Policy Decision Point Research Articles

Secure policy execution using reusable garbled circuit in the cloud

While cloud computing is fairly mature, there are underpinning data privacy and confidentiality issues that have yet to be resolved by existing security solutions such as cross domain access control policies. The latter necessitates the sharing of attributes with a Trusted Third Party (TTP), which in turn raises data privacy concerns. In this paper, we present a Privacy Aware Cross Tenant Access Control (PaCTAC) protocol for cross domain cloud users, based on reusable garbled circuit. We also propose the concept of a privacy aware Cloud Policy Decision Point (CPDP) that can be offered by cloud service providers. CPDP plays the role of a trusted third-party among its different tenants. We then formally specify PaCTAC to demonstrate its security.

Establishment of attribute bitmaps for efficient XACML policy evaluation

One of the primary challenges to apply the access control policy language XACML is the performance problem of the policy decision point (PDP), particularly when the PDP experience a great number of policies. The research on improving the PDP evaluation performance is of great significance. By combining with automaton theory an efficient policy decision engine is constructed in this paper, and attribute bitmaps are established statically for each subject, resource and action attribute of policies loaded by the policy decision engine. In evaluating access requests, the policy decision engine dynamically analyzes the requests and extracts the required attribute bitmaps to enforce the AND operation. According to the result of the AND operation, the policy decision engine matches the policies rapidly and gives out an authorization decision. The time that the policy decision engine takes to complete the evaluation of one access request is within 0.5 microsecond. This method not only greatly saves the storage space of policies, but also significantly reduces the time that the PDP takes to match the policies and evaluate access requests. Comparisons of the evaluation time taken by the policy decision engine with that taken by the Sun PDP, as well as XEngine and SBA-XACML, are made under different numbers of access requests. Experimental results show that the evaluation performance of the policy decision engine has a great improvement over that of the Sun PDP, XEngine and SBA-XACML.

An insider threat aware access control for cloud relational databases

The request-response paradigm that consists of policy decision points (PDPs) and policy enforcement points (PEPs) is used for access control in Cloud computing. The model uses PEP-side caching to increase the availability and reduce the processing overhead on PDP. This paper shows that using PEP-side caching can be exploited by insiders to bypass cloud access control mechanisms, which increases insider threat in cloud computing. To overcome this problem, the paper proposes a manageable model that detects and prevents insider threat at PEP side with minimum overhead on the performance of PEP and PDP. The model has been extensively tested and the results show its effectiveness in mitigating insider threat. Moreover, the experiments demonstrate that the overhead posed by the model on PEP and PDP is low. Lemmas, theorems and algorithm have been provided to show the correctness and the applicability of the proposed approach.

Elimination of policy conflict to improve the PDP evaluation performance

In the authorization access control model, the Policy Decision Point (PDP) may make an inappropriate authorization decision or the operating efficiency of the network and information system may be influenced, because there might be conflicts in the policies loaded on the PDP. As a result, the PDP's evaluation performance is affected when it evaluates access requests. In order to detect and eliminate conflicts in a policy and achieve the goal that the PDP can evaluate access requests with high efficiency, a form conflict detecting and eliminating engine is presented. This engine can not only detect and eliminate form conflicts in a policy, but also evaluate access requests. In the form conflict detecting and eliminating engine, a Resource Index Tree is constructed to convert the rules in a policy defined by the XACML to the node information in the Resource Index Tree. On the basis of the dependent relationship of resources, the overlapping relationship of conditions and effect information, form conflicts in a policy are detected and eliminated. Experiments make comparisons of the evaluation performance of the form conflict detecting and eliminating engine with that of the Sun PDP, as well as XEngine and SBA-XACML. Experimental results show that the evaluation performance of the PDP can be greatly improved by eliminating form conflicts in the policies.

Semantic aware processing of user defined inference rules to manage home networks

Increasing complexity makes it difficult for users to manage their home networks in a way that optimises their experience when using rich multimedia services. Current network management systems are not designed for ordinary network users—they do not seek to abstract the configuration details of network devices and services that need to be managed, requiring instead editing of configuration files with specific syntax and semantics. We investigated the use of semantic technologies to improve the ability of typical users to manage their networks by capturing their preferences using concepts familiar to them, and applying inference techniques to link monitored network events to these preferences so that appropriate configurations can be automatically applied. Our framework abstracts the detail of managing the network access and various multimedia services consumed in homes into an ontological descriptions augmented by inference rules (derived from users' interaction with system via intuitive interfaces). In this article, we specify semantic enrichment algorithms that analyse network flows concerning service usage and apply a reasoning process to identify events with user significance. These events are forwarded to a Policy Decision Point, triggering system policies that result in configuration actions. We demonstrate the power of our solution by implementing a set of use cases, and show that the semantic enrichment algorithms are flexible to suit a wide range of typical scenarios and performs better against a popular semantic search technique based on keyword interpretation.

