On the performance of access control policy evaluation

Leigh Griffin, Bernard Butler, Eamonn De Leastar, Brendan Jennings, Dmitri Botvich

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

12 Citations (Scopus)

Abstract

There is growing awareness of the need to protect digital resources and services in both corporate and home ICT scenarios. Meanwhile, communication tools tailored for corporations are blurring the line between communication mech- anisms and (near) real-time resource sharing. The resulting requirement for near real-time policy-based access control is technically challenging. In a corporate domain, such access control mechanisms must be unobtrusive and comply with strict security objectives. Thus policy evaluation performance needs to be considered while addressing traditional security concerns. This paper discusses policy system design principles that motivate a novel Policy Decision Point (PDP) implementation and associated policy language. These principles are consistent with recent web development techniques designed to improve performance and scalability. Given a modern web development stack comprising a language (Javascript), a framework (Node.js) and a database management system (Redis), the proposition is that significant performance gains can be made. Our performance experiments suggest this is the case when, through various design iterations, our prototype PDP implementation is compared with an estab- lished, Java/XACML-based access control PDP implementation. The experiments presented in this paper suggest that newer technologies offer better performance. The analysis suggests that this is because they offer a more efficient data representation and make better use of computing resources.
Original languageEnglish
Title of host publicationProceedings - 2012 IEEE International Symposium on Policies for Distributed Systems and Networks, POLICY 2012
Pages25-32
Number of pages8
DOIs
Publication statusPublished - 2012
Event2012 IEEE 13th International Symposium on Policies for Distributed Systems and Networks, POLICY 2012 - Chapel Hill, NC, United States
Duration: 16 Jul 201218 Jul 2012

Publication series

NameProceedings - 2012 IEEE International Symposium on Policies for Distributed Systems and Networks, POLICY 2012

Conference

Conference2012 IEEE 13th International Symposium on Policies for Distributed Systems and Networks, POLICY 2012
Country/TerritoryUnited States
CityChapel Hill, NC
Period16/07/201218/07/2012

Keywords

  • access control
  • evaluation performance
  • JSON
  • language conversion
  • policy
  • service time measurement
  • XACML

Fingerprint

Dive into the research topics of 'On the performance of access control policy evaluation'. Together they form a unique fingerprint.

Cite this