Designing fast and scalable XACML policy evaluation engines

A. X. Liu, Fei Chen, Jeehyun Hwang, Tao Xie

Research output: Contribution to journalArticle

Abstract

Most prior research on policies has focused on correctness. While correctness is an important issue, the adoption of policy-based computing may be limited if the resulting systems are not implemented efficiently and thus perform poorly. To increase the effectiveness and adoption of policy-based computing, in this paper, we propose fast policy evaluation algorithms that can be adapted to support various policy languages. In this paper, we focus on XACML policy evaluation because XACML has become the de facto standard for specifying access control policies, has been widely used on web servers, and is most complex among existing policy languages. We implemented our algorithms in a policy evaluation system called XEngine and conducted side-by-side comparison with Sun Policy Decision Point (PDP), the industrial standard for XACML policy evaluation. The results show that XEngine is orders of magnitude faster than Sun PDP. The performance difference grows almost linearly with the number of rules in an XACML policy. To our best knowledge, there is no prior work on improving XACML policy evaluation performance. This paper represents the first step in exploring this unknown space.

Original languageEnglish (US)
Article number5674020
Pages (from-to)1802-1817
Number of pages16
JournalIEEE Transactions on Computers
Volume60
Issue number12
DOIs
StatePublished - Dec 1 2011
Externally publishedYes

Keywords

  • Web servers
  • XACML
  • access control
  • policy decision point
  • policy evaluation
  • policy-based computing

ASJC Scopus subject areas

  • Software
  • Theoretical Computer Science
  • Hardware and Architecture
  • Computational Theory and Mathematics

Fingerprint Dive into the research topics of 'Designing fast and scalable XACML policy evaluation engines'. Together they form a unique fingerprint.

  • Cite this