An experimental testbed to predict the performance of XACML policy decision points

Bernard Butler, Brendan Jennings, Dmitri Botvich

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

7 Citations (Scopus)

Abstract

The performance and scalability of access control systems is a growing concern as organisations deploy ever more complex communications and content management systems. This paper describes how an (offline) experimental testbed may be used to address performance concerns. To begin, timing measurements are collected from a server component incorporating the Policy Decision Point (PDP) under test, using representative policies and corresponding requests. Our experiments with two XACML PDP implementations show that measured request service times are typically clustered by request type; thus an algorithm for request cluster identification is presented. Cluster characterisations are used as inputs to a PDP performance model for a given policy/request mix and an analytic (queueing) model is used to estimate the equilibrium server load for different mixes of request clusters. The analytic performance prediction model is validated and extended by discrete event simulation of a PDP subject to additional load. These predictive models enable network administrators to explore the capacity of the PDP for different overall loadings (requests per unit time) and profiles (relative frequencies) of requests.

Original languageEnglish
Title of host publicationProceedings of the 12th IFIP/IEEE International Symposium on Integrated Network Management, IM 2011
Pages353-360
Number of pages8
DOIs
Publication statusPublished - 2011
Event12th IFIP/IEEE International Symposium on Integrated Network Management, IM 2011 - Dublin, Ireland
Duration: 23 May 201127 May 2011

Publication series

NameProceedings of the 12th IFIP/IEEE International Symposium on Integrated Network Management, IM 2011

Conference

Conference12th IFIP/IEEE International Symposium on Integrated Network Management, IM 2011
Country/TerritoryIreland
CityDublin
Period23/05/201127/05/2011

Fingerprint

Dive into the research topics of 'An experimental testbed to predict the performance of XACML policy decision points'. Together they form a unique fingerprint.

Cite this