Beyond Scale: An Efficient Framework for Evaluating Web Access Control Policies in the Era of Big Data

Abstract

Recently explosive growth in data and the rapid development of communicate technologies bring us into the era of big data. As an important security strategy, access control calls for more highly efficient methods for its evaluation. However, most of the traditional work has already met the bottleneck. Although there’ve been some methods focusing on the performance of the evaluation engine, these methods are mostly either not in the setting of big data, or there are many limitations when they are deployed in practice. In this paper, we propose a novel framework based on a two-level structure employing multiple clustering techniques. Before building the framework, we propose some ideas for attributes’ preprocessing. Then we obtain the two-level structure by a two-stage clustering. In first stage, we make a coarse-grained clustering in quality, and in second stage, we make a fine-grained clustering in quantity. Finally, we can obtain a further improvement by set-operations. In experiments, the framework is applied to some prevailing evaluation engines using large dataset, and the results show that our approach can get great improvements for all involved engines.

A Appendix

In essence, the $Set^{0}_{pol}$ is the original policies directly extracted from the PolicySets without caring the structure and combing-algorithm; $Set^{1}_{pol}$ and $Set^{2}_{pol}$ are the modified versions for the transition work of two stage clustering respectively. The policies in $Set^{1}_{pol}$ are the ones that delete match conditions of the non-selected CatAttrs, all the NumAttrs and other-type attributes abiding by the relaxation rules. The policies in $Set^{2}_{pol}$ are the ones that regain all the match conditions of NumAttrs based on the policies in $Set^{1}_{pol}$. The policies above are the ones in $Set^{0}_{pol}$, $Set^{1}_{pol}$ and $Set^{2}_{pol}$ respectively, focusing on subjects.

Fig. 6.

An Example of Policy.