Systems and methods for using namespaces to access computing resources
Systems and methods described herein provide for building policies using namespaces. A device may receive a request to access a resource in a computing environment. The request may include one or more attributes. The device may identify a set of namespaces having domain-specific policy grammar to generate domain-specific policies. The device may determine a namespace from the identified set of namespaces which corresponds to the one or more attributes of the request. The device may generate, using domain-specific policy grammar of the determined namespace, a domain-specific policy to apply to the request.
1. A method comprising:
receiving, by at least one computing device, a request to access a resource in a computing environment, the request including one or more attributes;
identifying, by the at least one computing device, a set of namespaces having domain-specific policy grammar to generate domain-specific policies;
determining, by the at least one computing device, a namespace from the identified set of namespaces that corresponds to the one or more attributes of the request; and
generating, using domain-specific policy grammar of the determined namespace, a domain-specific policy to apply to the request.
2. The method of claim 1 , wherein the determined namespace includes at least one nested namespace having a subset of the domain-specific policy grammar from the selected namespace.
3. The method of claim 2 , further comprising:
selecting, according to the one or more attributes of the request, a nested namespace from the at least one nested namespace; and
generating, using domain-specific policy grammar of the nested namespace, the domain-specific policy to apply to the request.
4. The method of claim 3 , wherein the domain specific grammar of the determined namespace is applicable to a plurality of resources, and wherein the subset of domain-specific grammar is applicable to a subset of the plurality of resources including the resource associated with the request.
5. The method of claim 1 , further comprising:
applying the generated domain-specific policy to the request to identify an effect of the domain-specific policy for the resource, to permit or deny access to the resource; and
permitting or denying access to the resource according to the effect.
6. The method of claim 1 , comprising selecting the namespace with one or more target attributes that match to the one or more attributes of the request.
7. The method of claim 1 , wherein the one or more target attributes comprise at least one of: a subject, an action, an object or an environment.
8. The method of claim 1 , wherein the set of namespaces includes at least one of a database namespace, a networking product namespace, a file access namespace, a content filtering namespace, antivirus namespace, a uniform resource locator (URL) browsing namespace or an applications namespace.
9. The method of claim 1 , wherein the domain-specific policy grammar from the selected namespace includes a plurality of categories of policy grammar.
10. The method of claim 1 , further comprising:
receiving a user-defined namespace for incorporation into the set of namespaces; and
incorporating the user-defined namespace into the set of namespaces.
11. A device comprising:
at least one processor configured to:
receive a request to access a resource in a computing environment, the request including one or more attributes;
identify a set of namespaces having domain-specific policy grammar to generate domain-specific policies;
determine a namespace from the identified set of namespaces which corresponds to the one or more attributes of the request; and
generate, using domain-specific policy grammar of the determined namespace, a domain-specific policy to apply to the request.
12. The device of claim 11 , wherein the determined namespace includes at least one nested namespace having a subset of the domain-specific policy grammar from the selected namespace.
13. The device of claim 12 , wherein the at least one processor is further configured to:
select, according to the one or more attributes of the request, a nested namespace from the at least one nested namespace; and
generate, using domain-specific policy grammar of the nested namespace, the domain-specific policy to apply to the request.
14. The device of claim 13 , wherein the domain specific grammar of the determined namespace is applicable to a plurality of resources, and wherein the subset of domain-specific grammar is applicable to a subset of the plurality of resources including the resource associated with the request.
15. The device of claim 11 , wherein the at least one processor is further configured to:
apply the generated domain-specific policy to the request to identify an effect of the domain-specific policy for the resource, to permit or deny access to the resource; and
permit or deny access to the resource according to the effect.
16. The device of claim 11 , wherein the at least one processor is further configured to select the namespace with one or more target attributes that match to the one or more attributes of the request.
17. The device of claim 11 , wherein the domain-specific policy grammar from the selected namespace includes a plurality of categories of policy grammar.
18. The device of claim 11 , wherein the at least one processor is further configured to:
receive a user-defined namespace for incorporation into the set of namespaces; and
incorporate the user-defined namespace into the set of namespaces.
19. A non-transitory computer readable medium storing program instructions for causing one or more processors to:
receive a request to access a resource in a computing environment, the request including one or more attributes;
identify a set of namespaces having domain-specific policy grammar to generate domain-specific policies;
determine a namespace from the identified set of namespaces which corresponds to the one or more attributes of the request; and
generate, using domain-specific policy grammar of the determined namespace, a domain-specific policy to apply to the request.
20. The non-transitory computer readable medium of claim 19 , wherein the determined namespace includes at least one nested namespace having a subset of the domain-specific policy grammar from the selected namespace.