GRIDipedia – The European Grid Marketplace

Policy Based Access Control

When a user tries to access a resource on the grid access must be granted by a policy-based access control system, this allows flexible access to resources. A policy-based management system allows administrators to define rules based on questions such as "Is this user allowed access to this device?" or "Are users of this organization allowed access to this device?" and then manage them in the policy system. Policy information must be independent from components to permit policies to change and to allow the reuse of components with different policies. Policies can also be modified to suit changes in the structure of organizations or changes in the security situation, e.g. more stringent controls could be put into effect on the fly.

In the Policy Based Management the functionalities of access control are split in two entities named Policy Enforcement Point (PEP) and Policy Decision Point (PDP).

Summarizing PEP function is to mediate the access requests submitted by the users, it enforces the access decisions established by the PDP basing on the user requests and according to the access control policies. The PDP and PEP components could reside within the same process, but there are benefits to be derived from their separation:

A PDP packaged as a network service, called a policy server, allows multiple different applications, with embedded PEPs, to share the same policies. Developers are no longer needed to design and implement their own access control language and processor; they only need to implement PEP. Within an internet or extranet environment the benefits to an enterprise are that the fine grained expressiveness of the language and the lower cost of making changes allows the business managers to be flexible about opening up information and services to their customers, and partners always maintaining an elevated level of protection.

The figure above shows the flow of the access control model for Policy Based Management:

The client sends an access request to the PEP for accessing a certain service. The request’s signature needs to be examined and verified. An authentication domain may require that any request it processes be authenticated by a trust authority, and any request from a distrusted authority will be discarded, even if it could be completely processed by the system.

PEP recovers the needed resource attribute values according with the received access request.

PEP delegates to the PDP to enforce the decision. The enforcement of an authorization decision often requires information from the request context, so the PDP may bundle the authorization decision together with all the attribute values supplied by the PEP.

PDP must insert actual attribute values into the decision query, so it needs to ask the Attribute Source to obtain appropriate attribute values from the credentials owned by the user, and it may require interaction with several distinct Attribute Sources.

The PDP queries the Policies Administrator in order to obtain one or more policy or policyset instances. The final evaluation query includes the values of subject attribute, resource attribute, action attribute and other parameters.

PDP evaluates the policies, and generates a response context to send to the PEP.

According with the decision statement received, PEP decides if the access request for the service is permitted or denied.

© 2007 BEinGRID