Adaptive Reordering and Clustering-Based Framework for Efficient XACML Policy Evaluation
- 20 May 2010
- journal article
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Transactions on Services Computing
- Vol. 4 (4), 300-313
- https://doi.org/10.1109/tsc.2010.28
Abstract
The adoption of XACML as the standard for specifying access control policies for various applications, especially web services is vastly increasing. This calls for high performance XACML policy evaluation engines. A policy evaluation engine can easily become a bottleneck when enforcing XACML policies with a large number of rules. In this paper we propose an adaptive approach for XACML policy optimization. We apply a clustering technique to policy sets based on the K-means algorithm. In addition to clustering we find that, since a policy set has a variable number of policies and a policy has a variable number of rules, their ordering is important for efficient execution. By clustering policy sets and reordering policies and rules in a policy set and policies respectively, we formulated and solved the optimal policy execution problem. The proposed clustering technique categorizes policies and rules within a policy set and policy respectively in respect to target subjects. When a request is received, it is redirected to applicable policies and rules that correspond to its subjects; hence, avoiding unnecessary evaluations from occurring. We also propose a usage based framework that computes access request statistics to dynamically optimize the ordering access control to policies within a policy set and rules within a policy. Reordering is applied to categorized policies and rules from our proposed clustering technique. To evaluate the performance of our framework, we conducted extensive experiments on XACML policies. We evaluated separately the improvement due to categorization and to reordering techniques, in order to assess the policy sets targeted by our techniques. The experimental results show that our approach is orders of magnitude more efficient than standard Sun PDP.Keywords
This publication has 11 references indexed in Scilit:
- XenginePublished by Association for Computing Machinery (ACM) ,2008
- Automated xacml policy reconfiguration for evaluation optimisationPublished by Association for Computing Machinery (ACM) ,2008
- XACML Policy Integration AlgorithmsACM Transactions on Information and System Security, 2008
- An approach to evaluate policy similarityPublished by Association for Computing Machinery (ACM) ,2007
- Analyzing web access control policiesPublished by Association for Computing Machinery (ACM) ,2007
- Defining and Measuring Policy Coverage in Testing Access Control PoliciesLecture Notes in Computer Science, 2006
- Adaptive Statistical Optimization Techniques for Firewall Packet FilteringPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2006
- Verification and change-impact analysis of access-control policiesPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2005
- Extending query rewriting techniques for fine-grained access controlPublished by Association for Computing Machinery (ACM) ,2004
- On self-organizing sequential search heuristicsCommunications of the ACM, 1976