TY - GEN
T1 - Sfatables
T2 - 31st International Conference on Distributed Computing Systems, ICDCS 2011
AU - Bhatia, Sapan
AU - Bavier, Andy
AU - Peterson, Larry
AU - Sevinc, Soner
PY - 2011
Y1 - 2011
N2 - Recent efforts to federate computation and communication resources across organizational boundaries face a challenge in establishing the policies by which one organization's users can access resources in other organizations. This paper describes an approach to defining, communicating, analyzing, and enforcing resource allocation policies in this new setting. Our approach was designed to address the needs of PlanetLab, but we demonstrate through a range of examples that it is general enough to accommodate a diverse collection of computing facilities. Our policy engine is implemented in a specific tool chain, called sfatables, that is patterned after the iptables mechanism used to define packet processing policies for network traffic. The interface to our policy engine thus uses the familiar paradigm of a firewall and provides a flexible interface for resource owners to specify access policies for their resources. Our implementation makes it possible to precisely document policies, query, and analyze them.
AB - Recent efforts to federate computation and communication resources across organizational boundaries face a challenge in establishing the policies by which one organization's users can access resources in other organizations. This paper describes an approach to defining, communicating, analyzing, and enforcing resource allocation policies in this new setting. Our approach was designed to address the needs of PlanetLab, but we demonstrate through a range of examples that it is general enough to accommodate a diverse collection of computing facilities. Our policy engine is implemented in a specific tool chain, called sfatables, that is patterned after the iptables mechanism used to define packet processing policies for network traffic. The interface to our policy engine thus uses the familiar paradigm of a firewall and provides a flexible interface for resource owners to specify access policies for their resources. Our implementation makes it possible to precisely document policies, query, and analyze them.
UR - http://www.scopus.com/inward/record.url?scp=80051862473&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=80051862473&partnerID=8YFLogxK
U2 - 10.1109/ICDCS.2011.58
DO - 10.1109/ICDCS.2011.58
M3 - Conference contribution
AN - SCOPUS:80051862473
SN - 9780769543642
T3 - Proceedings - International Conference on Distributed Computing Systems
SP - 467
EP - 476
BT - Proceedings - 31st International Conference on Distributed Computing Systems, ICDCS 2011
Y2 - 20 June 2011 through 24 July 2011
ER -