Adaptive Reordering and Clustering-Based Framework for Efficient XACML Policy Evaluation

Marouf, Said; Shehab, Mohamed; Squicciarini, Anna; Sundareswaran, Smitha

doi:10.1109/tsc.2010.28

Cited by 39 publications

(24 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Effectively, resources are not used in an equal manner by the same subjects for the same actions. Some resources are used more than others and even changes of usage pattern can occur depending on external events as reported in [6].…”

Section: B the Benefits Of Structuringmentioning

confidence: 99%

See 1 more Smart Citation

Challenges of Composing XACML Policies

Stepien

Felty

Matwin

2014

2014 Ninth International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Abstract-XACML (eXtensible Access Control MarkupLanguage) is a declarative access control policy language that has unique language constructs for factoring out access control logic. These constructs make the specification of access control requirements more compact than decision trees, which can be considered the most natural way to specify access control logic. However, many publications report that performance of XACML policy decision point (PDP) engines is greatly affected by the structure of policy sets. In this paper we first explore the causes of potential inefficiencies of XACML policies, and then propose a procedure to re-structure policy sets vertically by modifying the distribution of access control logic among different configurations of structural elements, in order to remove much of this inefficiency. This is in contrast to horizontal re-ordering of constant structural elements. Our procedure can be applied regardless of the complexity and structure of the original policy set. We also compare the performance of policy sets that take advantage of the expressive power of XACML targets to decision trees.

show abstract

Section: B the Benefits Of Structuringmentioning

confidence: 99%

“…• Horizontal re-ordering, consisting of optimizing the order of alternate children of policy sets (policy sets or policies) and/or optimizing the order of child rules of policies, as described in [6]. This also includes weighing requests according to statistical usage.…”

Section: A a Review Of Existing Restructuring Algorithms Andmentioning

confidence: 99%

Challenges of Composing XACML Policies

Stepien

Felty

Matwin

2014

2014 Ninth International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

show abstract

“…A summary of research in conflict detection is given in [16]. The topic of improving performance has been the subject of more recent research [11,12,13].…”

Section: B State Of Research In Reducing Policy Setsmentioning

confidence: 99%

“…In [12], the emphasis is not on reduction of the size of the policy sets, but instead on re-ordering the policies to improve the search time required to evaluate AC requests and grant or deny permission to access a resource. The originality of this work is that the reordering algorithm is based on a statistical analysis not only of the policies of a policy set but also on the dynamic flow of requests that can structurally vary with time due to seasonal factors or market conditions.…”

Section: B State Of Research In Reducing Policy Setsmentioning

confidence: 99%

“…X is 10 and Y is one of "a", "b" and Z is one of true, false Policy P 5 has only a common value of 10 for attribute X, an entirely different value "c" for attribute Y but a value of true for attribute Z that is included in the corresponding attribute set of values (implicit disjunction) of another generalized policy Pm 12 . This is due to the fact that the original policies and the result of their merging are not equivalent in the sense that the original policies are satisfied by the merged policy, but the reverse is not true as the merged policy has combinations of values that cannot be satisfied by the original policies.…”

Section: B Alternate Policy Comparison Strategiesmentioning

confidence: 99%

See 1 more Smart Citation

An Algorithm for Compression of XACML Access Control Policy Sets by Recursive Subsumption

Stepien

Matwin

Felty

2012

2012 Seventh International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Abstract-Policy administrators increasingly face the challenge of managing large policy bases, and this need becomes more acute with the growing importance of fine-grained access control models, e.g. ABAC. We have shown in previous work that simple policies mostly based on conjunctions of single attribute conditions, can be merged into more complex conditions composed of combinations of conjunctions and disjunctions of attribute/value pairs. Here, we propose an algorithm that uses a recursive process of subsumption applied on the original set of policies that results in a complex and short policy, often significantly compressing the original policy. We present this algorithm, and discuss the advantages of this approach, i.e. its performance when working on the policy structures encountered in real-life policy sets, its scalability, and its ability to deal with large alphabet sets.

show abstract

Beyond Scale: An Efficient Framework for Evaluating Web Access Control Policies in the Era of Big Data

Liu

Wang

2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Adaptive Reordering and Clustering-Based Framework for Efficient XACML Policy Evaluation

Cited by 39 publications

References 11 publications

Challenges of Composing XACML Policies

Challenges of Composing XACML Policies

An Algorithm for Compression of XACML Access Control Policy Sets by Recursive Subsumption

Beyond Scale: An Efficient Framework for Evaluating Web Access Control Policies in the Era of Big Data

Contact Info

Product

Resources

About