Statistics & clustering based framework for efficient XACML policy evaluation

Said Marouf, Mohamed Shehab, Anna Squicciarini, Smitha Sundareswaran

Research output: Chapter in Book/Report/Conference proceedingConference contribution

11 Scopus citations

Abstract

The adoption of XACML as the standard for specifying access control policies for various applications, especially web services is vastly increasing. A policy evaluation engine can easily become a bottleneck when enforcing large policies. In this paper we propose an adaptive approach for XACML policy optimization. We proposed a clustering technique that categorizes policies and rules within a policy set and policy respectively in respect to target subjects. Furthermore, we propose a usage based framework that computes access request statistics to dynamically optimize the ordering of policies within a policy set and rules within a policy. Reordering is applied to categorized policies and rules from our proposed clustering technique. To evaluate the performance of our framework, we conducted extensive experiments on XACML policies. We evaluated separately the improvement due to categorization and to reordering techniques, in order to assess the policy sets targeted by our techniques. The experimental results show that our approach is orders of magnitude more efficient than the standard Sun PDP.

Original languageEnglish (US)
Title of host publicationProceedings - 2009 IEEE International Symposium on Policies for Distributed Systems and Networks, POLICY 2009
Pages118-125
Number of pages8
DOIs
StatePublished - 2009
Event2009 IEEE International Symposium on Policies for Distributed Systems and Networks, POLICY 2009 - London, United Kingdom
Duration: Jul 20 2009Jul 22 2009

Other

Other2009 IEEE International Symposium on Policies for Distributed Systems and Networks, POLICY 2009
CountryUnited Kingdom
CityLondon
Period7/20/097/22/09

All Science Journal Classification (ASJC) codes

  • Computer Networks and Communications
  • Computer Science Applications
  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'Statistics & clustering based framework for efficient XACML policy evaluation'. Together they form a unique fingerprint.

  • Cite this

    Marouf, S., Shehab, M., Squicciarini, A., & Sundareswaran, S. (2009). Statistics & clustering based framework for efficient XACML policy evaluation. In Proceedings - 2009 IEEE International Symposium on Policies for Distributed Systems and Networks, POLICY 2009 (pp. 118-125). [5197395] https://doi.org/10.1109/POLICY.2009.36