CAREER: Towards High Performance Policy Evaluation

Michigan State University, East Lansing MI

Investigators

Abstract

This award is funded under the American Recovery and Reinvestment Act of 2009 (Public Law 111-5). Policy-based computing is a critical component of many large-scale configurable systems because it enables dynamic adaptability of system behavior by changing policy configurations without reprogramming the systems. Policy evaluation, the process of checking whether a request satisfies a policy, is typically the performance bottleneck of policy-based systems. Most prior research has focused on the correctness (i.e., specification, design, and analysis) of policies. While correctness is an important issue, the adoption of policy-based computing may be limited if the resulting systems are not implemented efficiently and thus perform poorly. The high-level research objective of this project is to increase the effectiveness and adoption of policy-based computing by designing high performance policy evaluation algorithms and engines that can be adapted to support various policy languages. The primary focus of this project is the fast evaluation of security policies, which are most prevalent. To speed up policy evaluation, this research uses two unique approaches: policy normalization and canonical policy representation. The idea of policy normalization is to convert a policy with a complex logical structure to an equivalent policy with a simple logical structure. The idea of canonical policy representation is to convert a given policy to its canonical form. The techniques developed in this effort will be useful beyond this project. The results will greatly benefit society by increasing the adoption of policy-based computing. To promote education and learning, this effort actively involves high school, undergraduate, graduate students, especially students from under-represented minorities.