OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

xacml message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: Minutes of July 21 2005 XACML TC Meeting - UPDATED


Tim Moses 
Bill Parducci (minutes) 
Tony Nadalin 
Hal Lockhart 
Erik Rissanen 
David Staggs 
Ron Williams 
Anne Anderson
Daniel Engovatov
Mr Seth Proctor
Argyn Kuketayev

Quorum reached (80% per Kavi) 
 
Agenda: 
 
I.   Minutes from July 7 meeting voted upon: 
     Approved unanimously 
     No objections 
 
II.  Delegation (Issuer) 
     Naming of Subject of administrative Policy. Tim suggests Issuer is 
     the appropriate name. Ron offered that Delegate is more accurate 
     (on list). Tim countered that Delegate would include access Subject 
     and this is more general in its 'ordinary' use. Others asked to 
     weigh in. 
 
     Hal noted that the term "Pending Policy" is an interesting term to 
     describe a Policy that has not been fully evaluated in the decision 
     chain (temporal description). 
 
     Ron raised concern about increasing complexity in model via the 
     introduction of increased semantics and that this will ultimately 
     reduce flexibility in the model. 
 
     Hal also noted that the term "Administrative Policy" is also 
     appears to effective semantic in the delegation model. Both Tim and 
     Erik are currently using this term. 
 
III. Hypothetical Queries 
     HQ: Given a Subject to what Targets is access authorized? 
     HQ: Given a Target what Subjects are authorized to access? 
 
     Hal asked how this would be addressed by XACML? Could this be 
     handled via partial evaluation (non-enumerated). Ron stated that he 
     is not addressing computational efficiency, but that a general case 
     should allow such questions to be allowable despite some 
     systems' inability to address the problem realistically. 
 
     Daniel suggested that this issue can be addressed attribute 
     manipulation.  Bill stated that it may be possible to answer 
     first HQ above, but not second because current implementation is 
     limited to Permit|Deny response. Daniel's position is that "who" is 
     not defined within the system, Subjects are just a collection of 
     attributes. Ron offered that an audit process may wish to access 
     for listing of all Subjects that can access a particular Target. 
     Hal suggested that there are two ways to address this: partial 
     evaluation (query attribute limitation); limited scope of request 
     (PDP constraint). 
 
     David offered that XML processing would be inefficient for 
     addressing this type of processing. Hal suggested that 
     optimization strategies include non internal XML representation and 
     localized PDP/PEP processing. 
 
     Anne offered that there are academic references on the TC website 
     that may provide insight on the subject: 

     Change management: Verification and change-impact analysis of 
     access-control policies, Kathi Fisler, Shriram Krishnamurthi, Leo A. 
     Meyerovich, Michael Carl Tschantz; May 2005; Proceedings of the 27th 
     international conference on Software engineering. Available at 
     http://www.cs.brown.edu/~sk/Publications/Papers/Published/fkmt-verif-change-impact-xacml/.

     Policy verification and change impact analysis, by Kathi Fisler, Shriram 
     Krishnamurthi, Leo Meyerovich, Michael Carl Tschantz (Brown Univ), 
     Ottawa New Challenges for Access Control Workshop, 27 April, 2005. 
     Available at: http://lotos.site.uottawa.ca/ncac05/fisler_18500059.ppt.

     Bijan Parsia, Univ. MD College Park (I believe) is also doing some work 
     expressing existing policy languages using the semantic web, and then 
     using semantic web tools to query the policies with questions like 
     "which resources can subject X read?"  I believe he said at WWW 2005 
     Workshop on Policy Management for the Web that he was going to try to 
     tackle XACML.

     Note that, to the extent you can transform an XACML policy into 
     Disjunctive Normal Form (and OR of ANDs), you can then choose the sets 
     of ANDs that satisfy the constraint or constraints you are placing (for 
     example, "subject = X").  The remaining constraints in that AND set 
     capture exactly what else can be done given those constraints.
 
III. Work Items 
     No significant updates to Work Item list 
 
IV. General 
 
     Bill will post to the list when there is an update to the wiki 
     availability. 
 
     The Chair has asked for volunteers to consider hosting the next 
     F2F. The tentative date is some time in September. 
 
meeting adjourned. 
 
 
 
--------------------------------------------------------------------- 
To unsubscribe from this mail list, you must leave the OASIS TC that 
generates this mail.  You may a link to this group and all your TCs in OASIS 
at: 
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php 
 



[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]