TY - GEN
T1 - Refactoring access control policies for performance improvement
AU - El Kateb, Donia
AU - Mouelhi, Tejeddine
AU - Le Traon, Yves
AU - Hwang, Jeehyun
AU - Xie, Tao
PY - 2012
Y1 - 2012
N2 - In order to facilitate managing authorization, access control architectures are designed to separate the business logic from an access control policy. To determine whether a user can access which resources, a request is formulated from a component, called a Policy Enforcement Point (PEP) located in application code. Given a request, a Policy Decision Point (PDP) evaluates the request against an access control policy and returns its access decision (i.e., permit or deny) to the PEP. With the growth of sensitive information for protection in an application, an access control policy consists of a larger number of rules, which often cause a performance bottleneck. To address this issue, we propose to refactor access control policies for performance improvement by splitting a policy (handled by a single PDP) into its corresponding multiple policies with a smaller number of rules (handled by multiple PDPs). We define seven attribute-set-based splitting criteria to facilitate splitting a policy. We have conducted an evaluation on three subjects of reallife Java systems, each of which interacts with access control policies. Our evaluation results show that (1) our approach preserves the initial architectural model in terms of interaction between the business logic and its corresponding rules in a policy, and (2) our approach enables to substantially reduce request evaluation time for most splitting criteria.
AB - In order to facilitate managing authorization, access control architectures are designed to separate the business logic from an access control policy. To determine whether a user can access which resources, a request is formulated from a component, called a Policy Enforcement Point (PEP) located in application code. Given a request, a Policy Decision Point (PDP) evaluates the request against an access control policy and returns its access decision (i.e., permit or deny) to the PEP. With the growth of sensitive information for protection in an application, an access control policy consists of a larger number of rules, which often cause a performance bottleneck. To address this issue, we propose to refactor access control policies for performance improvement by splitting a policy (handled by a single PDP) into its corresponding multiple policies with a smaller number of rules (handled by multiple PDPs). We define seven attribute-set-based splitting criteria to facilitate splitting a policy. We have conducted an evaluation on three subjects of reallife Java systems, each of which interacts with access control policies. Our evaluation results show that (1) our approach preserves the initial architectural model in terms of interaction between the business logic and its corresponding rules in a policy, and (2) our approach enables to substantially reduce request evaluation time for most splitting criteria.
KW - Access control
KW - EXtensible access control markup language
KW - Performance
KW - Policy decision point
KW - Policy enforcement point
KW - Refactoring
UR - http://www.scopus.com/inward/record.url?scp=84861043720&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84861043720&partnerID=8YFLogxK
U2 - 10.1145/2188286.2188346
DO - 10.1145/2188286.2188346
M3 - Conference contribution
AN - SCOPUS:84861043720
SN - 9781450312028
T3 - ICPE'12 - Proceedings of the 3rd Joint WOSP/SIPEW International Conference on Performance Engineering
SP - 323
EP - 334
BT - ICPE'12 - Proceedings of the 3rd Joint WOSP/SIPEW International Conference on Performance Engineering
T2 - 3rd Joint WOSP/SIPEW International Conference on Performance Engineering, ICPE'12
Y2 - 22 April 2012 through 25 April 2012
ER -