Policy Decomposition for Evaluation Performance Improvement of PDP

As the need for more pervasive and more complex access controls grows, the challenge of ensuring the performance of access control systems is becoming apparent. Researchers have proposed several solutions to mitigate performance problems, including: adjusting the policy set; re-engineering the policy decision point (PDP); and decomposing the policies and distributing their evaluation. However, since the benefits and tradeoffs depend heavily upon the actual scenario, security administrators typically do not have objective justification for adopting particular mitigation actions. In response, we present the ATLAS framework, comprising: 1) DomainManager , which facilitates modelling the domain as closely as possible and automatically generates large numbers of representative policies and associated requests; 2) STACS , which enables controlled experiments to be performed using the generated policies/requests, to collect comprehensive measurements of PDP performance; and 3) PARPACS , which aids the understanding and worth of the measurement data and, by using rigorous validation techniques, reduces the risk of spurious insights or incorrect recommendations. We present a discussion of ATLAS as applied to an enterprise communication scenario, where access control is realised via XACML PDPs. Notable insights include that the SunXacml 2.0 PDP performs relatively poorly in terms of policy evaluation performance and that adding additional memory and/or processor cores to a XACML PDP server is not guaranteed to improve performance significantly.

An efficient policy evaluation engine for XACML policy management

DistriTrust: Distributed and low-latency access validation in zero-trust architecture

Traditional access control systems often use the extensible access control markup language (XACML), a widely adopted standard for defining and enforcing access control policies. XACML is flexible and compatible with various access control models. It comprises key components such as the Policy Decision Point (PDP), Policy Enforcement Point (PEP), Policy Administration Point (PAP), and Policy Information Point (PIP), which are centrally managed in traditional setups. However, this central management introduces vulnerabilities like Single Point of Failure (SPOF) and other security risks. This research addresses these challenges by proposing a decentralized access control architecture built on Hyperledger Fabric. The design distributes the four core components of XACML— PEP, PDP, PAP, and PIP- across multiple blockchain nodes, eliminating SPOF while enhancing scalability and data integrity. A proof of concept (PoC) implementation is developed to evaluate the system’s performance. The architecture and PoC are analyzed against predefined threats and requirements, demonstrating how the system delivers a secure, scalable, and resilient access control solution.

Most prior research on policies has focused on correctness. While correctness is an important issue, the adoption of policy-based computing may be limited if the resulting systems are not implemented efficiently and thus perform poorly. To increase the effectiveness and adoption of policy-based computing, in this paper, we propose fast policy evaluation algorithms that can be adapted to support various policy languages. In this paper, we focus on XACML policy evaluation because XACML has become the de facto standard for specifying access control policies, has been widely used on web servers, and is most complex among existing policy languages. We implemented our algorithms in a policy evaluation system called XEngine and conducted side-by-side comparison with Sun Policy Decision Point (PDP), the industrial standard for XACML policy evaluation. The results show that XEngine is orders of magnitude faster than Sun PDP. The performance difference grows almost linearly with the number of rules in an XACML policy. To our best knowledge, there is no prior work on improving XACML policy evaluation performance. This paper represents the first step in exploring this unknown space.

As distributed applications increase in size and complexity, traditional authorization mechanisms based on a single policy decision point are increasingly fragile because this decision point represents a single point of failure and a performance bottleneck. Authorization recycling is one technique that has been used to address these challenges. This paper introduces and evaluates the mechanisms for authorization recycling in RBAC enterprise systems. The algorithms that support these mechanisms allow precise and approximate authorization decisions to be made, thereby masking possible failures of the policy decision point and reducing its load. We evaluate these algorithms analytically and using a prototype implementation. Our evaluation results demonstrate that authorization recycling can improve the performance of distributed access control mechanisms.

