FAIL-SAFE DISTRIBUTED ACCESS CONTROL SYSTEM

摘要

A distributed system includes two or more components, where at least one of the components is a Policy Decision Point (PDP). The PDP is capable of requesting information from another component of the distributed system, and the PDP is capable of executing an authorization process based on one or more policies defined in a policy language. The policy language includes a communicate command, an execution of which causes the PDP to request information from another component in the distributed system. The policy language also includes a fail operator, which defines handling of failures of the communicate command. An analysis tool for analyzing a result of an authorization process in a Policy Decision Point is also described.

主权项

1. A distributed system comprising two or more components, where at least one of said components is a Policy Decision Point (PDP), where said PDP is capable of requesting information from another component of said distributed system, and where said PDP is capable of executing an authorization process based on one or more policies defined in a policy language, wherein
said policy language comprises a communicate command, an execution of which causes said to PDP to request information from another component in said distributed system, and said policy language comprises a fail operator, which defines handling of failures of said communicate command.