Refactoring access control policies for performance improvement
Refactoring access control policies for performance improvement
复制标题
DOI：
10.1145/2188286.2188346
复制
发表时间：
2012-04
期刊：
影响因子：
--
通讯作者：
Donia El Kateb;Tejeddine Mouelhi;Y. L. Traon;JeeHyun Hwang;Tao Xie
中科院分区：
文献类型：
--
作者：
Donia El Kateb;Tejeddine Mouelhi;Y. L. Traon;JeeHyun Hwang;Tao Xie
为了便于管理授权，访问控制体系结构被设计为将业务逻辑与访问控制策略分离。为了确定用户是否可以访问哪些资源，从位于应用程序代码中的称为策略执行点（PEP）的组件制定请求。给定请求，策略决策点（PDP）针对访问控制策略评估请求并返回其访问决策（即，或否认，或否认。随着应用程序中需要保护的敏感信息的增长，访问控制策略由大量规则组成，这往往会导致性能瓶颈。为了解决这个问题，我们建议通过将策略（由单个PDP处理）拆分为其相应的多个具有较少规则数量的策略（由多个PDP处理）来重构访问控制策略以提高性能。我们定义了七个基于属性集的拆分标准，以方便拆分策略。我们已经进行了评估的三个主题的现实生活中的Java系统，其中每一个相互作用的访问控制策略。我们的评估结果表明，（1）我们的方法保留了初始架构模型的业务逻辑和策略中相应的规则之间的交互，（2）我们的方法能够大大减少大多数拆分标准的请求评估时间。
In order to facilitate managing authorization, access control architectures are designed to separate the business logic from an access control policy. To determine whether a user can access which resources, a request is formulated from a component, called a Policy Enforcement Point (PEP) located in application code. Given a request, a Policy Decision Point (PDP) evaluates the request against an access control policy and returns its access decision (i.e., permit or deny) to the PEP. With the growth of sensitive information for protection in an application, an access control policy consists of a larger number of rules, which often cause a performance bottleneck. To address this issue, we propose to refactor access control policies for performance improvement by splitting a policy (handled by a single PDP) into its corresponding multiple policies with a smaller number of rules (handled by multiple PDPs). We define seven attribute-set-based splitting criteria to facilitate splitting a policy. We have conducted an evaluation on three subjects of real-life Java systems, each of which interacts with access control policies. Our evaluation results show that (1) our approach preserves the initial architectural model in terms of interaction between the business logic and its corresponding rules in a policy, and (2) our approach enables to substantially reduce request evaluation time for most splitting criteria.