sfatables: A Firewall-like Policy Engine for Federated Systems

Recent efforts to federate computation and communication resources across organizational boundaries face a challenge in establishing the policies by which one organization's users can access resources in other organizations. This paper describes an approach to defining, communicating, analyzing...

Full description

Saved in:
Bibliographic Details
Main Authors: Bhatia, S., Bavier, A., Peterson, L., Sevinc, S.
Format: Conference Proceeding
Language:English
Subjects:
cloud
Distributed computing
firewall
planetlab
Resource allocation policies
testbeds
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Recent efforts to federate computation and communication resources across organizational boundaries face a challenge in establishing the policies by which one organization's users can access resources in other organizations. This paper describes an approach to defining, communicating, analyzing, and enforcing resource allocation policies in this new setting. Our approach was designed to address the needs of Planet Lab, but we demonstrate through a range of examples that it is general enough to accommodate a diverse collection of computing facilities. Our policy engine is implemented in a specific tool chain, called sfatables, that is patterned after the iptables mechanism used to define packet processing policies for network traffic. The interface to our policy engine thus uses the familiar paradigm of a firewall and provides a flexible interface for resource owners to specify access policies for their resources. Our implementation makes it possible to precisely document policies, query, and analyze them.
ISSN:1063-6927
2575-8411
DOI:10.1109/ICDCS.2011.58