Reference no: EM132508240
Requirements
The basic requirements of a policy language for expressing information system security policy are:
• To provide a method for combining individual rules and policies into a single policy set that applies to a particular decision request.
• To provide a method for flexible definition of the procedure by which rules and policies are combined.
• To provide a method for dealing with multiple subjects acting in different capacities.
• To provide a method for basing an authorization decision on attributes of the subject and resource.
• To provide a method for dealing with multi-valued attributes.
• To provide a method for basing an authorization decision on the contents of an information resource.
• To provide a set of logical and mathematical operators on attributes of the subject, resource and environment.
• To provide a method for handling a distributed set of policy components, while abstracting the method for locating, retrieving and authenticating the policy components.
• To provide a method for rapidly identifying the policy that applies to a given action, based upon the values of attributes of the subjects, resource and action.
• To provide an abstraction-layer that insulates the policy-writer from the details of the application environment.
• To provide a method for specifying a set of actions that must be performed in conjunction with policy enforcement.
The motivation behind XACML is to express these well-established ideas in the field of access- control policy using an extension language of XML. The XACML solutions for each of these requirements are discussed in the following sections.
Attachment:- Access control core.rar