Namespace-Based Policy Decision Points for Expressive Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing policy decision points (PDPs) face a tradeoff between being purpose-built, which are expressive but limited to specific use cases, and general-purpose, which lack expressiveness and fail to capture arbitrary third-party policy restrictions and logic, making them harder to audit and extend.
Innovation Solution
The introduction of namespaces with extensible Attribute Based Access Control (ABAC) grammar and PDP systems provides hierarchical policy domains with a dedicated vocabulary, bridging the gap between general-purpose and purpose-built PDPs, allowing for third-party configuration and addressing arbitrary policy use cases by generating domain-specific policies based on request attributes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If purpose-built policy decision points are used, then policy expressiveness and auditability are improved, but adaptability to arbitrary use cases deteriorates
Solution Approach 1:
The patent segments the policy decision point into multiple independent namespaces, each handling specific policy domains (e.g., networking, security, applications). This allows each namespace to maintain domain-specific expressiveness while the collection of namespaces provides broad adaptability to arbitrary use cases through modular composition.
Solution Approach 2:
The patent implements dynamic namespace selection based on request attributes, allowing the system to adaptively choose the appropriate namespace for each policy evaluation. This dynamic behavior enables the system to maintain high expressiveness for known domains while flexibly accommodating arbitrary new use cases without requiring a complete redesign of the policy framework.
2Adaptability or versatility
If general-purpose policy decision points are used, then adaptability to various use cases is improved, but policy expressiveness and auditability deteriorate
Solution Approach 1:
Instead of using a single general-purpose policy decision point, the patent segments functionality into multiple specialized namespaces. Each namespace maintains domain-specific policy grammar and vocabulary, preserving expressiveness and auditability for that domain while the overall system remains adaptable through the combination of namespaces.
Solution Approach 2:
The patent creates a universal policy framework where multiple specialized namespaces can coexist and be selected based on the request type. This multi-functional approach allows the system to handle diverse use cases adaptively while each individual namespace maintains high policy expressiveness for its specific domain.
3Reliability
If purpose-built policy decision points are used, then policy auditability is improved, but system complexity increases due to tight coupling with policy enforcement points
Solution Approach 1:
The patent segments the policy system into independent namespaces that are loosely coupled with policy enforcement points. Each namespace can be audited independently for its domain, maintaining auditability while reducing overall system complexity through modular architecture and reduced coupling.
Data Source
AI summary
Systems and methods described herein provide for building policies using namespaces. A device may receive a request to access a resource in a computing environment. The request may include one or more attributes. The device may identify a set of namespaces having domain-specific policy grammar to generate domain-specific policies. The device may determine a namespace from the identified set of namespaces which corresponds to the one or more attributes of the request. The device may generate, using domain-specific policy grammar of the determined namespace, a domain-specific policy to apply to the request.