Policy Specification Tree Optimization via Visiting Density Sorting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control mechanisms, such as Sun XACML PDP, face performance issues due to sequential linear searching and depth-first traversal in evaluating policy requests, leading to inefficient computing time and space usage, especially when more rules in the policy are evaluated.
Innovation Solution
The method involves transforming the policy specification tree into a similar tree by sorting sibling nodes based on their visiting density, ensuring frequently accessed rules are prioritized, thereby optimizing the depth-first traversal and reducing computational costs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sequential linear searching and depth-first traversal are used to evaluate policy rules, then the policy evaluation can be performed systematically, but the computing time and space requirements increase significantly
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing access frequency statistics for each node in the policy tree before actual evaluation requests are processed. This statistical information is gathered in advance and used to optimize the traversal order, avoiding the need to re-evaluate all nodes sequentially during each request.
Solution Approach 2:
The patent implements dynamics by adapting the tree traversal order based on access frequency statistics. Instead of using a fixed depth-first traversal, the system dynamically adjusts the evaluation order by prioritizing nodes with higher access frequencies, thereby reducing the average time required for policy evaluation.
2Reliability
If all rules in the policy are evaluated sequentially, then comprehensive access control can be ensured, but the memory space and computational resources are wasted
Solution Approach 1:
The patent applies partial action by evaluating only the necessary subset of policy nodes based on access frequency statistics. Nodes with higher access frequencies are evaluated first and more thoroughly, while nodes with lower frequencies are evaluated less extensively, reducing the total computational resources required while maintaining adequate access control.
Solution Approach 2:
The patent changes the parameter of node evaluation priority based on access frequency statistics. By reordering nodes according to their access frequency (a key parameter change), the system can evaluate policies more efficiently, reducing both time and computational resource consumption while maintaining security.
3Ease of manufacture
If the policy tree is traversed in a fixed depth-first order, then the evaluation process is simple to implement, but the performance deteriorates when more rules need to be evaluated
Solution Approach 1:
The system performs preliminary computation of access frequency statistics for all nodes and stores this information in advance. This pre-computed statistical data is then used to create an optimized traversal order that balances implementation simplicity with improved evaluation speed, avoiding the need for complex real-time analysis during each request.
Solution Approach 2:
The patent incorporates feedback mechanisms where access frequency statistics are collected from actual policy evaluation requests and used to refine the tree traversal order. This feedback loop enables the system to learn from actual usage patterns and continuously improve its evaluation performance while maintaining reasonable implementation complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present description relates to a computer-implemented method, computer system, and computer program product for optimization of evaluation of a policy specification. In one aspect, the computer-implemented method for optimization of evaluation of a policy specification may comprise: receiving the policy specification represented as a tree, the tree comprising a plurality of nodes; determining a visiting history of the tree, wherein the visiting history is determined by computing a density at least for each node in a subset of the plurality of nodes having been visited, wherein the density is determined by a relationship between a position of a node v in the tree and a frequency F(v) in which the node v is visited; transforming the tree with respect to the visiting history into a similar tree such that sibling nodes in the subset of the plurality of nodes are sorted in decreasing order according to their density.