Model Checking Grid Policies

1. JeeHyun Hwang, Mine Altunay, Tao Xie, Vincent Hu Presenter: tanya levshina Model Checking Grid Policies International Symposium on Grid Computing (ISGC 2010)

2. Background • Open Science Grid provides an infrastructure for coordinating Virtual Organizations (VOs) and sites based on various grid policies (policies in short • VO have its own VO policy • E.g. which VO member access which resources, usage rules -- queue priority, etc • Sites have their own policy for providing access to VOs • Which resource is available to which VO, how long, under which conditions, etc 20010-03-09 ISGC

3. Background - cont. Sites enforce both their own policies and the VO policies when VO members utilize the site resources. 20010-03-09 ISGC

4. Motivation • Storage elements and computing elements in sites are shared within and across members of various VOs • Different roles of VOs have different privileges over resources in sites • Sensitive resource or jobs requires policy mechanisms • access control, job priority and scheduling, monitoring and etc • Site policy authors write their own policies w.r.t. their interests • e.g., combine multiple VO policies 20010-03-09 ISGC

5. Motivation - cont. • How to ensure the correct behaviours of policies? • What you specify is what you get, but not necessarily what you want • Our solution: model checking grid policies • Property verification • Check whether a policy satisfied a property • Conflict and redundancy checking • Check whether two policies have conflicts or redundancy • Help combine two policies effectively • Change impact analysis • Check whether a policy is correctly changed 20010-03-09 ISGC

6. Outline • Approach • Access Control in XACML • Property verification • Conflict and redundancy checking • Change impact analysis • Conclusion 20010-03-09 ISGC

7. Access Control in XACML • XACML is eXtensible Access Control Markup Language standardized by OASIS • XACML policy describes a set of rules to specify policy behaviors • Policy Decision Point (PDP) produces a policy decision (e.g., Permit or Deny) with regards to a request from a user XACML Policy Policy Decision Point Request Decision 20010-03-09 ISGC

8. Example Grid Policy • Subjects/Roles: Admin, Tester • Actions: execute • Resources: DiskQuota • Condition: DiskQuotaBytes Rule 1: IF (Admin AND execute AND DiskQuota AND DiskQuotaBytes > 15 MB) Permit Rule 2: IF (Tester AND execute AND DiskQuota AND DiskQuotaBytes > 20 MB) Permit Rule 3: OTHERWISE Deny 20010-03-09 ISGC

9. A FSM Model in NuSMV • NuSMV is a state-of-the-art symbolic model checker developed by CMU and IRST • Requires that a policy is translated into a FSM model • State: Pending, Deny, Permit init(decision) := Pending; next (decision) := case subject = Admin & Resource = DiskQuota & Action = execute & DiskQuotaBytes <= 15 : Permit; subject = Tester & Resource = DiskQuota & Action = execute & DiskQuotaBytes <= 20 : Permit; 1 : Deny; esac; 20010-03-09 ISGC

10. Describing a policy as a state machine • State: description of the decisions in the machine • Initial State: Pending • Finite states: Deny, Permit • Finite-state machine (FSM) model Permit Rule 1 or Rule2 Pending ! (Rule 1 or Rule 2) Deny 20010-03-09 ISGC

11. Policy Verification Property 1: Admin can execute a job that requires 15 MB disk quota No violations are found … next (decision) := case subject = Admin & Resource = DiskQuota & Action = execute & DiskQuotaBytes <= 15 : Permit; …; 1 : Deny; esac; … 20010-03-09 ISGC

12. Policy Verification Property 2: No role cannot execute (a job) that requires a disk quota bigger than 15 MB Violation with a counterexample: Tester can execute a job that requires 17 MB disk quota next (decision) := case … subject = Tester & Resource = DiskQuota & Action = execute & DiskQuotaBytes <= 20 : Permit; …; 1 : Deny; esac; … Violation Found! 20010-03-09 ISGC

13. Conflict and Redundancy • Find conflict and redundant rules • Consider a site policy author combine multiple VO policies • Detect redundancies to remove redundant policies • Detect conflicts to identify which rule should be given higher priority during policy evaluation • Detect conflict between site and VO policies • FSM models to detect redundancy and conflict • For example, A VO has two policies: VO1 and VO2 • State: Pending, Redundancy or Conflict 20010-03-09 ISGC

14. Conflict and Redundancy - cont. Conflict and redundancy state Conflicts Pending Redundancy Conflict/redundancy checking VO1.dec state VO2.dec state Permit Permit Pending Deny Pending Deny NA NA Policy VO1 Policy VO2 20010-03-09 ISGC

15. Conflict and Redundancy Detect conflict and redundancy by property verification Property 1: Is there any ways to reach to redundancy state This property outputs redundancies (if any) VO1 = Permit and VO2 = Deny or VO1 = Deny and VO2 = Permit VO1 = Permit and VO2 = Permit or VO1 = Deny and VO2 = Deny Property 2: Is there any ways to reach to conflict state This property outputs redundancies (if any) Pending Conflict Pending Redundancy 20010-03-09 ISGC

16. Change Impact Analysis • Policy authors change a policy A to a policy B • Ensure correctness of a changed policy • Output all different requests-decision pairs produced by two policies • outputs conflicting decisions of a policy A and policy B (conflicting decisions) • The administrators could miss corner cases to expose faults after policy change • By extending our conflict detection technique, we plan to apply change impact analysis on grid policies to ensure a policy B is correctly changed after inspecting conflicting decisions. 20010-03-09 ISGC

17. Conclusion and Future Work • Model checking help ensure the correctness of policies • Property verification • Conflict and redundancy checking • Change impact analysis 20010-03-09 ISGC

18. Any Questions? Thank You 20010-03-09 ISGC