Indexation improvement

[Erwan G]

Hello

I have few questions about indexation improvement.

First, I have to explain the context: we plan to use your framework to manage a huge among of Policies or PolicySet (about 2 500 000) and we predict about 10 000 requests by day. These requests include 20% of deployment request (to deploy a new policy on the PDP) and 80% of evaluation requests. An PolicySet example is available as attached file.

We are testing deployment requests. When there is about 3 500 requests deployed, the deployment of a new one take more than 1s to complete, so we need to improve the indexation process.

My questions are:

• What is the most efficient? To have a large among of simple Policy or to have only few complex PolicySets that regroup all Policies?
  

• If we have a main PolicySet with a general target that contain sub policies with specific targets (like shown in the attached file). How will the main PolicySet be indexed? Will the locator’s locate method return only the concerned sub-Policy or the main PolicySet?
  Is the indexation only performed on the main PolicySet target or does it take care of sub-PolicySet target too?
  

• Do you think it’s possible to easily add a new evaluatables to the indexes and not to re-index all evaluatables each time a new one is added? Or should we use another way to index evaluatables to make it possible?
  

Regards,
Erwan

[Florian Huonder]

Hi Erwan,

The answer to your questions cannot be given out of the box because it always depends on the context.

• In our XACML implementation all trees that are deployed are indexed. That means in our case the index works better the flatter the policies are. Meaning in a hierarchy only the top policy is indexed.
• If that main policy set is indexed. Only the root target will be indexed. the locate method will return (in case of a match) the main PolicySet containing all sub policies. All sub policies must be evaluated. Here also the same statement as above, the index is better when the tree is flat.
• Our index does not support updating of the index at all. Every deployment requires a complete rebuild of the index.

If you have any ideas or hints about an improvement let us know.

Regards,
Florian