Download - Academy Publisher

6) Opining source, the language definition itself is an
open source, which can be modified to cater for the new
changes.
Ⅳ. SOLUTION TO THE CONFLICT
In the policy-based applications, it is difficult to avoid
conflicts between policies. So the tools to provide
detection of conflict and conflict resolution approach are
necessary. We discuses two kinds of conflict here:
modality conflicts and application specific conflicts [12].
A. modality conflicts
The modality conflict is caused by inconsistencies in
policy specification. When two or more policies use the
same subject, behavior or goals that define the form of
the opposite, then such conflicts occur. As shown in
figure 3. it can be achieved by parsing policies to predict
[13]. Because space is limited, we do not make a specific
description.
Figure 3.
Form conflict
B. application specific conflicts
Application specific conflict refers to the conflict with
the consistency of the elements, these elements that is
related to the subject, objectives and standards of
behavior and external. Such conflicts can not predict
directly through the definition of policies, need to specify
additional information that lead to conflict. The
additional information is called meta-policy. There are
two kinds of proposal of static and dynamic to resolve
the semantic conflict by Application of meta-policy.
Static proposal refers to the policies of conflict can not
exist together in a system. Dynamic proposal is the
policies of conflict can not be run at the same time to
activate.
Figure 4.
FAM Framework
2) Ponder policy deployment model. The framework is
an extension of IETF policy management framework. It
includes 3 supporting services: a domain service, a
policy service, and an event service. The Policy Service
acts as the interface to policy management, it stores
compiled policy classes, creates and distributes new
policy objects. The Domain Service manages a
distributed hierarchy of domain objects and supports the
efficient evaluation of subject and target sets at run-time.
Each domain object holds references to its managed
objects but also references to the policy objects that
currently apply to the domain. The Event Service collects
and composes events from the underlying systems and
from the managed objects in the system, and forwards
them to registered policy management agents triggering
obligation policies. An overview of the policy
deployment model is shown in figure 5.
Ⅴ. POLICY FRAMEWORK
A. Introduction
SHAN [14] divided security policy framework into
three categories in his dissertation: based on policy
description language; based on security attributes and
based on the unified model. The following are some
well-known policy Framework:
1) FAM Framework. This is based on policy
description language, is proposed by Sushil Jajodia,
Pierangela Samarati et al. in 1997. They defined a
flexible authorization manager, could to implement
multiple security policies in the same system. But it is
the biggest drawback is that can not adapt to dynamic
changes. An overview of FAM framework is shown in
figure 4.
Figure 5.
Overview of policy deployment model
3) FLASK Framework. The Flask security architecture,
as shown in Figure 6, describes the interactions between
subsystems that enforce security policy decisions and a
subsystem which makes those decisions, and the
requirements on the components within each subsystem.
The primary goal of the architecture is to provide for
flexibility in the security policy by ensuring that these
subsystems always have a consistent view of policy
decisions regardless of how those decisions are made or
how they may change over time. Secondary goals for the
architecture include application transparency, defense-in-depth,
ease of assurance, and minimal performance impact.
216