Dynamic conflict detection in policy-based management systems

Abstract

While advances in open distributed systems have undoubtedly provided a uniquely diverse environment for users, managing the resources within such an environment has become an increasingly complex task. This challenge has been considered for several years within the distributed systems management research community and we have recently seen policy-based management emerge as one such promising exemplification.The focus of our work has been predominantly on supporting the requirements of large evolving enterprises. Such environments present a significant challenge for policybased management as the fluidity and complexity of interactions occurring in such environments mean that prevailing static-based specification and analysis of policies and roles, would be inadequate in many instances. We are therefore interested in providing support for a dynamic policy-based management environment. This paper discusses the critical nature of providing both dynamic and static conflict detection and resolution and introduces a scalable computationally-efficient dynamic conflict detection mechanism.

On harnessing information models and ontologies for policy conflict analysis

“…A similar denition of policy conict has been adopted by Dunlop et al (2001Dunlop et al ( , 2002Dunlop et al ( , 2003 who further classify policy conict into dynamic and static cases. Dynamic policy conict can only be truly detected at runtime, whereas static policy conict can be detected at compile time.…”

Dynamic Consistency Analysis for Convergent Operators

“…Whether O 2 and O 4 conflict depends upon what they mean or intend, rather than how they are coded. While the reader may suggest that they could be coded such that the fixed point of a set becomes a syntactic property, this would not simplify the problem of determining whether a fixed point exists.…”

“…It remains difficult to analyze whether a given set of operators shares a fixed point, particularly when the operators act upon different parts of a distributed network. Static analysis of operator fixed-points is difficult enough when we have complete knowledge of the operators (the problem is equivalent to policy consistency [3]), and virtually impossible when we have incomplete knowledge of the operators [4]. Based upon prior work, without further assumptions, we conclude that the problem of statically determining whether a particular set of distributed operators share a fixed point is intractable, in the same way that it is computationally hard to determine consistency of an unconstrained set of rules.…”

Enhanced sharing and privacy in distributed information sharing environments

“…Static and dynamic conflict are described and their detection methods are provided in [15]. An owner-based hybrid policy-based sharing control model is described in our system [16].…”