Design and implementation of policy decision point in policy-based network

2005 ◽  
Author(s):  
Geonlyang Kim ◽  
Jinoh Kim ◽  
Jungchan Na
Keyword(s):  
Policy Decision ◽  
Decision Point ◽  
Design And Implementation ◽  
Policy Decision Point

scholarly journals Policy Decomposition for Evaluation Performance Improvement of PDP

2014 ◽  
Vol 2014 ◽  
pp. 1-14 ◽  
Author(s):  
Fan Deng ◽  
Ping Chen ◽  
Li-Yong Zhang ◽  
Xian-Qing Wang ◽  
Sun-De Li ◽  
...  
Keyword(s):  
Performance Improvement ◽  
Greedy Algorithm ◽  
Policy Decision ◽  
Decision Point ◽  
Evaluation Performance ◽  
Évaluation Performance ◽  
Policy Decision Point ◽  
Evaluation Time ◽  
The Cost ◽  
The Greedy Algorithm

In conventional centralized authorization models, the evaluation performance of policy decision point (PDP) decreases obviously with the growing numbers of rules embodied in a policy. Aiming to improve the evaluation performance of PDP, a distributed policy evaluation engine called XDPEE is presented. In this engine, the unicity of PDP in the centralized authorization model is changed by increasing the number of PDPs. A policy should be decomposed into multiple subpolicies each with fewer rules by using a decomposition method, which can have the advantage of balancing the cost of subpolicies deployed to each PDP. Policy decomposition is the key problem of the evaluation performance improvement of PDPs. A greedy algorithm withO(nlgn)time complexity for policy decomposition is constructed. In experiments, the policy of the LMS, VMS, and ASMS in real applications is decomposed separately into multiple subpolicies based on the greedy algorithm. Policy decomposition guarantees that the cost of subpolicies deployed to each PDP is equal or approximately equal. Experimental results show that (1) the method of policy decomposition improves the evaluation performance of PDPs effectively and that (2) the evaluation time of PDPs reduces with the growing numbers of PDPs.

Enforcing ASTD Access-Control Policies with WS-BPEL Processes in SOA Environments

2011 ◽  
Vol 2 (2) ◽  
pp. 37-59 ◽  
Author(s):  
Michel Embe Jiague ◽  
Marc Frappier ◽  
Frédéric Gervais ◽  
Régine Laleau ◽  
Richard St-Denis
Keyword(s):  
Policy Decision ◽  
Policy Enforcement ◽  
Decision Point ◽  
Public Agencies ◽  
Web Based ◽  
Access Control Policies ◽  
Policy Decision Point ◽  
Security Rule ◽  
Private Corporations ◽  
Bpel Processes

Controlling access to the Web services of public agencies and private corporations depends primarily on specifying and deploying functional security rules to satisfy strict regulations imposed by governments, particularly in the financial and health sectors. This paper focuses on one aspect of the SELKIS and EB3SEC projects related to the security of Web-based information systems, namely, the automatic transformation of security rules into WS-BPEL (or BPEL, for short) processes. The former are instantiated from security-rule patterns written in a graphical notation, called ASTD that is close to statecharts. The latter are executed by a BPEL engine integrated into a policy decision point, which is a component of a policy enforcement manager similar to that proposed in the XACML standard.

scholarly journals Elimination of the Redundancy Related to Combining Algorithms to Improve the PDP Evaluation Performance

2016 ◽  
Vol 2016 ◽  
pp. 1-18
Author(s):  
Fan Deng ◽  
Li-Yong Zhang ◽  
Bo-Yu Zhou ◽  
Jia-Wei Zhang ◽  
Hong-Yang Cao
Keyword(s):  
Policy Decision ◽  
Brick Wall ◽  
Decision Point ◽  
Evaluation Performance ◽  
Policy Rule ◽  
Évaluation Performance ◽  
Policy Decision Point ◽  
Evaluation Time ◽  
And Storage ◽  
Target Attributes

If there are lots of redundancies in the policies loaded on the policy decision point (PDP) in the authorization access control model, the system will occupy more resources in operation and consumes plenty of evaluation time and storage space. In order to detect and eliminate policy redundancies and then improve evaluation performance of the PDP, aredundancy related to combining algorithmsdetecting and eliminating engine is proposed in this paper. This engine cannot only detect and eliminate theredundancy related to combining algorithms, but also evaluate access requests. AResource Brick Wallis constructed by the engine according to the resource attribute of a policy’s target attributes. By theResource Brick Walland the policy/rule combining algorithms, three theorems for detectingredundancies related to combining algorithmsare proposed. A comparison of the evaluation performance of theredundancy related to combining algorithmsdetecting and eliminating engine with that of Sun PDP is made. Experimental results show that the evaluation performance of the PDP can be prominently improved by eliminating theredundancy related to combining algorithms.

