GRIDLOCK: A New Scalable Approach to Unifying Computer and Communications Security

GRIDLOCK：统一计算机和通信安全的新的可扩展方法

• 批准号: 0208972
• 负责人: Joan Feigenbaum
• 金额: $ 60万
• 依托单位: Yale University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2002
• 资助国家: 美国
• 起止时间: 2002-07-15 至 2006-06-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0208972&HistoricalAwards=false
• 关键词: GRIDLOCK; New; Scalable; Approach; Unifying

The GRIDLOCK hypothesis is that use of a globally specified and locally interpreted policy language for specification of access-control policy can provide a new, unified approach to securing network applications. In particular, this approach can be used to specify network access-control policies and host access-control policies in combination to provide "virtual private services." GRIDLOCK simultaneously provides more security to applications, greater scalability, and unification of network access control and host access control. Policies are specified in a new policy-expression language, modeled on the KeyNote trust-management language. This design supports compliance checking, with which credentials provided by a client can be validated to provide access to a resource. The applicability of this layer-crossing approach to multiple virtual private services is investigated.The research focuses on the development of formal semantics for the unified access-control policy, as well as a rigorous experimental investigation, using multiple example applications. The expected results include both the new policy-expression language and the demonstration that a scalable access-control model for networked applications is practical.

GRIDORM的假设是，使用一个全球指定和本地解释的访问控制策略的规范的策略语言可以提供一个新的，统一的方法来保护网络应用程序。特别是，这种方法可以用来指定网络访问控制策略和主机访问控制策略的组合，以提供“虚拟专用服务”。“网格同时为应用程序提供了更高的安全性、更大的可扩展性以及网络访问控制和主机访问控制的统一。策略是以一种新的策略表达语言来指定的，该语言是以Keynote信任管理语言为模型的。 此设计支持遵从性检查，通过该检查可以验证客户端提供的凭据以提供对资源的访问。 这种跨层方法的适用性多个虚拟专用services.The研究的重点是统一的访问控制策略的形式化语义的发展，以及严格的实验研究，使用多个示例应用程序。预期的结果包括新的政策表达语言和演示，可扩展的访问控制模型的网络应用程序是切实可行的。