This article describes a privacy policy framework that can represent and reason about complex privacy policies. By using a Common Data Model together with a formal shareability theory, this framework enables the specification of expressive policies in a concise way without burdening the user with technical details of the underlying formalism. We also build a privacy policy decision engine that implements the framework and that has been deployed as the policy decision point in a novel enterprise privacy prototype system. Our policy decision engine supports two main uses: (1) interfacing with user interfaces for the creation, validation, and management of privacy policies; and (2) interfacing with systems that manage data requests and replies by coordinating privacy policy engine decisions and access to (encrypted) databases using various privacy enhancing technologies.

In modern pervasive applications, it is important to validate access control mechanisms that are usually defined by means of the standard XACML language. Mutation analysis has been applied on access control policies for measuring the adequacy of a test suite. In this paper, we present a testing framework aimed at applying mutation analysis at the level of the Java based policy evaluation engine. A set of Java based mutation operators is selected and applied to the code of the Policy Decision Point (PDP). A first experiment shows the effectiveness of the proposed framework in assessing the fault detection of XACML test suites and confirms the efficacy of the application of code-based mutation operators to the PDP.

Policy-based computing is taking an increasing role in governing the systematic interaction among distributed cloud and Web services.XACML has been known as the de facto standard widely used by many vendors for specifying access control policies.Accordingly, the size and complexity of XACML policies are significantly growing to cope with the evolution of webbased applications.This growth raised many concerns related to the efficiency of real-time decision process (i.e. policy evaluation) and the correctness of complex policies.This thesis is addressing both concerns through the elaboration of SBA-XACML, a novel set-based scheme that provides efficient evaluation and analysis of XACML policies.To the best of our knowledge, we are the first addressing both problems simultaneously.Our approach constitutes of elaborating (1) set-based language that covers all the XACML components and establish an intermediate layer to which policies are automatically converted, (2) policy evaluation module that provides better performance compared to the industrial standard Sun Policy Decision Point (PDP) and its corresponding ameliorations, and (3) policy analysis module that allows to detect flaws, conflicts and redundancies in XACML policies.Formal and practical experiments have been conducted on real-life and synthetic XACML policies in order to demonstrate the efficiency, relevance and scalability of our proposition.The experimental results explore that SBA-XACML evaluation of large and small sizes policies offers better performance than the current approaches, by a factor ranging between 2.4 and 15 times faster depending on policy size.Moreover, they show how SBA-XACML analysis module allows detecting access flaws, conflict and redundancy at policy and rule levels.

Future mobile networks are anticipated to have support to access heterogeneous access technologies. An important question in such environments is the decisions on when to use what access network. These decisions must take the users and mobile network operators’ perspectives into consideration. The operators usually have a focus of always-best-managed networks while the users have an always-best-connected focus. A key enabler of such environments is the use of policies to perform these handover decisions. These policies, which must be dynamic in nature, should be configurable when the requirements change. Policy decisions are always made based on the current context of mobile networks. Context information refers to static and dynamic information about mobile networks. Networking Context Aware Policy Environment (NetCAPE) is a policy based mobility management architecture for such mobile networks. NetCAPE is based on the policy framework defined by the IETF and DMTF. It consists of Policy Decision Points (PDPs), Policy Enforcement Points (PEPs) and meters that work together to make decisions based on the regulatory, operator and user policies. The PDPs make decisions using the policies defined in the policy repository and the context information in context repositories. The context information is built by the meters distributed in the mobile networks. Decisions are finally executed by the PEPs that control different network elements of mobile networks. The work in this thesis consists of defining this new architecture (NetCAPE), detailing the operations and mechanisms its constituent components, implementing it and evaluating its performance against a non-NetCAPE based environment.

We describe how to control the cumulative use of distributed grid resources by using coordination‐aware policy decision points (coordinated PDPs) and an SQL database to hold ‘coordination’ data. When access to a resource is granted, obligations in the security policy ensure that the coordination database is updated. The coordination database is a normal grid service providing distributed access to the coordinated PDPs. Access to the databases is secured by the grid security infrastructure (GSI) and its own PDP, so that only authorized users (the coordinated PDPs) can access it. A coordinated PDP is imbedded into the Globus Toolkitv4 authorization chain as a custom PDP so that any grid service can be protected by a security policy that provides a coordination capability. Each coordinated PDP uses the services of an uncoordinated PDP to make its access control decisions, so that any existing stateless PDP can be supplemented with a coordination capability. We provide performance results for the coordinated PDPs and compare these with two stateless PDPs. Virtually the entire performance penalty of using coordinated PDPs is accounted for by the heavy costs of using GSI to secure communications between the coordinated PDPs and the coordination database. Copyright © 2007 John Wiley & Sons, Ltd.

