restrictingkeyusewithxacmlforaccesscontrol-資料下載頁(yè)
2024-10-24 17:15本頁(yè)面
【導(dǎo)讀】1. foraccesscontrol. *Zack’-a-mul. 2. Introduction. Enableaudit. 3. 4. akeyfromtheEKM. information,butnobodyelse’s”。encryptingdevice.5. 103pgs.“dept”[obtainedfrom]=“HRbackup”。6. Commonterms. policies:<Policy>and<PolicySet>.A<Policy>containsactual. 7. PEP. context. handler. 4.request. notification. PIP. 6.attribute. query. 11.response. context. 1.policy. 8.attribute. environment. resource. subjects. 7b.environment. attributes. PAP. obligations. service. 13.obligations. PDP. access. requester. 2.accessrequest. 9.resource. content. 7c.resource. attributes. 7a.subject. attributes. 5.attribute. queries. 10.attributes. 8. Factorsinrules. Must
【正文】 mend “Denybiased” PEP approach ? If the decision is Permit, then the PEP SHALL permit access. If obligations acpany the decision, then the PEP SHALL permit access only if it understands and it can and will discharge those obligations. ? All other decisions SHALL result in the denial of access. ? Note: other actions, . consultation of additional PDPs, reformulation/resubmission of the decision request, etc., are not prohibited.. ? PEP might be a consuming application or the EKM client 10 Implementation issues ? Five open source implementations available ? – Two announced in the last month ? Numerous Product Statements ? We may want to define a subset more easily implemented without full blown PDP ? Federated Policy Administration may be overkill ? – Multiple policies applicable to same situation ? – Combining rules to resolve conflicts ? Evaluating plex rules against raw XML is slow ? Many optimization opportunities ? – Policy encoding ? – Request context ? – Partial evaluation ? – Decision Cachin
教學(xué)課件相關(guān)推薦
鄂ICP備17016276號(hào)-1