SPCL: Structured Policy Command Language

1
SPCL Structured Policy Command Language

• M. LocastoM. BurnsideC. LiA. Wahl

2
Motivation Contributions

• Create a policy language that makes policy
  specification easy natural
• Separate policy specification from policy
  enforcement

3
Language Overview

• Main elements zone, policy, object, principal,
  group, action
• basic rule
• allow deny action on object by principal
• optional clauses
• - when
• - side-effects rule update
• Precedence principal, group, default

4
(No Transcript)
5
(No Transcript)
6
Test Plan

• Language AND platform
• must test correctness of each component
• SPCL -gt Intermediate format
• Intermediate format -gt Policy decisions

7
Test Plan (cont.)

• Hierarchical
• each stage
• Compiler and PE individually
• Compiler and PE together

8
Test Suite

• Makefile-based test suite
• zone Empty
• policy Allow
• default
• allow

• Zone housepolicy MyPolicy default
  deny object tv string
  channel actions
  action watch watch
  principal Matt allow watch on tv
  when ( tv.channel ! MTV )

9
Test Suite (cont.)

• import spcl.data.
• import java.util.
• import java.io.
• public class EmptyAllowInstaller extends
  PolicyInstaller
• public EmptyAllowInstaller( )
• public void doInstall() throws PolicyException
• if (nullpolicyLoader)
• throw new PolicyException("No policy loader
  defined.",
• PolicyException.NULL_LOADER)
• final Zone zone new Zone( "Empty" )
• final Policy policy new Policy( "Empty.Allow"
  )
• final Principal default_p new Principal(
  "default_p" )
• policy.setDefaultPrincipal( default_p )

10
Runtime Environment

• PolicyEngine
• assume some network architecture objects defer
  to PolicyEngine for decisions
• primitive types
• Implementation
• Java sockets, own ClassLoader, command-line
  client application

11
Model of Computation

• computation is Prolog-like
• search rule base
• unification resolution
• order of precedence
• side effects (unique interesting)
• Sample Query
• can principal do action-regex with
  condition-bindings

12
Conclusion

• SPCL separates policy specification from policy
  enforcement
• SPCL provides a natural form for policy
  expression
• Project was a great learning experience for
  everyone, we were able to work very well
  together.
• Take questions