xacml — archive

Re: [xacml] request's attribute assertion lifetime?

From: Frank Siebenlist <[email protected]>
To: [email protected]
Date: Wed, 10 Mar 2004 08:09:00 -0000

 MHonArc v2.5.0b2 -->

xacml message

[Date Prev]
 | [Thread Prev]
 | [Thread Next]
 | [Date Next]

--

[Date Index]
 | [Thread Index]
 | [List Home]

Subject: Re: [xacml] request's attribute assertion lifetime?

From: Frank Siebenlist <[email protected]>
To: Daniel Engovatov <[email protected]>
Date: Wed, 10 Mar 2004 00:22:47 -0800

Daniel Engovatov wrote:
> Why should we treat time anyhow differently then any other attribute in
> the context?   Evaluation happens against the "snapshot" of the context
> (or rather a fuzzy snapshot, as we do not regulate how that data will be
> cached or provisioned).  Time is just a dimension like any other.
> 
> After the decision is made - it is PEP job on how and when to use it.

Time is different than any other attribute as it moves in predictable ways. This 
is not a philosophical observation but is truly used.

The PEP actually makes use of that property to note implicitly or explicitly 
that the current time is still within an acceptable range compared to the time 
for which the decision was evaluated.

> For your example:
> You are asking to evaluate not against a point in the context space,
> with "current-time" fixed, but against an uncountable set in that space
> (current-time from 4 to 6).  I do not believe you can formulate such a
> query in a generic way.  Asking whether you can access at 4, and then at
> 6 is not sufficient (you can be denied from 17:01 to 17:03)
> 
> If you want to test what you can do from 4 to 6, introduce context
> parameters "access-begin"  "access-end" of type time, and write policy
> making use of them.  For example 
> GRANT(enter, building, joe) if access-begin < 2pm and access-end > 5pm.

That is exactly what I was asking for when I said time interval. Except that I 
can not incorporate the validity time check for the assertions that are used in 
the evaluation as their validity is only compared to the current time before the 
PDP gets its hand on it.

For what ever it worth, I haven't found any reference in the literature about 
access control policy expressions and evaluation that truly takes time intervals 
into account properly... I'm not sure what that implies...

-Frank.

>