A flexible access control mechanism supporting large scale distributed collaboration

In the large scale collaborative systems based on Internet, autonomous domains always share some resources between each other. So the access control mechanism of shared resources need to support multiple security policies, including the security policy of the domain it belongs to and various policies for requests from different cooperative domains. Because the security policy is traditionally hard coded into the access control mechanism, only one kind of access control policy can be supported at the access control mechanism. This paper provides a method to build a flexible security mechanism that separates the access control policy from the access control decision function by using the concept of meta-policy. The flexible security mechanism can support multiple security policies dynamically. The methods has been implemented and verified in a CORBA based system.