library / references

Primary Policy Machine References/Background:

This paper provides a good overview of the Policy Machine's ability to express and enforce policies and policy combinations. However, unlike Policy Machine's most recent specification, this paper activates attributes prior to mediating an access request and does not recognize obligations or prohibitions.

• D. Ferraiolo, S. Gavrila, V. Hu, R. Kuhn, “Composing and combining policies under the policy machine, in: Proceedings of ACM Symposium on Access Control Models and Technologies”, 2005, pp. 11–20.

This paper describes the Policy Machine’s ability to unify data services and access control.

• David Ferraiolo, Serban Gavrila (NIST), and Wayne Jansen (Booz Allen Hamilton); "Using a Policy Machine to Enable an Enterprise-wide, Data Centric Operating Environment." IEEE Computer Magazine’s Security Column, Vol. 46, No. 5, May 2013

A good description of the PM's ability to support different types of policies without the need to activate attributes:

• D. Ferraiolo, V. Atluri, and S. Gavrila, “ The Policy Machine: A Novel Architecture and Framework for Access Control Policy Specification and Enforcement,” J. Systems Architecture, vol. 57, no. 4, 2011, pp. 412–424.

This draft IR is the most detailed Policy Machine specification:

• D. Ferraiolo, S. Gavrila, W. Jansen, “ Policy Machine: Features, Architecture, and Specification ” December 2012

High level slide briefing:

• David Ferraiolo and Serban Gavrila "Policy Machine Enabling an Enterprise–wide, Data Centric Operating Environment"

Related Articles:

• David Ferraiolo & Vijay Atluri, "A Meta Model for Access Control: Why is it needed and Is it even possible to achieve?", In Proceeding SACMAT '08 Proceedings of the 13th ACM symposium on Access control models and technologies, pp. 153–154
• D. Ferraiolo, J. Voas and G. Hurlburt, “A Matter of Policy”, IT Pro, March/April 2012, pp. 4–7