Elimination of the Redundancy Related to Combining Algorithms to Improve the PDP Evaluation Performance

If there are lots of redundancies in the policies loaded on the policy decision point (PDP) in the authorization access control model, the system will occupy more resources in operation and consumes plenty of evaluation time and storage space. In order to detect and eliminate policy redundancies and then improve evaluation performance of the PDP, aredundancy related to combining algorithmsdetecting and eliminating engine is proposed in this paper. This engine cannot only detect and eliminate theredundancy related to combining algorithms, but also evaluate access requests. AResource Brick Wallis constructed by the engine according to the resource attribute of a policy’s target attributes. By theResource Brick Walland the policy/rule combining algorithms, three theorems for detectingredundancies related to combining algorithmsare proposed. A comparison of the evaluation performance of theredundancy related to combining algorithmsdetecting and eliminating engine with that of Sun PDP is made. Experimental results show that the evaluation performance of the PDP can be prominently improved by eliminating theredundancy related to combining algorithms.

Measurement and Prediction of Access Control Policy Evaluation Performance

As the need for more pervasive and more complex access controls grows, the challenge of ensuring the performance of access control systems is becoming apparent. Researchers have proposed several solutions to mitigate performance problems, including: adjusting the policy set; re-engineering the policy decision point (PDP); and decomposing the policies and distributing their evaluation. However, since the benefits and tradeoffs depend heavily upon the actual scenario, security administrators typically do not have objective justification for adopting particular mitigation actions. In response, we present the ATLAS framework, comprising: 1) DomainManager , which facilitates modelling the domain as closely as possible and automatically generates large numbers of representative policies and associated requests; 2) STACS , which enables controlled experiments to be performed using the generated policies/requests, to collect comprehensive measurements of PDP performance; and 3) PARPACS , which aids the understanding and worth of the measurement data and, by using rigorous validation techniques, reduces the risk of spurious insights or incorrect recommendations. We present a discussion of ATLAS as applied to an enterprise communication scenario, where access control is realised via XACML PDPs. Notable insights include that the SunXacml 2.0 PDP performs relatively poorly in terms of policy evaluation performance and that adding additional memory and/or processor cores to a XACML PDP server is not guaranteed to improve performance significantly.

SBA-XACML: Set-based approach providing efficient policy decision process for accessing Web services

Policy-based computing is taking an increasing role in providing real-time decisions and governing the systematic interaction among distributed Web services. XACML (eXtensible Access Control Markup Language) has been known as the de facto standard widely used by many vendors for specifying access and context-aware policies. Accordingly, the size and complexity of XACML policies are significantly growing to cope with the evolution of web-based applications and services. This growth raised many concerns related to the efficiency of real-time decision process (i.e. policy evaluation) and the correctness of complex policies. This paper is addressing these concerns through the elaboration of SBA-XACML, a novel Set-Based Algebra (i.e. SBA) scheme that provides efficient evaluation of XACML policies. Our approach constitutes of elaborating (1) a set-based language that covers all the XACML components and establish an intermediate layer to which policies are automatically converted, and (2) a semantics-based policy evaluation that provides better performance compared to the industrial standard Sun Policy Decision Point (PDP) and its corresponding ameliorations. Experiments have been conducted on real-life and synthetic XACML policies in order to demonstrate the efficiency, relevance and scalability of our proposition. The experimental results explore that SBA-XACML evaluation of large and small sizes policies offers better performance than the current approaches, by a factor ranging between 2.4 and 15 times faster depending on policy size.

Toward a mature industrial practice of software test automation

Since the launch of the first IEEE/ACM International Workshop on Automation of Software Test eight years ago, the research in the area has developed rapidly as test automation has become a mature practice widely adopted by the IT and software industry. One of the goals that has been continuously pursued is to bridge the gap between research and practice. Many of the recent papers are closely related to the current practice in the industry reflecting the trend toward a mature community unifying both researchers and practitioners. This is also reflected in the diversity of the topics related to the practical industrial problems covered in this special section. Authorization systems are at the heart of computer security. Antonia Bertolino et al.’s paper entitled Testing of PolPA-based Usage Control Systems is devoted to the testing of the Policy Decision Point (PDP) within the authorization system called PolPA, which enables both history-based and usage-based control of accesses. They propose two testing strategies for validating the history-based access control and the usage control functionalities, respectively. The former is based on a fault model being able to highlight the problems and vulnerabilities that could occur during the PDP implementation. The latter combines the standard technique for condition coverage with a methodology for simulating the continuous control of the PDP

