Managing XACML systems in distributed environments through Meta-Policies

Díaz-López, Daniel; Dólera-Tormo, Ginés; Mármol, Félix Gómez; Martinez-Perez, Gregorio

doi:10.1016/j.cose.2014.10.004

Cited by 12 publications

(4 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Wang et al 17 analyze topological characteristics of different policies and apply a greedy algorithm to divide a policy set into multiple subsets, making them suitable for distributed systems. Daniel et al 18 redefine a default XACML architecture, such that the PAP can effectively manage policy sets belonging to the XACML architecture. Deng et al 19 make a policy decomposition technology based on an ant colony algorithm, which decomposes a policy set into multiple subpolicies, so as to reduce the cost of policy deployment.…”

Section: Distributed Authorization Systemsmentioning

confidence: 99%

An efficient density peak cluster algorithm for improving policy evaluation performance

Yan

Fan

et al. 2022

Sci Rep

View full text Add to dashboard Cite

In recent years, the XACML (eXtensible Access Control Markup Language) is widely used in a variety of research fields, especially in access control. However, when policy sets defined by the XACML become large and complex, the policy evaluation time increases significantly. In order to improve policy evaluation performance, we propose an optimization algorithm based on the DPCA (Density Peak Cluster Algorithm) to improve the clustering effect on large-scale complex policy sets. Combined with this algorithm, an efficient policy evaluation engine, named DPEngine, is proposed to speed up policy matching and reduce the policy evaluation time. We compare the policy evaluation time of DPEngine with the Sun PDP, HPEngine, XEngine and SBA-XACML. The experiment results show that (1) when the number of requests reaches 10,000, the DPEngine evaluation time on a large-scale policy set with 100,000 rules is approximately 2.23%, 3.47%, 3.67% and 4.06% of that of the Sun PDP, HPEngine, XEngine and SBA-XACML, respectively and (2) as the number of requests increases, the DPEngine evaluation time grows linearly. Compared with other policy evaluation engines, the DPEngine has the advantages of efficiency and stability.

show abstract

Section: Distributed Authorization Systemsmentioning

confidence: 99%

An efficient density peak cluster algorithm for improving policy evaluation performance

Yan

Fan

et al. 2022

Sci Rep

View full text Add to dashboard Cite

show abstract

“…However, the simple string-based method is unable to solve naming heterogeneity in a distributed environment since we cannot expect that policies belonging to different organizations are based on the same vocabulary. Nevertheless, there are also works such as [2,[31][32][33][34][35][36][37][38][39][40] that made attempts to improve the policy decision point (PDP) evaluation performance with regard to evaluation time by grouping/clustering the whole rule set into several subsets; hence, resolving the issue of semantic interoperability is not part of their solutions. Meanwhile, our work focuses on the effectiveness of a policy evaluation engine in which accuracy is the main measurement used.…”

Section: Related Workmentioning

confidence: 99%

An Effective Naming Heterogeneity Resolution for XACML Policy Evaluation in a Distributed Environment

et al. 2021

View full text Add to dashboard Cite

Policy evaluation is a process to determine whether a request submitted by a user satisfies the access control policies defined by an organization. Naming heterogeneity between the attribute values of a request and a policy is common due to syntactic variations and terminological variations, particularly among organizations of a distributed environment. Existing policy evaluation engines employ a simple string equal matching function in evaluating the similarity between the attribute values of a request and a policy, which are inaccurate, since only exact match is considered similar. This work proposes several matching functions which are not limited to the string equal matching function that aim to resolve various types of naming heterogeneity. Our proposed solution is also capable of supporting symmetrical architecture applications, in which the organization can negotiate with the users for the release of their resources and properties that raise privacy concerns. The effectiveness of the proposed matching functions on real XACML policies, designed for universities, conference management, and the health care domain, is evaluated. The results show that the proposed solution has successfully achieved higher percentages of Recall and F-measure compared with the standard Sun’s XACML implementation, with our improvement, these measures gained up to 70% and 57%, respectively.

show abstract

“…Meta policy is short for management meta policy. And in the next of this paper meta policy [9] represents management meta policy. The way of using meta policies has many advantages.…”

Section: Policy Levelsmentioning

confidence: 99%

A Security Policy Description Language for Distributed Policy Self-management

Ma¹,

Yang²,

Wang³

2015

Proceedings of the 4th International Conference on Mechatronics, Materials, Chemistry and Computer Engineering 2015

View full text Add to dashboard Cite

The existing security policy description languages can't support distributed policy self-management and have some problems in the aspect of describing capability, extensibility, portability and other issues. Against these problems, this paper proposes a security policy description language SPDL for distributed policy self-management. SPDL uses XML Schema to define basic elements and grammatical structure of the policy. And it uses XML to complete the policy configuration. It uses meta policy to realize distributed policy self-management. Finally, this paper gives an analysis of the characteristics and advantages of SPDL comparing with other policy languages.

show abstract

Managing XACML systems in distributed environments through Meta-Policies

Cited by 12 publications

References 3 publications

An efficient density peak cluster algorithm for improving policy evaluation performance

An efficient density peak cluster algorithm for improving policy evaluation performance

An Effective Naming Heterogeneity Resolution for XACML Policy Evaluation in a Distributed Environment

A Security Policy Description Language for Distributed Policy Self-management

Contact Info

Product

Resources

About