A Graph and Clustering-Based Framework for Efficient XACML Policy Evaluation

2020 ◽  
Vol 29 (01n02) ◽  
pp. 2040001
Author(s):  
Yanfei Li ◽  
Fan Deng
Keyword(s):  
Access Control ◽  
Policy Decision ◽  
Experimental Results ◽  
The Sun ◽  
Evaluation Performance ◽  
Évaluation Performance ◽  
Aggregate Function ◽  
Access Control Policies ◽  
Policy Decision Point ◽  
Rule Set

EXtensible Access Control Markup Language (XACML) is one of the standardized languages for specifying access control policies. Policies described by the XACML are used to express the security requirement in the network and information system when we study authorization access control. With the aim to improve the Policy Decision Point (PDP) evaluation performance, we put forward a Graph and Clustering-Based Framework, employing the aggregate function. First, we partition the rule set into subsets. For the single value, we select the best partition quantity based on the aggregate function. As for the interval value, we handle with the start point and the finish point, respectively, in the same way as single value. Second, the policy set is split according to the partition of rule set. In this way, not only single values, but also interval values are taken into consideration. After that, we explore the searching tree to obtain the possibly matched rules. Finally, we construct the combining tree and output the policy decision on the basis of it. The experimental results show that our approach is orders of magnitude better than the Sun PDP. A comparison in evaluation performance between the redundancy detecting and eliminating engine and the Sun PDP, as well as XEngine and SBA-XACML, is made. Experimental results show that the evaluation performance of the PDP can be prominently improved by eliminating redundancies.

Enforcing ASTD Access-Control Policies with WS-BPEL Processes in SOA Environments

2013 ◽  
pp. 252-273
Author(s):  
Michel Embe Jiague ◽  
Marc Frappier ◽  
Frédéric Gervais ◽  
Régine Laleau ◽  
Richard St-Denis
Keyword(s):  
Policy Decision ◽  
Policy Enforcement ◽  
Public Agencies ◽  
Web Based ◽  
Access Control Policies ◽  
Policy Decision Point ◽  
Security Rule ◽  
Private Corporations ◽  
Bpel Processes ◽  
The Web

Controlling access to the Web services of public agencies and private corporations depends primarily on specifying and deploying functional security rules to satisfy strict regulations imposed by governments, particularly in the financial and health sectors. This paper focuses on one aspect of the SELKIS and EB3SEC projects related to the security of Web-based information systems, namely, the automatic transformation of security rules into WS-BPEL (or BPEL, for short) processes. The former are instantiated from security-rule patterns written in a graphical notation, called ASTD that is close to statecharts. The latter are executed by a BPEL engine integrated into a policy decision point, which is a component of a policy enforcement manager similar to that proposed in the XACML standard.

AAC Considerations for Individuals With Angelman Syndrome

2015 ◽  
Vol 24 (3) ◽  
pp. 106-113 ◽  
Author(s):  
Stephen N. Calculator
Keyword(s):  
Angelman Syndrome ◽  
Augmentative And Alternative Communication ◽  
High Tech ◽  
Alternative Communication ◽  
Design And Implementation

Purpose To provide an overview of communication characteristics exhibited by individuals with Angelman Syndrome (AS) and special considerations associated with the design and implementation of augmentative and alternative communication (AAC) programs. Method Results of recent studies exploring individuals' uses of AAC are reviewed, with particular emphasis on factors related to individuals' acceptance and successful uses of AAC systems. Results Not applicable Conclusion Despite their inconsistent access to practices previously found to foster individuals' acceptance of AAC systems, individuals with AS demonstrate the ability to use AAC systems, including high-tech AAC devices, successfully.

EURRECA’s Approach for Estimating Micronutrient Requirements

2011 ◽  
Vol 81 (4) ◽  
pp. 256-263 ◽  
Author(s):  
Christophe Matthys ◽  
Pieter van ‘t Veer ◽  
Lisette de Groot ◽  
Lee Hooper ◽  
Adriënne E.J.M. Cavelaars ◽  
...  
Keyword(s):  
Reference Values ◽  
Policy Decision ◽  
Individual Variability ◽  
The Body ◽  
Decision Makers ◽  
Nutrient Requirements ◽  
Factorial Approach ◽  
Dietary Reference Values ◽  
Health Policy Decision ◽  
Quantitative Integration

In Europe, micronutrient dietary reference values have been established by (inter)national committees of experts and are used by public health policy decision-makers to monitor and assess the adequacy of diets within population groups. The approaches used to derive dietary reference values (including average requirements) vary considerably across countries, and so far no evidence-based reason has been identified for this variation. Nutrient requirements are traditionally based on the minimum amount of a nutrient needed by an individual to avoid deficiency, and is defined by the body’s physiological needs. Alternatively the requirement can be defined as the intake at which health is optimal, including the prevention of chronic diet-related diseases. Both approaches are confronted with many challenges (e. g., bioavailability, inter and intra-individual variability). EURRECA has derived a transparent approach for the quantitative integration of evidence on Intake-Status-Health associations and/or Factorial approach (including bioavailability) estimates. To facilitate the derivation of dietary reference values, EURopean micronutrient RECommendations Aligned (EURRECA) is developing a process flow chart to guide nutrient requirement-setting bodies through the process of setting dietary reference values, which aims to facilitate the scientific alignment of deriving these values.

Modeling Foreign Policy Decision Making

1970 ◽  
Vol 15 (2) ◽  
pp. 136, 138
Author(s):  
RICHARD L. MERRITT
Keyword(s):  
Decision Making ◽  
Foreign Policy ◽  
Policy Decision ◽  
Policy Decision Making
Sign in / Sign up

Export Citation Format

Share Document