Graph-based XACML evaluation
Graph-based XACML evaluation
复制标题
DOI：
10.1145/2295136.2295153
复制
发表时间：
2012-06
期刊：
影响因子：
--
通讯作者：
Santiago Pina Ros;Mario Lischka;Félix Gómez Mármol
中科院分区：
文献类型：
--
作者：
Santiago Pina Ros;Mario Lischka;Félix Gómez Mármol
随着云计算和社交网络的爆炸式增长，互联网中的私人信息量不断增加。XACML是为Web服务指定访问控制策略的最重要的标准之一。XACML策略的数量增长非常快，评估处理时间也变得更长。XEngine方法建议根据目标部分中使用的属性重新排列匹配树，但出于速度原因，它们只支持属性值相等。对于快速终止，组合算法被转换成第一可应用策略，其不正确地支持义务。在我们的方法中，XACML中定义的所有比较函数以及义务都得到了支持。本文提出了一种基于两种树结构的XACML策略评估优化方法。第一个称为匹配树，用于快速搜索适用的规则。第二个称为组合树，用于评估适用的规则。最后，提出了一种基于二分查找算法的匹配树搜索方法。实验结果表明，我们的方法是数量级优于Sun PDP。
The amount of private information in the Internet is constantly increasing with the explosive growth of cloud computing and social networks. XACML is one of the most important standards for specifying access control policies for web services. The number of XACML policies grows really fast and evaluation processing time becomes longer. The XEngine approach proposes to rearrange the matching tree according to the attributes used in the target sections, but for speed reasons they only support equality of attribute values. For a fast termination the combining algorithms are transformed into a first applicable policy, which does not support obligations correctly. In our approach all comparison functions defined in XACML as well as obligations are supported. In this paper we propose an optimization for XACML policies evaluation based on two tree structures. The first one, called Matching Tree, is created for a fast searching of applicable rules. The second one, called Combining Tree, is used for the evaluation of the applicable rules. Finally, we propose an exploring method for the Matching Tree based on the binary search algorithm. The experimental results show that our approach is orders of magnitude better than Sun PDP.