An experimental testbed to predict the performance of XACML Policy Decision Points

摘要: The performance and scalability of access control systems is a growing concern as organisations deploy ever more complex communications content management systems. This paper describes how an (offline) experimental testbed may be used to address concerns. To begin, timing measurements are collected from server component incorporating the Policy Decision Point (PDP) under test, using representative policies corresponding requests. Our experiments with two XACML PDP implementations show that measured request service times typically clustered by type; thus algorithm for cluster identification presented. Cluster characterisations inputs model given policy/request mix analytic (queueing) estimate equilibrium load different mixes clusters. prediction validated extended discrete event simulation subject additional load. These predictive models enable network administrators explore capacity overall loadings (requests per unit time) profiles (relative frequencies)