A policy deployment model for the Ponder language

Abstract

Policies are rules that govern the choices in behaviour of a system. Security policies define what actions are permitted or not permitted, for what or for whom, and under what conditions. Management policies define what actions need to be carried out when specific events occur within a system or what resources must be allocated under specific conditions. There is considerable interest in the use of policies for the security and management of large-scale networks and distributed services. Existing policy work has focussed on specification, information models and application-specific policy enforcement. We address the important goal of providing a general-purpose deployment model for policies that is independent of the underlying policy enforcement mechanisms and can be employed in mixed policy environments. In this paper, we present a deployment model that is object-oriented and addresses the instantiation, distribution and enabling of policies as well as the disabling, unloading and deletion of policies. The model defines objects for policies, for domains, and for policy enforcement agent and outlines the interactions needed between them. The model also caters for changes in the memberships of domains since such changes also effect policy enforcement. The model forms part of the runtime support for Ponder; a new policy language that combines structuring ideas from object-oriented languages with a common set of policy basic types.

Semantic Web Languages for Policy Representation and Reasoning: A Comparison of KAoS, Rei, and Ponder

“…Ponder proposes a general-purpose deployment model [22]. At the end of the policy specification the policy is compiled by the Ponder compiler into a Java class and then represented at runtime by a Java object.…”

The University of Virginia Campus Grid: Integrating Grid Technologies with the Campus Information Infrastructure

“…Preconditions and obligation in policy [26] provide a compact means of representing what a user must do before performing a specific action as well as what they must do after an action. The Generic Authentication, Authorization, and Accounting (AAA) Architecture (RFC 2903 [27]) builds an architecture in terms of Generic AAA servers, policy and event repositories, and Application Specific Modules (ASMs).…”

Use of Logic to Describe Enhanced Communications Services

“…Ponder is being developed at Imperial College (London). Ponder provides a language for the specification of policies [DDLS01], a framework to deploy Ponder policies [DLSD01], and a toolkit to support the policy life-cycle in the context of the framework [Pon]. Ponder provides 3 types of policies:…”