NOVI: Networking innovations Over Virtualized Infrastructures STREP Project No. 257867, Call 5 – FIRE Policy Framework Leonidas Lymberopoulos NOVI Workshop Barcelona, March 15th 2012

Policy types Authorization Policies to specify which actors have access to which virtual resources Event-Condition-Action Policies that enforce control & management actions upon certain events within the managed environment. Role-Based-Access Control Policies to specify which classes of actors have access to which virtual resources. Mission Policies that define the obligations of a domain in respect to the other domains within a NOVI federation. Duties are specified as sets of Authorization and Event-Condition-Action policies. NOVI Workshop 15 March 2012

Policy Service within NOVI's C&M plane NOVI Workshop 15 March 2012

Example PlanetLab policy objects NOVI Workshop 15 March 2012

Example FEDERICA policy objects NOVI Workshop 15 March 2012

Slice reconfiguration example using an event-condition-action policy An event is generated by the Monitoring Service indicating that a PlanetLab virtual resource in a NOVI slice (topology in the NOVI IM) is no longer available. This event (vnodefailure) triggers an event-condition-action policy rule (virtualnodefailure) within the Policy Service. Policy Service calls the “updateSlice” method of Intelligent Resource Mapping Service to find a new solution to fulfill the needs of the user’s request. NOVI Workshop 15 March 2012

Example authorization policy configuration file newauthpol := root load: "AuthorisationPolicy". root/factory at: "newauthpol" put: newauthpol. root/authdom at: "a1" put: (newauthpol subject: root/Usersdomain/User1 action: "access:" target: root/Resources/planetlab2-novi focus: "t"). root/authdom/a1 reqneg. // set the policy negative, auth - root/authdom/a1 active: true //activate this policy NOVI Workshop 15 March 2012

Future Work Inter-domain relationships as missions A mission defines the requirements of one domain for interacting with another. A mission is a group of policies which defines the duties of the remote domain as a set of obligation policies it must enforce. Obligation policies are written according to the mission interfaces for each domain. Mission interfaces specify Events, Notifications, Local actions and Remote actions. Integration of the Policy Ontology in the NOVI Service Layer Definition of Roles, so that Role Based Access Control policies can be deployed NOVI Workshop 15 March 2012