Xengine: a fast and scalable XACML policy evaluation engine

XACML has become the de facto standard for specifying access control policies for various applications, especially web services. With the explosive growth of web applications deployed on the Internet, XACML policies grow rapidly in size and complexity, which leads to longer request processing time. This paper concerns the performance of request processing, which is a critical issue and so far has been overlooked by the research community. In this paper, we propose XEngine, a scheme for efficient XACML policy evaluation. XEngine first converts a textual XACML policy to a numerical policy. Second, it converts a numerical policy with complex structures to a numerical policy with a normalized structure. Third, it converts the normalized numerical policy to tree data structures for efficient processing of requests. To evaluate the performance of XEngine, we conducted extensive experiments on both real-life and synthetic XACML policies. The experimental results show that XEngine is orders o...

• Type: Journal
• Year: 2008
• Where: SIGMETRICS
• Authors: Alex X. Liu, Fei Chen, JeeHyun Hwang, Tao Xie
• Keywords: Hardware, Numerical Policy, SIGMETRICS 2008, Sun PDP, XACML Policies