Idea: Efficient Evaluation of Access Control Constraints

Abstract

Business requirements for modern enterprise systems usually comprise a variety of dynamic constraints, i. e., constraints that require a complex set of context information only available at runtime. Thus, the efficient evaluation of dynamic constraints, e. g., expressing separation of duties requirements, becomes an important factor for the overall performance of the access control enforcement.In distributed systems, e. g., based on the service-oriented architecture (SOA), the time for evaluating access control constraints depends significantly on the protocol between the central Policy Decision Point (PDP) and the distributed Policy Enforcement Points (PEPs).In this paper, we present a policy-driven approach for generating customized protocol for the communication between the PDP and the PEPs. We provide a detailed comparison of several approaches for querying context information during the evaluation of access control constraints.

Introducing concurrency in policy-based access control

“…Other possible tactics are (i) introducing caching as explored by Wei et al [15] and (ii) optimizing attribute fetch, an idea first posed by by Brucker and Petritsch [5] and further explored by Gheorghe et al [8] and Decat et al [6]. Finally, an important building block for this paper was the work by Turkmen et al [14], who presented one of the first extensive performance evaluations of XACML evaluation engines.…”

XACML Policy Evaluation with Dynamic Context Handling

“…Our work is different in that it does not dynamically update the original policy definitions, but implicitly incorporate context into rule evaluation. Brucker and Petritsch [12] enhanced the context handling protocol used in XACML, but they focus on the efficiency of attribute resolution strategies either via the PIP or the XACML context handler.…”

Middleware for efficient and confidentiality-aware federation of access control policies

“…This work builds upon the idea of improving policy evaluation performance by focusing on attribute fetching, as first introduced by Brucker and Petritsch [25]. Policy federation can be complemented with the work of several other authors, e.g., Wei et al [26], who focus on decision caching and Gheorghe et al [27], who focus on infrastructure reconfiguration for optimal attribute retrieval and cross-request attribute caching.…”