Abstract: The description and execution of access control policy is an important way of information resource protection,which affects system’s operational running.In view of the poor efficiency of evaluation,some researchers have proposed the policy evaluation methods based on attribute cache and reordering,which improve the efficiency of policy eva-luation,but they still fail to solve the problem that the policy evaluation needs to traverse all relevant rules.To focus on this problem,after the analysis about the characteristics of the XACML policy description,a XACML policy query method based on attribute and/or matrix and type analysis was proposed in this paper,which can reduce the number of matching during policy evaluation.This method modifies the processing of the existing Context Handler,and adds a preprocessing phase which will match access control rule.During the preprocessing phase,the discriminations are calculated for each rule attributes.The irrelative rules for current access control request can be filtered by the attribute and/or matrix and the discriminations.The proposed method can improve the efficiency of policy evaluation by matching the filtered rule set.Experimental results verify its efficiency.

Key words: Attribute and/or matrix, Discrimination, Type analysis, XACML