Measurement and Prediction of Access Control Policy Evaluation Performance

摘要: As the need for more pervasive and complex access controls grows, challenge of ensuring performance control systems is becoming apparent. Researchers have proposed several solutions to mitigate problems, including: adjusting policy set; re-engineering decision point (PDP); decomposing policies distributing their evaluation. However, since benefits tradeoffs depend heavily upon actual scenario, security administrators typically do not objective justification adopting particular mitigation actions. In response, we present ATLAS framework, comprising: 1) DomainManager , which facilitates modelling domain as closely possible automatically generates large numbers representative associated requests; 2) STACS enables controlled experiments be performed using generated policies/requests, collect comprehensive measurements PDP performance; 3) PARPACS aids understanding worth measurement data and, by rigorous validation techniques, reduces risk spurious insights or incorrect recommendations. We a discussion applied an enterprise communication where realised via XACML PDPs. Notable include that SunXacml 2.0 performs relatively poorly in terms evaluation adding additional memory and/or processor cores server guaranteed improve significantly.