More precisely, the algorithm combines multiple policies referenced in a single composed policy into a larger equivalent composed policy and combines their remote policy references into a reference to the new combined policy.
Afterward, the algorithm tries to combine multiple remote policy references into a single reference again, in order to minimize the number of remote policy evaluation requests.
This not only leads to a performance overhead because of the additional (possibly remote) policy evaluation, but in data-driven applications such as medical image processsing, this can lead to sending back and forth large data sets between different cloud offerings.
Remote policy decision point.
While many companies are benefitting from telework, some are regressing and retreating on their own remote policy trends.
The policy tree resulting from normalizing and decomposing the policies from the case study does not allow to combine multiple remote policy references.
First, remote policy references can be extended with local targets in order to avoid the unnecessary policy requests mentioned in Section 6.3.
In case of FirstApplicable, only consecutive remote policy references in the sub-policies can be combined; in case of PermitOverrides or DenyOverrides, all remote policy references can be combined since these algorithms are commutative as shown by transformations T8 and T9 of Equations (T8 T9).
Finally, the third step of the algorithm tries to combine remote policy references in order to minimize the number of policy evaluation requests between tenant and provider (see Algorithm 4).
