Easy Expression of Authorisation Policies

点击翻译按钮获取中文摘要

The primary purpose of this 20 month long project is to allow Grid managers to be able to specify the authorisation policy for access to their Grid computing resources through the use of controlled natural language. The policy tool will parse the policy, interpret it, and store it in its own internal representation, using a model and ontology developed at the start of the research. The policy tool will prompt the manager to clarify any unclear terms (e.g. what is Fred? Is it a filename or a username?), resolve any ambiguities, and once this has been done will print the policy out in similar natural language, using wording as near to the original input language as possible. This will allow the manager to see if the computer has fully understood his policy, but if not, the manager will need to edit his policy and resubmit it, until the computer's version is identical in meaning to his own. Finally, the tool will compile the policy into two existing XML authorization policy languages (XACML and PERMIS) so that the policy can be automatically fed into existing Grid authorization engines (policy decision points). In this way, we can be assured that the policy that is implemented is the one that the manager intended it to be.