Automated xacml policy reconfiguration for evaluation optimisation

Abstract

We present a programmatic approach to the optimisation of XACML policies that specifies how a set of access control rules should be best represented for optimised evaluation. The work assumes no changes to the current XACML specification and methods of interpretation shall be made, so that those who consume XACML are unaffected structurally, and those that generate XACML can provide optimised output. Discussion regarding the flexibility of the XACML specification to describe the same access rules with different policy configurations is presented, and is used to formulate a comprehensive analysis of the evaluation costs the possible policy configurations will produce. This leads to the specification of methods that can be employed to produce optimal forms of policy description. These are implemented and evaluated to show the benefits of the approach proposed.

Challenges of Composing XACML Policies

“…If any of these structural elements is not satisfied, it prevents the evaluation of elements that are further down in the hierarchy. A description of this process and its resulting savings in terms of computation costs is provided in [7].…”

“…As has already been mentioned in [7], there are cases where the principle of hierarchical structures of decision trees does not avoid searching all the rules of a policy or at least some of its subtrees. Effectively, the efficiency of this process can depend on the distribution of logic expressed as match expressions on attributes among these structural elements.…”

“…• Vertical re-ordering, consisting of redistributing logic among hierarchical partitioning blocks including changing the configuration of these blocks entirely [7] [9]. For example interchanging the logic contained in a rule target with one of its parent policies, or even further upstream targets of policy set parents.…”

“…A manual optimization could be complex. An illustration of these challenges can be derived from [7]. Effectively they propose an algorithm for computing performance of various randomly or manually restructured policy sets.…”

“…• Step 6: compute the total cost of request processing of the compressed policies using the algorithm proposed in [7]. • Step 7: repeat step 2 to 5 using a different order in the sequence of attribute conditions of traces as a best-first search heuristic.…”