GRIDLOCK: A New Scalable Approach to Unifying Computer and Communications Security

僵局假设是，使用全局指定和本地解释的策略语言来规范访问控制策略可以提供一种新的、统一的方法来保护网络应用。特别是，此方法可用于指定网络访问控制策略和主机访问控制策略，以提供“虚拟专用服务”。Gridlock同时为应用程序提供了更高的安全性、更大的可扩展性以及网络访问控制和主机访问控制的统一。策略是以一种新的策略表达式语言指定的，该语言以Keynote信任管理语言为模型。此设计支持遵从性检查，使用该检查可以验证客户端提供的凭据以提供对资源的访问。研究了这种跨层方法对多个虚拟专用服务的适用性，重点研究了统一访问控制策略的形式化语义的开发，并使用多个实例应用进行了严格的实验研究。预期的结果既包括新的策略表达语言，也包括演示用于网络应用的可扩展访问控制模型的实用性。

The GRIDLOCK hypothesis is that use of a globally specified and locally interpreted policy language for specification of access-control policy can provide a new, unified approach to securing network applications. In particular, this approach can be used to specify network access-control policies and host access-control policies in combination to provide "virtual private services." GRIDLOCK simultaneously provides more security to applications, greater scalability, and unification of network access control and host access control. Policies are specified in a new policy-expression language, modeled on the KeyNote trust-management language. This design supports compliance checking, with which credentials provided by a client can be validated to provide access to a resource. The applicability of this layer-crossing approach to multiple virtual private services is investigated.The research focuses on the development of formal semantics for the unified access-control policy, as well as a rigorous experimental investigation, using multiple example applications. The expected results include both the new policy-expression language and the demonstration that a scalable access-control model for networked applications is practical.