RSVP Policy Control using XACML Pontifícia Universidade Católica do Paraná PUC-PR, Brazil Presented by: Emir Toktar Emir Toktar Edgard Jamhour Carlos Maziero

Emir Toktar - Policy Summary Motivation Proposal RSVP Policy Control XACML Framework XACML Extensions Example Conclusions Future Works

Emir Toktar - Policy Motivation Many IETF publications for QoS management is based on PCIM extensions.  PCIM is an information model  PCIM deployment can be complex XACML offers an alternative for defining policies in XML.  A model suited for business level policies  Easy to understand and deploy IETF: Internet Engineering Task Force OASIS: Organization for the Advancement of Structured Information Standards PCIM: Policy Core Information Model XACML: eXtensible Access Control Markup Language

Emir Toktar - Policy Motivation RSVP Policy Control is an “Access Control” problem suited to be addressed by XACML. However:  For properly addressing the RSVP issue, additional RSVP information must be returned with access control decision: e.g. Tspec  It requires XACML extensions Policy Control is Not Admission Control

Emir Toktar - Policy Proposal Define XACML extensions for addressing the RSVP Policy Control issue. Compare the XACML-based framework with IETF PCIM-based framework with respect to:  policy definition and  framework implementation.

Emir Toktar - Policy RSVP Policy Control [RFC 2753] manage the use of network resources and services based on policies derived from criteria such as:  to identify users and applications,  traffic/bandwidth requirements,  security considerations and  time-of-day/week. Business Level Policies   i.e. can be addressed by XACML

Emir Toktar - Policy RSVP Admission Control Only takes into account the  requester’s resource reservation request  available capacity The available capacity is a stateful information available in the routers, and it is not addressed in our proposal.

Emir Toktar - Policy XACML Policy Language Model

Emir Toktar - Policy XACML Example =VideoServer =login = Permit = >08h00 and <17h00 = UsersRegs =Deny-Overrides =Multimedia “the user can login on a Video Server in the period between 08:00AM and 05:00PM”

Emir Toktar - Policy XACML Framework adapted to RSVP PEP element is a component of the Server Application  PEP is responsible for all integration with RSVP daemon The Applicaton is releasing from any task of QoS negotiation This approach can be implemented in any system that supports RSPV APIs.  XACML doesn´t define any Policy Transaction Protocol between PDP and PEP.

Emir Toktar - Policy XACML Problems Resource and User Information is supposed to be defined in the policy document. The reuse of resource and user information requires creating references to external information. The issue of addressing external information was not well-developed in XACML 1.1.

Emir Toktar - Policy Proposal Use XPointer language to create policies with reusable User and Resource Information.

Emir Toktar - Policy Proposal – + – – + The strategy adopted for describing a RSVP policy

Emir Toktar - Policy Proposal QoS information is returned by the Obligations Single service can offer different service levels A XML schema for RSVP parameters  for building the PATH msg  Tspec {r,b,p,m,M}  type of service (GS / CL)  reservation style  described in the RFC 2210 and RFC 2215

Emir Toktar - Policy Example a) Registered students have permission to access any server in the campus offering a “TutorialVideoStreaming” service without time restrictions.  If a student connects to a server using a client host from inside the campus, he will receive a “GOLD” or “SILVER” service level.  Otherwise, it will receive a “BRONZE” service level.

Emir Toktar - Policy Example b) Unregistered students can have access to the “TutorialVideoStreaming” service only from the internal network and not in business- time.  They can receive only the “BRONZE” service level.

Emir Toktar - Policy Scenario example…  XACML Request context etoktar TutorialVideo getResourceQoS Receiver Sender etoktar TutorialVideo getResourceQos

Emir Toktar - Policy Example of Service Document tutorial videos in the university campus

Emir Toktar - Policy Example of User Document – Emir Toktar Toktar etoktar RegisteredStudent – Luiz Cesar Cezar lcezar RegisteredStudent + – Guest guest UnregisteredStudent +

Emir Toktar - Policy – + + <Policy PolicyId="...:policy:TutorialRegStudentsInternal" RuleCombiningAlgId="...:rule-combining-algorithm:first-applicable"> + <Policy PolicyId="...:policy:TutorialRegStudentsExternal" RuleCombiningAlgId="...:rule-combining-algorithm:first-applicable"> + <Policy PolicyId="...:policy:TutorialRegStudentsGuest" RuleCombiningAlgId="...:rule-combining-algorithm:first-applicable"> + <Policy PolicyId="...:policy:TutorialDenyForOthers" RuleCombiningAlgId="...:rule-combining-algorithm:first-applicable"> Example of Policy Document

Emir Toktar - Policy – – – TutorialVideo – ="TutorialVideoStreaming"]/sap/inetaddress/text()) + Example of Policy – PolicySet Target Request context

Emir Toktar - Policy – – /user[businessCategory='RegisteredStudent']/uid/text()) – getResourceQoS Example of Policy # 1 Request context

Emir Toktar - Policy – – * – – Example of Policy Document # 1 Request context

Emir Toktar - Policy Example of Policy Document # 4

Emir Toktar - Policy Example of Response Permit + G Guaranteed FF H261QCIF Controlled-load SE

Emir Toktar - Policy Framework Implementation Sun Package for XACML at (URL): SUN ONE Studio 4 update1 Java™ 2 SDK, Standard Edition XACML XPath functions are optional they are not implemented

Emir Toktar - Policy Framework Modifications for supporting the Proposal Used JAXEN to support XPath statements Stand-alone XPath implementation Works with DOM, JDOM and EletricXML RSVP XML schema definition RSVP parameters (Tspec) to support definitions of Resources XMLSpy® v.5.0, release 4 Function xpath-node-match developed Syntax type of expressions: “full XPointers”  uri-reference#scheme(expression) scheme(expression)…  scheme name: xpointer(xptr-expr)

Emir Toktar - Policy Conclusions XACML is suited for business level policies The available framework is easy to use and extend PCIM has not addressed the business level issue, it is focused on device configuration. XACML requires additional specification for creating policies that refer to external documents The obligation structure must be extended to support a more flexible strategy for returning parameters. XACML is an open standard that enables the setting of new tools for controlling the managing of policies.

Emir Toktar - Policy Thank you! Questions ?  address to

Emir Toktar - Policy Example of Service Document - SAP tutorial videos in the university campus – TCP

Emir Toktar - Policy Example of Service Document - RSVP tutorial videos in the university campus + – Guaranteed FF + +