An approach to evaluate policy similarity

Abstract

Recent collaborative applications and enterprises very often need to efficiently integrate their access control policies. An important step in policy integration is to analyze the similarity of policies. Existing approaches to policy similarity analysis are mainly based on logical reasoning and boolean function comparison. Such approaches are computationally expensive and do not scale well for large heterogeneous distributed environments (like Grid computing systems). In this paper, we propose a policy similarity measure as a filter phase for policy similarity analysis. This measure provides a lightweight approach to pre-compile a large amount of policies and only return the most similar policies for further evaluation. In the paper we formally define the measure, by taking into account both the case of categorical attributes and numeric attributes. Detailed algorithms are presented for the similarly computation. Results of our case study demonstrates the efficiency and practical value of our approach.

On harnessing information models and ontologies for policy conflict analysis

“…An exception is Al-Shaer et al (2005); however, the approach they present is described specically for rewall policy conict and the performance of the algorithm is not presented. Another exception is the work on policy similarity carried out by Lin et al (2007), who introduce a ltering step to eliminate policies from being considered for further expensive analysis.…”

“…Determining the similarity of policies can aid in the policy conict analysis between policies deployed to dierent management domains, as Lin et al (2007) demonstrate. They propose to use policy similarity algorithms as a fast check to determine how similar two policies are, so that policies can be rapidly eliminated from more extensive policy analysis.…”

“…There are also no standards for representing policies in an ontology, although there has been considerable eorts in this direction. This issue may be overcome by using the semantic mapping capabilities of ontologies as discussed by Lin et al (2007); Cridlig et al (2007), however there is currently no standard way of transforming between policy languages.…”

“…Other research, conducted by Lin et al (2007), discusses the complexity associated to establishing a similarity factor between two policies. They present an algorithm that can readily establish how similar two policies are, by examining the respective policy components of each policy.…”

“…Van der Meer et al (2005) investigated the use of ontologies to aid in policy mobility, where ontologies aid in using policies between management domains. As presented by Verlaenen et al (2007a) and Lin et al (2007), ontologies can be used extensively in other policy based management processes, such as similarity matching between policies and the integration of policy languages.…”