EXtensible Access Control Markup Language (XACML) is one of the standardized languages for specifying access control policies. Policies described by the XACML are used to express the security requirement in the network and information system when we study authorization access control. With the aim to improve the Policy Decision Point (PDP) evaluation performance, we put forward a Graph and Clustering-Based Framework, employing the aggregate function. First, we partition the rule set into subsets. For the single value, we select the best partition quantity based on the aggregate function. As for the interval value, we handle with the start point and the finish point, respectively, in the same way as single value. Second, the policy set is split according to the partition of rule set. In this way, not only single values, but also interval values are taken into consideration. After that, we explore the searching tree to obtain the possibly matched rules. Finally, we construct the combining tree and output the policy decision on the basis of it. The experimental results show that our approach is orders of magnitude better than the Sun PDP. A comparison in evaluation performance between the redundancy detecting and eliminating engine and the Sun PDP, as well as XEngine and SBA-XACML, is made. Experimental results show that the evaluation performance of the PDP can be prominently improved by eliminating redundancies.

中文翻译：

---

用于高效 XACML 策略评估的基于图和聚类的框架

可扩展访问控制标记语言 (XACML) 是用于指定访问控制策略的标准化语言之一。在我们研究授权访问控制时，XACML 所描述的策略用于表达网络和信息系统中的安全要求。为了提高政策决策点（PDP）评估性能，我们提出了一个基于图和聚类的框架，采用聚合函数。首先，我们将规则集划分为子集。对于单个值，我们根据聚合函数选择最佳分区数量。对于区间值，我们分别处理起点和终点，处理方式与单值相同。其次，根据规则集的划分对策略集进行拆分。这样，不仅是单一的值，但也考虑了区间值。之后，我们探索搜索树以获得可能匹配的规则。最后，我们构建组合树并在此基础上输出策略决策。实验结果表明，我们的方法比 Sun PDP 好几个数量级。对冗余检测和消除引擎与Sun PDP、XEngine和SBA-XACML的评估性能进行了比较。实验结果表明，通过消除冗余可以显着提高PDP的评估性能。实验结果表明，我们的方法比 Sun PDP 好几个数量级。对冗余检测和消除引擎与Sun PDP、XEngine和SBA-XACML的评估性能进行了比较。实验结果表明，通过消除冗余可以显着提高PDP的评估性能。实验结果表明，我们的方法比 Sun PDP 好几个数量级。对冗余检测和消除引擎与Sun PDP、XEngine和SBA-XACML的评估性能进行了比较。实验结果表明，通过消除冗余可以显着提高PDP的评估性能。