An efficient density peak cluster algorithm for improving policy evaluation performance.

Area of Science:

• Computer Science
• Information Security
• Algorithms

Background:

• eXtensible Access Control Markup Language (XACML) is crucial for access control but suffers from performance degradation with large, complex policy sets.
• Increased policy evaluation time hinders the scalability and efficiency of XACML-based systems.

Purpose of the Study:

• To propose an optimization algorithm and an efficient policy evaluation engine to address the performance issues in large-scale XACML policy sets.
• To significantly reduce policy matching and evaluation time.

Main Methods:

• Developed an optimization algorithm based on the Density Peak Cluster Algorithm (DPCA) for improved clustering of large-scale XACML policies.
• Designed and implemented an efficient policy evaluation engine, DPEngine, integrating the DPCA-based algorithm.

Main Results:

• DPEngine demonstrated significantly faster policy evaluation times compared to Sun PDP, HPEngine, XEngine, and SBA-XACML.
• With 10,000 requests and 100,000 rules, DPEngine's evaluation time was only 2.23%-4.06% of the compared engines.
• DPEngine exhibits linear growth in evaluation time as the number of requests increases, indicating stable performance.

Conclusions:

• DPEngine offers substantial improvements in efficiency and stability for XACML policy evaluation, especially for large and complex policy sets.
• The DPCA-based optimization effectively enhances policy clustering, leading to reduced evaluation times.