Policy Decomposition for Evaluation Performance Improvement of PDP

In conventional centralized authorization models, the evaluation performance of policy decision point (PDP) decreases obviously with the growing numbers of rules embodied in a policy. Aiming to improve the evaluation performance of PDP, a distributed policy evaluation engine called XDPEE is presented. In this engine, the unicity of PDP in the centralized authorization model is changed by increasing the number of PDPs. A policy should be decomposed into multiple subpolicies each with fewer rules by using a decomposition method, which can have the advantage of balancing the cost of subpolicies deployed to each PDP. Policy decomposition is the key problem of the evaluation performance improvement of PDPs. A greedy algorithm withO(nlgn)time complexity for policy decomposition is constructed. In experiments, the policy of the LMS, VMS, and ASMS in real applications is decomposed separately into multiple subpolicies based on the greedy algorithm. Policy decomposition guarantees that the cost of subpolicies deployed to each PDP is equal or approximately equal. Experimental results show that (1) the method of policy decomposition improves the evaluation performance of PDPs effectively and that (2) the evaluation time of PDPs reduces with the growing numbers of PDPs.

Testing of PolPA-based usage control systems

The implementation of an authorization system is a critical and error-prone activity that requires a careful verification and testing process. As a matter of fact, errors in the authorization system code could grant accesses that should instead be denied, thus jeopardizing the security of the protected system. In this paper, we address the testing of the implementation of the Policy Decision Point (PDP) within the PolPA authorization system that enables history-based and usage-based control of accesses. Accordingly, we propose two testing strategies specifically conceived for validating the history-based access control and the usage control functionalities of the PolPA PDP. The former is based on a fault model able to highlight the problems and vulnerabilities that could occur during the PDP implementation. The latter combines the standard technique for conditions coverage with a methodology for simulating the continuous control of the PDP during the runtime execution. Both strategies are implemented within a testing framework supporting the automatic generation and execution of security test suites. Results produced by the application of this testing framework to a real case study are presented.

Automated testing of eXtensible Access Control Markup Language‐based access control systems

The trustworthiness of sensitive data needs to be guaranteed and testing is a common activity among privacy protection solutions, even if quite expensive. Accesses to data and resources are ruled by the policy decision point (PDP), which relies on the eXtensible Access Control Markup Language (XACML) standard language for specifying access rights. In this study, the authors propose a testing strategy for automatically deriving test requests from a XACML policy and describe their pilot experience in test automation using this strategy. Considering a real two-level PDP implemented for health data security, the authors compare the effectiveness of the test plan automatically derived with the one derived by a standard manual testing process.

Network Access Control Technology—Proposition to Contain New Security Challenges

Traditional products working independently are no longer sufficient, since threats are continually gaining in complexity, diversity and performance; In order to proactively block such threats we need more integrated information security solution. To achieve this objective, we will analyze a real-world security platform, and focus on some key components Like, NAC, Firewall, and IPS/IDS then study their interaction in the perspective to propose a new security posture that coordinate and share security information between different network security components, using a central policy server that will be the NAC server or the PDP (the Policy Decision Point), playing an orchestration role as a central point of control. Finally we will conclude with potential research paths that will impact NAC technology evolution.

A privacy preserving authorisation system for the cloud

In this paper we describe a policy based authorisation infrastructure that a cloud provider can run as an infrastructure service for its users. It will protect the privacy of usersʼ data by allowing the users to set their own privacy policies, and then enforcing them so that no unauthorised access is allowed to their data. The infrastructure ensures that the usersʼ privacy policies are stuck to their data, so that access will always be controlled by the policies even if the data is transferred between cloud providers or services. This infrastructure also ensures the enforcement of privacy policies which may be written in different policy languages by multiple authorities such as: legal, data subject, data issuer and data controller. A conflict resolution strategy is presented which resolves conflicts among the decisions returned by the different policy decision points (PDPs). The performance figures are presented which show that the system performs well and that each additional PDP only imposes a small overhead.

