An Authorization Framework Resilient to Policy Evaluation Failures

Free registration required

Executive Summary

In distributed computer systems, it is possible that the evaluation of an authorization policy may suffer unexpected failures, perhaps because a sub-policy cannot be evaluated or a sub-policy cannot be retrieved from some remote repository. Ideally, policy evaluation should be resilient to such failures and, at the very least, fail "Gracefully" if no decision can be computed. The authors define syntax and semantics for an XACML-like policy language. The semantics are incremental and reflect different assumptions about the manner in which failures can occur. Unlike XACML, their language uses simple binary operators to combine sub-policy decisions.

  • Format: PDF
  • Size: 366 KB