2002 12

Summary • Meta-Policies (Compliance/Interface) • Implementation (Desert) – Mapping editor – SLA generator Policy 2002 13

Acknowledgement • King’s College Cambridge Graduate Student Fund • Overseas Research Students Award Scheme Policy 2002 14