Wirtschaftsuniversität Wien Magisterarbeit - SemanticLab

3.3.1. XACML - an introduction
Similar to P3P and EPAL, XACML is implemented using XML-files. It also uses the already
common approach of defining one policy which includes several rules. It is checked
whether a rule applies and what the effect of this rule is (the request is allowed or denied)
based on given conditions. Such matches are being performed if a request has been sent
whereas the necessary information to decide whether the request matches the rule under
given conditions is provided with the request. These similarities are no coincidence as
EPAL 1.1 used XACML explicitly and EPAL 1.2 uses a lot of XACML’s concepts such as
attributes, rules, conditions, etc [Sun05]. Furthermore, XACML is based on a previous
project of IBM - the XML Access Control Language (XACL) [Cov08b].
However, [Sun05] highlights some difference between EPAL and XACML, especially
when it comes to the evaluation of rules. Whereas in EPAL the first rule which conditions
are met is applicable (the descending precedence of rules was already described
above), XACML has a combined algorithm in place. That means if in XACML policies
several rules match one request, a choice is given to the user which rule to apply. Although
there are some other key differences between EPAL and XACML, EPAL remains
a subset of XACML - interested readers should consult [Sun05] for more detail on that
issue.
3.3.2. Requirements and structure of XACML
The XACML specification defines some non-normative requirements which are generic
requirements for a policy language. It does, however, of course also defines XACML
specific requirements which are going to be shortly discussed in this section:
• The three basic XACML elements are POLICYSET, POLICY and RULE. Similar
to the previously introduced privacy standards, a policy-set can contain one or
more policies and one policy can contain one or more rules. Data access requests
have to go through a Policy Enforcement Point (PEP). This PEP formulates a
request for an authorization decision which is then sent to a Policy Decision Point
(PDP). This PDP evaluates the existing policies and sends the authorization decision
(Permit, Deny, NotApplicable) back to the PEP.
• To decide on the authorization, the combining algorithm mentioned above comes
into place. It has to ensure that only one policy or policy-set is applicable. If no
policy or policy-set is applicable, it returns NotApplicable, if more than one policy
or policy-set is applicable, it returns Indeterminate.
• XACML supports Role Based Access Control (RBAC). This means that a subject
can hold a role (e.g. IT-Manager) and that such roles have to be considered when
making authorization decisions.
This collection of specifications was just exemplary. For a full list of requirements readers
should consult the XACML specification.
36