SecPAL

SecPAL is a declarative, logic-based, security policy language that has been developed to support the complex access control requirements of large scale distributed computing environments.[1][2][3][4]

Common access control requirements

Here is a partial-list of some of the challenges that SecPAL addresses:

  • How does an organization establish a fine-grained trust relationship with another organization across organizational boundaries?
  • How does a user delegate a subset of a user’s rights (constrained delegation) to another user residing either in the same organization or in a different organization?
  • How can access control policy be authored and reviewed in a manner that is human readable - allowing auditors and non-technical people to understand such policies?
  • How does an organization support compliance regulations requiring that a system be able to demonstrate exactly why it was that a user was granted access to a resource?
  • How can policies be authored, composed and evaluated in a manner that is efficient, deterministic and tractable?

Architecture

The SecPAL Research homepage includes links to the following papers which describe the architecture of SecPAL at varying levels of abstraction.[5]

  • SecPAL Formal Model ("Design and Semantics of a Decentralized Authorization Language") – Formal description of the abstract types, language semantics and evaluation rules that support deterministic evaluation in efficient time.
  • SecPAL Schema Specification – Specification describing a practical XML based implementation of the formal model targeted at supporting access control requirements of distributed applications
  • .NET Research Implementation of SecPAL – C# implementation, C# samples for common authz patterns, and comprehensive developer documentation and a getting started tutorial

Additional research
  • IEEE Grid 2007 - Fine Grained Access Control Using SecPAL[6]
  • SecPAL for Privacy[7][8]

References
  1. "Archived copy". research.microsoft.com. Archived from the original on 28 April 2016. Retrieved 12 January 2022.{{cite web}}: CS1 maint: archived copy as title (link)
  2. "Microsoft Building Security Language for Grids". 13 September 2006.
  3. https://linuxinsider.com/story/microsoft-invites-collaboration-with-grid-computing-research-57147.html
  4. "Access Control in Grid Computing Environments". 7 May 2007.
  5. "Microsoft – Cloud, Computers, Apps & Gaming". Archived from the original on 2009-11-06.
  6. http://www.cs.virginia.edu/~humphrey/papers/GridFTP_SecPAL_2007.pdf
  7. https://www.sec.in.tum.de/~malkis/BeckerMalkisBussard-APracticalGenericPrivacyLanguage.pdf
  8. https://www.sec.in.tum.de/~malkis/BeckerMalkisBussard-S4P-AGenericLanguageForSpecifyingPrivacyPreferencesAndPolicies.pdf
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.