CAREER: Towards High Performance Policy Evaluation

该奖项是根据2009年美国复苏和再投资法案（公法111-5）资助的。基于策略的计算是许多大规模可配置系统的关键组件，因为它通过更改策略配置来实现系统行为的动态适应性，而无需对系统进行重新编程。策略评估，即检查请求是否满足策略的过程，通常是基于策略的系统的性能瓶颈。大多数先前的研究都集中在策略的正确性（即规范、设计和分析）上。虽然正确性是一个重要的问题，但是如果得到的系统没有得到有效的实现，从而表现不佳，那么基于策略的计算的采用可能会受到限制。该项目的高级研究目标是通过设计高性能的策略评估算法和引擎来提高基于策略的计算的有效性和采用率，这些算法和引擎可以适应各种策略语言。这个项目的主要焦点是安全策略的快速评估，这是最普遍的。为了加快政策评估的速度，本研究采用了两种独特的方法：政策规范化和规范化策略表示。策略规范化的思想是将具有复杂逻辑结构的策略转换为具有简单逻辑结构的等价策略。规范策略表示的思想是将给定的策略转换为规范形式。在此工作中开发的技术将在本项目之外发挥作用。通过增加基于策略的计算的采用，其结果将极大地造福社会。为了促进教育和学习，这项努力积极吸引高中生、本科生、研究生，特别是来自少数民族的学生。

This award is funded under the American Recovery and Reinvestment Act of 2009 (Public Law 111-5).Policy-based computing is a critical component of many large-scale configurable systems because it enables dynamic adaptability of system behavior by changing policy configurations without reprogramming the systems. Policy evaluation, the process of checking whether a request satisfies a policy, is typically the performance bottleneck of policy-based systems. Most prior research has focused on the correctness (i.e., specification, design, and analysis) of policies. While correctness is an important issue, the adoption of policy-based computing may be limited if the resulting systems are not implemented efficiently and thus perform poorly. The high-level research objective of this project is to increase the effectiveness and adoption of policy-based computing by designing high performance policy evaluation algorithms and engines that can be adapted to support various policy languages. The primary focus of this project is the fast evaluation of security policies, which are most prevalent. To speed up policy evaluation, this research uses two unique approaches: policy normalization and canonical policy representation. The idea of policy normalization is to convert a policy with a complex logical structure to an equivalent policy with a simple logical structure. The idea of canonical policy representation is to convert a given policy to its canonical form. The techniques developed in this effort will be useful beyond this project. The results will greatly benefit society by increasing the adoption of policy-based computing. To promote education and learning, this effort actively involves high school, undergraduate, graduate students, especially students from under-represented minorities.