1. AAAARCH Research Group A grammar for Policies in a generic AAA Environment A. Taal G. Sliepen A.E. Hemel C.T.A.M. de Laat

2. Changes References: AVPs --> Objects AAA Message Types No type checking

3. Object references if ( Query = getPassword( userid = Request.Identity.UserID ) && Request.Identity.PassW == Query.PassW ) then( … ) else( … ) PassW Request Identity

4. Request ServiceReply Answer ServiceData // Action list A1 = getSwitchSettings( ) ; A2 = getConnectionList( ) ; A1. Connections = A2.Connections ; Reply.ServiceData.Settings = A1

5. Object trees A B C D P Q R S A.B = P A.B = K.L.M leaf: int | float | string E A B D E A B D E Q R S

6. AAA Message Types Request Reply Authentication Identity AuthenticationData Answer PolicyRef (remote AAA server): Reply = Authentication@ 146.50.0.23 ( Identity = Request.Identity, AuthenticationData = Request.AuthenticationData ) ! One-to-one mapping Requests Driving Policies

7. AAA Message Types Request Reply Policy Evaluation PolicyReference …….. Answer ServiceData A1 = PolicyEvaluation@ 146.50.0.23 ( PolicyReference = “policy_23” ) A2 = PolicyEvaluation@ 146.50.0.23 ( PolicyReference = “policy_117” ) ! A1.ServiceData  A2.ServiceData

8. Local policy reference: PolicyRef versus FunctionCall PolicyRef : policy_71 @ 127. 0.0.1 ( data1 = “Yes”, data2=12 ) policy_71 @ localhost ( data1 = “Yes”, data2=12 ) FunctionCall: evaluate( ref = “policy_71”, data1 = “Yes”, data2=12 )

9. No type checking ComputedBoolean: ( INT Request.Data.Bandwidth / INT Data.Fraction < 20 ) JavaScript: var a, b, c; a = 3; b = “yeah”; c = a / b; alert( “c=“+c);==> c=NaN Perl: $a; $b; $c; $a = 3; $b = “yeah”; $c = $a / $b;==> Illegal division …

10. Example Driving Policy KERBEROS Authentication: if ( if( exists Request.AuthenticationData.Protocol.Name ) then( ) else ( Reply.Answer.Type = MISSING_DATA ; Reply.Answer.Message = "Missing Protocol.Name" ) && if( Request.AuthenticationData.Protocol.Name == "Kerberos" ) then( ) else ( Reply = Authentication@146.50.0.23( Identity = Request.Identity, AuthenticationData = Request.AuthenticationData ) ) ) then ( // Next slide )

11. Example Driving Policy then ( // Action if ( exists Request.Identity.UserName && … ) then ( KRBReply = authenticate( username = Request.Identity.UserName, servername = … ) ; HE/SHE IS KNOWN!!!! Reply.Answer.AuthenticationData.SessionKey = KRBReply.SessionKey ; … ) else ( Reply.Answer.Type = MISSING_DATA ; Reply.Answer.Message = "AuthenticationData incomplete” ) ;... ) else (... )

12. To do AAA message types Definition of top level objects generic AAA functions return trees generic ASMs return trees pushed / pulled policy treatment

13. Exception handling Parallelism ( Actions, remote references ) To do or to do not