Poliseek: A Fast XACML Policy Evaluation Engine Using Dimensionality Reduction and Characterized Search

Abstract

Due to evaluation performance limits and compatibility problems with PDP (Policy Decision Point) in practical information systems, some established schemes have limits in handling massive complex requests. To address the existing challenges of fast rule match on interval values, we propose a novel policy evaluation engine, namely Poliseek with three desired modules. A preprocessing module of Poliseek is equipped with a static encoding strategy and converts the XACML rules and requests into four-dimensional numeric vectors in an attribute space. Owing to a novel optimization object of minimizing interval collisions, a dimensionality reducer and diffuser module can generate candidate values related to each rule vector in the identification space. These values and requests are handled by a fast policy evaluation module using well-constructed hash buckets and a characterized search algorithm. The experimental results show that if the number of requests reaches 10,000, Poliseek can find the target rule approximately 1090, 15, and 15 times faster than the Sun PDP, XEngine, and SBA-XACML, respectively. Poliseek also offers a fast evaluation progress of handling 10,000 complex policy rules with interval attribute values in 275.9 ms, which shows its strong robustness and practicality.