Abstract Policy Evaluation for Access Control Batch Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern enterprise systems face performance issues due to the complex and dynamic nature of access control constraints, which require context information for resolution, leading to inefficient evaluation and increased response times in distributed systems like those based on the service-oriented architecture (SOA) paradigm.
Innovation Solution
Implementing abstract policy evaluation methods that determine the required attributes for access control decisions at runtime, allowing for a single batch request to retrieve all necessary attribute values, thereby reducing communication overhead and improving response times.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic access control constraints are evaluated at runtime using traditional methods, then access control decisions can be made based on context information, but the number of interactions between the central PDP and distributed services increases, leading to longer response times
Solution Approach 1:
The patent performs preliminary analysis of the access control policy to identify all attributes required for evaluation before actually evaluating the policy. This allows the system to request all necessary attribute values in a single batch operation, rather than making multiple sequential requests during policy evaluation, thus reducing response time while maintaining decision accuracy
2Loss of information
If multiple sequential requests are made to retrieve attribute values from distributed services, then all required attributes can be obtained for policy evaluation, but the communication overhead increases and performance decreases
Solution Approach 1:
The patent merges multiple attribute retrieval requests into a single batch request. By identifying all required attributes upfront and requesting them simultaneously in one communication operation, the system reduces communication overhead and improves performance while ensuring all necessary attributes are obtained for complete policy evaluation
3Loss of information
If the central PDP requests all possible attribute values, then complete information is available for policy evaluation, but unnecessary communication occurs increasing response time
Solution Approach 1:
The patent extracts only the specific attributes that are actually required for policy evaluation from the set of all possible attributes. By analyzing the policy structure and identifying only the necessary attributes, the system requests precisely the information needed without unnecessary communication, optimizing both completeness and efficiency
Data Source
AI summary
Implementations of the present disclosure include methods, systems, and computer-readable storage mediums for evaluating access control constraints and include actions of receiving an access control request, obtaining a set of attributes based on an abstract evaluation of a policy, the set of attributes including one or more attributes that could be required to evaluate the access control request, requesting respective values of the one or more attributes in a batch request, receiving the respective values, and providing an access control decision based on the respective values and the policy.