xacml — archive

[System]

Hi Bill, sorry for the delay was on travel. i have not completely understood the examples (also since the allow/deny semantics is not unique). for instance, in Apache you state how to interpret the allow/deny by specifying one of two possible interpretation (meaning: "order deny/allow" or "order allow/deny"). given that the concall will be in two hours we can discuss it by phone. with respect to > deny message if the content contains: (^debt|[ ]debt) ? i am not sure where to query the content of the message (action? resource? environment?). suppose it is a parameter of the action 1) an ONLY IF rule with an action expression evaluating "content contains: (^debt|[ ]debt)" and after the ONLY IF the condition "false" 2) an ONLY IF rule with no conditions before the ONLY IF and with condition "NOT (content contains: (^debt|[ ]debt))" after the only if. is this making sense? we can talk more in the concall. best -p On Tue, 20 Nov 2001, bill parducci wrote: > i am having trouble coming to grips with this concept in a practical sense. > > here is an example of something that i work with on a regular basis: > content filtering. > > let's suppose that i want to use a PEP to filter e-mail/news/media > feeds, etc. based upon content. here are some examples: > > ALLOW (the easy stuff) > ---------------------- > ^From.*root\@.*(mydomain\.net|(mydomain|yourdomain|hisdomain|herdomain)\.com) > ^From.*xacml\@lists.oasis-open\.org > > DENY > ---- > ^Subject:.*LOVEYOU > ^Subject:.*invest.in.credit.card > ^Subject:.*[sS]av((e)|(ings))?.up.to > > DENY ('score' based, may require multiple hits to deny) > ---------------------------------------------------- > Content: [(no)?(without)?].obligation > Content: over.(18|eighteen) > Content: bargain > Content: (^debt|[ ]debt) > Content: save.big > Content: no.*fee > > this is a small sample of the hundreds (if not thousands) of conditions > that can be used (i personally have hundreds). conversely, the number of > possible character combinations comprising a request is litterally > infinite. describing the ALLOWs is easy, but how does one generate a > policy that says: > > deny message if the content contains: (^debt|[ ]debt) ? > > thanks > > b > > > Pierangela Samarati wrote: > > > Hi > > > > as mentioned in the concall today al the last policy committee > > call we discussed the issue of positive (meaning permissions; e.g., > > "this principal can access this resource") and negative authorizations > > (meaning denials: "this principal cannot access this resources"). > > While it is true that you cannot do with permissions alone (many cases > > call for more flexibility), it is also true that having denials > > complicates the framework (mostly also since when you start having > denials > > you start thinking of the different semantics that they can carry - and > > that who specified the rule may have intended). > > > > i had proposed an alternative solution inspired by a recent work, which > > goes as follows. Distinguish two kinds of rules: > > > > 1) the ones that specify sufficient conditions (which are the permissions > > above) > > > > 2) the ones that specify necessary conditions. > > > > instead of repeating descriptions and examples here, i am attaching you a > > file of that work where the two forms of rules are introduced (Section > > 4.2). Of course our language is different as more expressive; but that > > gives the idea. > > > > only one thing, what i call "subject" > > there is our "principal", what i call "object" is our "resource" > > > > pls just send me email (or post the group) for any clarification that may > > be needed, and any comments. > > > > best > > -p > > > ---------------------------------------------------------------- > To subscribe or unsubscribe from this elist use the subscription > manager: <http://lists.oasis-open.org/ob/adm.pl> >