Authorization systems are an integral part of any network where resources need to be protected. They act as the gateway for providing (or denying) subjects (users) access to resources. As networks expand and organisations start to federate access to their resources, authorization infrastructures become increasingly difficult to manage. In this paper, we explore the potential of self-adaptive authorization as a means to automate the management of the access control configuration. We propose a Self-Adaptive Authorization Framework (SAAF) that is capable of managing any policy based distributed RBAC/ABAC authorization infrastructure. SAAF relies on a feedback control loop to monitor decisions (by policy decision points) of a target authorization infrastructure. These decisions are analysed to form a view of the subject's behaviour to decide whether to adapt the target authorization infrastructure. Adaptations are made in order to either endorse or restrict the identified behaviour, e.g. by loosening or tightening the current authorization policy. We demonstrate in terms of representative scenarios SAAF's ability for detecting abnormal behaviour, such as, misuse of access to system resources, proposing solutions that either prevent/endorse such behaviour, applying a cost function to each of these solutions, and executing the adaptive changes against a target authorization infrastructure.

Real-time collaborative Web applications allow a multitude of users to concurrently work on a shared document. Especially in business contexts it is often necessary to be able to precisely define and restrict who is allowed to edit which data field of such a shared document. Existing solutions for enforcing such access control restrictions typically rely on a central service, the policy decision point. However, for use cases with unreliable or limited connectivity, such as mobile devices, a permanent connection to this centralized policy decision point can not be guaranteed. To address this problem, we present a novel approach that includes methods for client-side enforcement of access control constraints for offline users, and merging of offline changes, that enables users to edit such access constrained shared documents offline. We propose a generic conflict detection and resolution approach that attempts to resolve merge conflicts that are inherent to access constrained documents automatically while prioritizing online users and maximizing the number of filled out data fields in a document. In addition, we discuss and evaluate our approach via a prototype implementation.

Policy Based Network Management (PBNM) for network security has been paid much attention as a solution to consistent and unified management of security systems including IDS (Intrusion Detection System) and Firewall. In this paper, we define NSPIM (Network Security Policy Information Model) as a framework of representation, edition, store, and reuse of policies for intrusion detection and response in the PBNM. NSPIM forces each component of PBNM for network security to be flexible and extensible. NSPIM induces the operational structure of PMT (Policy Management Tool) and the data schema of PR (Policy Repository). In addition, policy provisioning objects between PDP (Policy Decision Point) and PEP (Policy Enforcement Point) can be defined based on NSPIM.

Access control policies are increasingly written in specification languages such as XACML. To increase confidence in the correctness of specified policies, policy developers can conduct policy testing to probe the Policy Decision Point (PDP) with some typical test inputs (in the form of requests) and check test outputs (in the form of responses) against expected ones. Unfortunately, manual test generation is tedious and manually generated tests are often not sufficient to exercise various policy behaviors. In this paper we present an efficient test generation approach and its supporting tool called Targen. We further reduce the number of generated requests based on structural coverage information to facilitate manual inspection. If a rule is unreachable due to an unsatisfiable set of constraints, it is redundant. We also present an approach for redundant-rule detection based on change-impact analysis and its supporting tool call Cirg. We have evaluated Targen on policies collected from various sources, some of which are complex policies being used in real systems. Our results show that Targen can effectively generate tests to achieve high structural coverage of policies and outperforms the existing random test generation in terms of structural coverage and fault-detection capability. Cirg can identify a large number of redundant rules among rules defined in a complex, real policy.