Composable Security Policies
Composable security policies enable multiple authorization policies to be combined into a composed effective authorization policy such that policy authoring rights may be arbitrarily and flexibly delegated. In an example implementation, making an authorization decision based on a composed effective policy is described. In another example implementation, the delegation of policy authoring rights using an assertion in accordance with a security language is described. In yet another example implementation, a security authorization system is described that includes a mechanism enabling an administrator to explicitly grant all or a part of policy authoring rights to another administrator.
1 . A method comprising:
receiving a resource request that is directed to a resource;
retrieving a trust policy that is authored by principal A, the trust policy associated with the resource;
retrieving a resource access policy that is authored by principal B, the resource authorization policy associated with the resource;
combining the trust policy and the resource access policy into a composed effective policy; and
making an authorization decision responsive to the resource request and based on the composed effective policy.
2 . The method as recited in claim 1 , further comprising:
retrieving a delegation policy that is authored by principal C, the delegation policy associated with the resource;
wherein the combining comprises:
combining the delegation policy into the composed effective policy.
3 . The method as recited in claim 1 , further comprising:
retrieving an audit policy that is authored by principal D, the audit policy associated with the resource;
wherein the combining comprises:
combining the audit policy into the composed effective policy.
4 . The method as recited in claim 1 , further comprising:
delegating, by an administrator, a right to author the trust policy to the principal A; and
delegating, by the administrator, a right to author the resource access policy to the principal B.
5 . The method as recited in claim 1 , further comprising:
delegating, by a first administrator, a right to author the trust policy to the principal A; and
delegating, by a second administrator, a right to author the resource access policy to the principal B.
6 . The method as recited in claim 1 , wherein the trust policy identifies a security token service (STS) that is empowered to assert that principals possesses one or more attributes; and wherein the resource access policy specifies at least one attribute that a principal must possess to access the resource.
7 . The method as recited in claim 1 , wherein the trust policy is authored by the principal A using a security language, and the resource access policy is also authored by the principal B using the security language; and wherein the combining is enabled by the security language.
8 . A method comprising:
delegating, by an entity to an administrator A, a portion PA of policy authoring rights with respect to a resource; and
delegating, by the entity to an administrator B, a portion PB of the policy authoring rights with respect to the resource;
wherein each delegating is effected using at least one assertion issued by the entity in accordance with a security language, the at least one assertion including a delegation-directive verb.
9 . The method as recited in claim 8 , further comprising:
issuing, by the administrator A, a first authorization policy that is directed to the portion PA of the policy authoring rights with respect to the resource; and
issuing, by the administrator B, a second authorization policy that is directed to the portion PB of the policy authoring rights with respect to the resource.
10 . The method as recited in claim 8 , wherein:
the portions PA and PB relate to different parts of the resource;
the portions PA and PB relate to different actions that may be taken with regard to the resource;
the portions PA and PB relate to different policy categories that may exist with regard to security polices about the resource; or
the portions PA and PB relate to different groups of principals that may access the resource.
11 . The method as recited in claim 8 , wherein the portion PA relates to actions that may be taken on the resource, and the portion PB relates to identifying types of principals that may access the resource.
12 . The method as recited in claim 8 , further comprising:
delegating, by the entity to an administrator C, a portion PC of the policy authoring rights with respect to the resource; and
wherein the three delegating actions enable the entity to separate duties with respect to the resource among the three different administrators A, B, and C.
13 . The method as recited in claim 8 , wherein the portion PA of the policy authoring rights comprises delegation rights with respect to the resource; and
wherein the method further comprises:
delegating, by the administrator A to a sub-administrator, a particular part of the portion PA of the policy authoring rights with respect to the resource.
14 . The method as recited in claim 13 , farther comprising:
issuing, by the sub-administrator, a policy directed to the particular part of the portion PA of the policy authoring rights with respect to the resource;
receiving a resource request that is directed to the resource;
combining policy assertions from the entity, the administrator A, and the sub-administrator into a composed effective policy; and
making an authorization decision responsive to the resource request and based on the composed effective policy.
15 . A security authorization system comprising policy authoring rights on at least one resource and a security language; wherein the security language includes a mechanism enabling an administrator to explicitly grant all or a part of the policy authoring rights to another administrator so as to allow the other administrator to make policy assertions about the at least one resource; and wherein the mechanism comprises a delegation-directive verb.
16 . The security authorization system as recited in claim 15 , wherein each policy assertion includes at least one variable representing a principal, at least one variable representing a resource, or at least one variable representing an action on a resource.
17 . The security authorization system as recited in claim 15 , further comprising an application programming interface (API) that accepts the policy assertions.
18 . The security authorization system as recited in claim 15 , wherein the mechanism comprises an assertion that comports with the following:
assertor says delegation-fact if fact 1 , fact 2 , . . . , fact n , constraints 1 . . . m , in which (i) fact 1 . . . n and constraints 1 . . . m are optional in each assertion and (ii) the “delegation fact” delegates at least one policy authoring right and comports with:
principal delegation-directive-verb delegated-fact.
19 . The security authorization system as recited in claim 15 , wherein each policy assertion is monotonic such that each assertion adds one or more rights.
20 . The security authorization system as recited in claim 15 , further comprising a policy composition mechanism that combines multiple authorization policies that are associated with a given resource into a composed effective authorization policy that may be used in an authorization decision regarding the given resource.