1 © 2003, Cisco Systems, Inc. All rights reserved. IEEE Policy Conference 2004 CIM and Ponder Andrea Westerinen, Cisco June, 2004

222 © 2003, Cisco Systems, Inc. All rights reserved. Purpose Determine if the DMTF approach for writing policy rules is workable Compare the CIM representation with a “known” language

333 © 2003, Cisco Systems, Inc. All rights reserved. DMTF’s Policy Model in CIM Instances and groups of PolicyRules Rules aggregate PolicyConditions and PolicyActions Conditions can be combined in conjunctive or disjunctive sets Actions can be sequenced Domain-specific subclassing For example, IPsec or Authentication/Authorization rules New work in support of generic Event-Condition- Action policy rules

444 © 2003, Cisco Systems, Inc. All rights reserved. CIM Policy Classes

555 © 2003, Cisco Systems, Inc. All rights reserved. Authentication/Authorization Rules in CIM

666 © 2003, Cisco Systems, Inc. All rights reserved. CIM Event-Condition-Action Classes Can identify “rule triggering” conditions/events

777 © 2003, Cisco Systems, Inc. All rights reserved. PONDER Policies Declarative Three categories of policy rules Authorization, Obligation, Delegation Both positive and negative Negative obligation rules are coded as “refrain” inst oblig { on ; subject = ; target = ; do ; }

888 © 2003, Cisco Systems, Inc. All rights reserved. Policy, Pigs and PONDER Discussion in DMTF Policy WG If at least two of a farmer’s pigs are squealing, then he/she must feed one of the pigs that is not squealing.

999 © 2003, Cisco Systems, Inc. All rights reserved. Policy and Pigs – CIM Representation MethodAction’s Query clause MUST specify the method to be called and its parameters

10 © 2003, Cisco Systems, Inc. All rights reserved. Policy and Pigs – PONDER Representation oblig feedNotSquealingPig { on CIM_AtLeastTwoSquealingPigs ; // 2 or more squealing pigs subject /farmers ; // i.e., all farmers do (t = self.Raises->reject(isSquealing)) -> self.HandleAnimal(t, 2) ; } // where 2=‘feed’

11 © 2003, Cisco Systems, Inc. All rights reserved. Conclusions Both Ponder and CIM - Declarative rules with backing semantics Ponder – Concise and explicit CIM – Language neutral and reusing infrastructure Query expression is “not natural” Initial rendering/testing successful (SNIA SMI-S)

12 © 2003, Cisco Systems, Inc. All rights reserved. Questions?