A policy system for Grid Management and Monitoring

Organizations using a Grid computing model are faced with non-traditional administrative challenges: the heterogeneous nature of the underlying resources requires professionals acting as Grid Administrators. Members of a Virtual Organization (VO) can use a subset of available resources and services in the grid infrastructure and in an ideal world, the more resoures are exploited the better. In the real world, the less faulty services, the better: experienced Grid administrators apply procedures for adding and removing services, based on their status, as it is reported by an ever-growing set of monitoring tools. When a procedure is agreed and well-exercised, a formal policy could be derived. For this reason, using the DIRAC framework in the LHCb collaboration, we developed a policy system that can enforce management and operational policies, in a VO-specific fashion. A single policy makes an assessment on the status of a subject, relative to one or more monitoring information. Subjects of the policies are monitored entities of an established Grid ontology. The status of a same entity is evaluated against a number of policies, whose results are then combined by a Policy Decision Point. Such results are enforced in a Policy Enforcing Point, which provides plug-ins for actions, like raising alarms, sending notifications, automatic addition and removal of services and resources from the Grid mask. Policy results are shown in the web portal, and site-specific views are provided also. This innovative system provides advantages in terms of procedures automation, information aggregation and problem solving.

Designing Fast and Scalable XACML Policy Evaluation Engines

Most prior research on policies has focused on correctness. While correctness is an important issue, the adoption of policy-based computing may be limited if the resulting systems are not implemented efficiently and thus perform poorly. To increase the effectiveness and adoption of policy-based computing, in this paper, we propose fast policy evaluation algorithms that can be adapted to support various policy languages. In this paper, we focus on XACML policy evaluation because XACML has become the de facto standard for specifying access control policies, has been widely used on web servers, and is most complex among existing policy languages. We implemented our algorithms in a policy evaluation system called XEngine and conducted side-by-side comparison with Sun Policy Decision Point (PDP), the industrial standard for XACML policy evaluation. The results show that XEngine is orders of magnitude faster than Sun PDP. The performance difference grows almost linearly with the number of rules in an XACML policy. To our best knowledge, there is no prior work on improving XACML policy evaluation performance. This paper represents the first step in exploring this unknown space.

Decision-cache based XACML authorisation and anonymisation for XML documents

This paper describes a decision cache for the eXtensible Access Control Markup Language (XACML) that supports fine-grained authorisation and anonymisation of XML based messages and documents down to XML attribute and element level. The decision cache is implemented as an XACML obligation service, where a specification of the XML elements to be authorised and anonymised is sent to the Policy Enforcement Point (PEP) during initial authorisation. Further authorisation of individual XML elements according to the authorisation specification is then performed on all matching XML resources, and decisions are stored in the decision cache. This makes it possible to cache fine-grained XACML authorisation and anonymisation decisions, which reduces the authorisation load on the Policy Decision Point (PDP). The theoretical solution is related to a practical case study consisting of a privacy-enhanced intrusion detection system that needs to perform anonymisation of Intrusion Detection Message Exchange Format (IDMEF) XML messages before they are sent to a security operations centre that operates in privacy-preserving mode. The solution increases the scalability of XACML based authorisation significantly, and may be instrumental in implementing federated authorisation and anonymisation based on XACML in several areas, including intrusion detection systems, web services, content management systems and GRID based authentication and authorisation.

Enforcing ASTD Access-Control Policies with WS-BPEL Processes in SOA Environments

Controlling access to the Web services of public agencies and private corporations depends primarily on specifying and deploying functional security rules to satisfy strict regulations imposed by governments, particularly in the financial and health sectors. This paper focuses on one aspect of the SELKIS and EB3SEC projects related to the security of Web-based information systems, namely, the automatic transformation of security rules into WS-BPEL (or BPEL, for short) processes. The former are instantiated from security-rule patterns written in a graphical notation, called ASTD that is close to statecharts. The latter are executed by a BPEL engine integrated into a policy decision point, which is a component of a policy enforcement manager similar to that proposed in the XACML standard.

The S3MS.NET Run Time Monitor: Tool Demonstration

This paper describes the S3MS.NET run time monitor, a tool that can enforce security policies expressed in a variety of policy languages for .NET desktop or mobile applications. The tool consists of two major parts: a bytecode inliner that rewrites .NET assemblies to insert calls to a policy decision point, and a policy compiler that compiles source policies to executable policy decision points. The tool supports both singlethreaded and multithreaded applications, and is sufficiently mature to be used on real-world applications.This paper describes the overall functionality and architecture of the tool, discusses its strengths and weaknesses, and reports on our experience with using the tool on case studies as well as in teaching.

Resource allocation scheme based on dynamic policy and mobile prediction

A dynamic resource allocation scheme based on dynamic policies and mobile predicted information was presented for the problem that traditional policies cannot preferably get adapted to the change of network state. Policy Decision Point (PDP) made decisions before the mobile users' arriving and worked out parameter values of the action according to the predicted information of the users,guidance policies and universal policies when it made decisions, which decreased the amount of stored policies and improved the adaptability of policies to network state. By experiments and analysis, it is shown that this scheme insures new call blocking probability, reduces handoff call dropping probability and increases network resource utilizing rate.