This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthor

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note

Page References

Incoming links Outgoing links
Policy Based Management System
Policy Based Management System

Version management

Difference between version and

At line 1 added 59 lines
!!! Overview
[{$pagename}] is a [Framework] in which an [Access Request] received by a [Policy Enforcement Point] ([PEP]) is presented to a [Policy Decision Point] which retrieves the [Authorization] [Policy] [data] from a [Policy Retrieval Point] along with [data] on the [Entity] requesting access and [data] on the [Target Resource] from [Policy Information Point](s) and renders a decision to the [Policy Decision Point].
Generally, any of the [AAA] [Servers] (or [Access Control Engines]) transactions may retrieve a [policy] or evaluate a [Access Control Policy], and any of the Service Equipment may enforce a policy. [Policy Retrieval Points] ([Policy] Repositories) may reside on any of the [Access Control Engines] or be located elsewhere in the network.
[Data] against which [Access Control Policy] conditions are evaluated (such as [resource] status, [session] [state], or time of day) are accessible at [Policy Information Points] ([PIPs]) and might be accessed using [Policy Information Blocks] ([PIB]s).
A [{$pagename}] consists of four main functional Non_normative elements: (following [RFC 2904], except for [PAP]) [2]
%%zebra-table
%%sortable
%%table-filter
||ABBR||Term||Description
|[PAP]|[Policy Administration Point]|Point which manages [access] [authorization] policies
|[PDP]|[Policy Decision Point]|Point which evaluates access requests against authorization policies before issuing access decisions
|[PEP]|[Policy Enforcement Point]|Point which intercepts user's access request to a resource, makes a decision request to the [PDP] to obtain the access decision (i.e. access to the resource is approved or rejected), and acts on the received decision
|[PIP]|[Policy Information Point]|The system entity that acts as a source of [attribute] values (i.e. a [resource], subject, environment)
|[PRP]|[Policy Retrieval Point]|Point where the [XACML] access [authorization] policies are stored, typically a database or the filesystem. (Not in DIagram below)
/%
/%
/%
[Policy Based Management System/XACML_Architecture_&_Flow.png]
[Policy] sets, rules and [requests] all use [subjects], [resources], [environments], and [Resource Action].
* A [subject] ([Alice]) element is the [entity] requesting access. A subject has one or more [attributes].
* The [resource] element is a [data], [service] or system component. A [resource] has one or more [attributes].
* An [Resource Action] element defines the type of [access] requested on the [resource]. Actions have one or more [attributes].
* An [environment] (or [Context]) element can optionally provide additional [attributes].
The Resulting [policies|Policy] are stored in a [Policy Retrieval Point]
When new policies have been added in the [Policy Retrieval Point], or existing ones have been changed, the [Policy Administration Point] [MUST] update the relevant [Policy Retrieval Points]
When an [actionable event|Actionable Intelligence] is encountered at the [Policy Enforcement Point] contacts the [Policy Decision Point] which interprets the [policies|Policy] from the [Policy Retrieval Points] and the [Policy Information Point] and then communicates the appropriate decision to be exercised by the [Policy Enforcement Point]
The most well known policy-based management architecture was specified jointly by the [IETF] and the [DMTF]. This consists of four main functional elements:[1]
* the Policy Management Tool (PMT) which we refer to as the [Policy Administration Point] ([PAP])
* Policy Repository which we refer to as the [Policy Information Point] ([PIP])
* [Policy Decision Point] ([PDP])
* [Policy Enforcement Point] ([PEP]).
The preferred choice for communicating policy decisions between a [PDP] and network devices ([PEP]s) is the [Common Open Policy Service] ([COPS]) or [SNMP], and [LDAP] for the [PAP]/[PDP]–[PIP] communication.
!! [{$pagename}] [Examples]
Many modern [Organizational Entity]s have implementaitons:
* [Google Cloud Platform] - [BeyondCorp]
* [Netflix] - (uses [PADME] and [Open Policy Agent]) [Netflix OSS Meetup Season 5 Episode 1 - Security|https://youtu.be/dim85J5cLq4|target='_blank']
* [Secure Production Identity Framework For Everyone] ([SPIFFE])
* [Policy Access Decision Management Engine]
* [Open Policy Agent]
* [Istio]
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
----
* [#1] - [Policy-based management|Wikipedia:Policy-based_management|target='_blank'] - based on information obtained 2015-10-10
* [#2] - [XACML|Wikipedia:XACML|target='_blank'] - based on information obtained 2017-10-04
This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthorTop