Access control policy optimization

1 . A computer-implemented method comprising:

optimizing, at an access control policy administration point in a cloud provider network, a base access control policy to yield a residual access control policy;

compiling, by a verified access control policy compiler in the cloud provider network, the residual access control policy by:

parsing the residual access control policy;

transforming the residual access control policy to a target access control policy; and

generating executable code based on the target access control policy to yield a compiled residual access control policy;

indexing, at an access control policy information point in the cloud provider network, the compiled residual access control policy;

receiving, at an access control policy enforcement point (PEP) in the cloud provider network, an access request;

retrieving, by an access control policy decision point (PDP) in the cloud provider network, the compiled residual access control policy from an index based on one or more attributes of the access request;

evaluating, at the access control PDP in the cloud provider network, the access request against the compiled residual access control policy to determine an authorization decision; and

returning, by the access control PDP in the cloud provider network, the authorization decision to the access control PEP.

2 . The computer-implemented method of claim 1 , wherein optimizing a base access control policy to yield a residual access control policy is based on known information.

3 . The computer-implemented method of claim 1 , further comprising:

intercepting, at the access control PEP, the access request;

determining, at the access control PEP, that the access request is subject to access control;

requesting, by the access control PEP, the access control PDP to evaluate the access request;

receiving, at the access control PEP, the authorization decision from the access control PDP; and

allowing, by the access control PEP, the access request to proceed based on the authorization decision.

4 . A computer-implemented method comprising:

optimizing a base access control policy to yield a residual access control policy;

compiling, by a verified access control policy compiler, the residual access control policy by:

parsing the residual access control policy;

transforming the residual access control policy to a target access control policy; and

generating executable code based on the target access control policy to yield a compiled residual access control policy;

indexing the compiled residual access control policy;

receiving an access request;

retrieving the compiled residual access control policy from an index based on one or more attributes of the access request;

evaluating the access request against the compiled residual access control policy to determine an authorization decision; and

returning the authorization decision.

5 . The computer-implemented method of claim 4 , wherein optimizing a base access control policy to yield a residual access control policy is based on known information.

6 . The computer-implemented method of claim 4 , further comprising:

intercepting, at an access control policy enforcement point (PEP), the access request;

determining, at the access control PEP, that the access request is subject to access control;

requesting, by the access control PEP, an access control policy decision point (PDP) to evaluate the access request;

receiving, at the access control PEP, the authorization decision from the access control PDP; and

allowing, by the access control PEP, the access request to proceed based on the authorization decision.

7 . The computer-implemented method of claim 4 , wherein the residual access control policy comprises statements, rules, or conditions of the base access control policy with one or more statements, rules, or conditions of the base access control policy pre-evaluated or removed.

8 . The computer-implemented method of claim 4 , further comprising:

receiving, at an access control policy decision point (PDP), the access request;

querying, by the access control PDP, an access control policy information point for selected policies applicable to the access request;

determining, by the access control PDP, a subset of the selected policies that are relevant to the access request as relevant policies, the relevant policies comprising the residual access control policy;

evaluating, by the access control PDP, the access request against the relevant policies;

packaging, by the access control PDP, the authorization decision as a packaged decision; and

communicating, by the access control PDP, the packaged decision to an access control policy enforcement point.

9 . The computer-implemented method of claim 4 , further comprising:

identifying, by an access control policy optimizer, known information; and

simplifying, by the access control policy optimizer, one or more access control policy conditions of the base access control policy based on the known information.

10 . The computer-implemented method of claim 4 , further comprising verifying an access control policy compiler according to a proof to yield the verified access control policy compiler, wherein the proof is that for (a) an arbitrary, valid source access control policy in a source access control policy language, (b) an arbitrary, valid input to the arbitrary, valid source access control policy, and (c) an encoding of the arbitrary, valid input, (1) a verified source access control policy interpreter for the source policy language, when evaluating (a) the arbitrary, valid source access control policy against (b) the arbitrary, valid input, results in a same authorization decision as (2) an execution of a compiled executable version of (a) the arbitrary, valid source access control policy, wherein an input to the execution of the compiled executable version is (c) the encoding of the arbitrary, valid input suitable for input to the execution of the compiled execution version, wherein the compiled executable version of (a) the arbitrary, valid source access control policy is compiled by the access control policy compiler, and wherein equivalence between the compiled residual access control policy and the residual access control policy follows from the verified access control policy compiler being verified according to the proof.

11 . The computer-implemented method of claim 4 , further comprising:

compiling, by the verified access control policy compiler, a raw access control policy to yield a compiled access control policy;

indexing the compiled access control policy;

receiving a second access request, wherein the access request is a first access request;

retrieving the compiled access control policy from the index based on one or more attributes of the second access request;

evaluating the second access request against the compiled access control policy to determine a second authorization decision, wherein the authorization decision is a first authorization decision; and

returning the second authorization decision.

12 . The computer-implemented method of claim 4 , further comprising:

receiving a second access request, wherein the access request is a first access request;

retrieving the compiled residual access control policy from the index based on one or more attributes of the second access request;

evaluating the second access request against the compiled residual access control policy to determine a second authorization decision, wherein the authorization decision is a first authorization decision; and

returning the second authorization decision.

13 . A system comprising:

a first one or more computing devices to implement an access control policy administration point (PAP) in a cloud provider network, the access control PAP including instructions that upon execution by one or more processors cause the access control PAP to:

optimize a base access control policy to yield a residual access control policy; and

compile, by a verified access control policy compiler of the access control PAP, the residual access control policy by:

parsing the residual access control policy;

transforming the residual access control policy to a target access control policy; and

generating executable code based on the target access control policy to yield a compiled residual access control policy;

a second one or more computing devices to implement an access control (PIP) in the cloud provider network, the access control (PIP) including instructions that upon execution by one or more processors cause the access control (PIP) to:

index the compiled residual access control policy;

a third one or more computing devices to implement an access control policy decision point (PDP) in the cloud provider network, the access control PDP including instructions that upon execution by one or more processors cause the access control (PIP) to:

receive an access request;

retrieve the compiled residual access control policy from an index based on one or more attributes of the access request;

evaluate the access request against the compiled residual access control policy to determine an authorization decision; and

return the authorization decision.

14 . The system of claim 13 , the access control PAP further including instructions that upon execution cause the access control PAP to optimize the base access control policy to yield the residual access control policy based on known information.

15 . The system of claim 13 , further comprising:

a fourth one or more computing devices to implement an access control policy enforcement point (PEP) in the cloud provider network, the access control PEP including instructions that upon execution by one or more processors cause the access control PEP to:

intercept the access request;

determine that the access request is subject to access control;

request the access control PDP to evaluate the access request;

receive the authorization decision from the access control PDP; and

allow the access request to proceed based on the authorization decision.

16 . The system of claim 13 , wherein the residual access control policy comprises statements, rules, or conditions of the base access control policy with one or more statements, rules, or conditions of the base access control policy pre-evaluated or removed.

17 . The system of claim 13 , the access control PDP further including instructions that upon execution by one or more processors cause the access control policy decision point to:

query the access control (PIP) for selected policies applicable to the access request;

determine a subset of the selected policies that are relevant to the access request as relevant policies, the relevant policies comprising the residual access control policy;

evaluate the access request against the relevant policies;

package the authorization decision as a packaged decision; and

communicate the packaged decision to an access control policy enforcement point.

18 . The system of claim 13 , the access control PAP further including instructions that upon execution by one or more processors cause the access control PAP to:

identify known information; and

simplify one or more access control policy conditions of the base access control policy based on the known information.

19 . The system of claim 13 , the access control PAP further including instructions that upon execution by one or more processors cause the access control PAP to:

compile, by the verified access control policy compiler, a raw access control policy to yield a compiled access control policy;

the access control (PIP) further including instructions that upon execution by one or more processors cause the access control (PIP) to:

index the compiled access control policy; and

the access control PDP further including instructions that upon execution by one or more processors cause the access control PDP to:

receive a second access request, wherein the access request is a first access request;

retrieve the compiled access control policy from the index based on one or more attributes of the second access request;

evaluate the second access request against the compiled access control policy to determine a second authorization decision, wherein the authorization decision is a first authorization decision; and

return the second authorization decision.

20 . The system of claim 13 , the access control PDP further including instructions that upon execution by one or more processors cause the access control PDP to:

receive a second access request, wherein the access request is a first access request;

retrieve the compiled residual access control policy from the index based on one or more attributes of the second access request;

evaluate the second access request against the compiled residual access control policy to determine a second authorization decision, wherein the authorization decision is a first authorization decision; and

return the second authorization decision.