Attribute-Based Access Control Caching With Decision Trees
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing attribute-based access control systems, particularly those using the XACML v3.0 architecture, suffer from increased computational complexity and latency due to centralized decision points and inefficient caching mechanisms that fail to optimize decisions based on varying attribute values.
Innovation Solution
Implement a multi-attribute query-based access control method utilizing decision trees to cache relevant attribute values, optimizing the decision-making process by storing and updating access policies in a centralized module, and enhancing PDP and PEP functions to handle complex queries efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If attribute-based access control is implemented with centralized decision points, then access control precision and policy enforcement capability are improved, but system latency and computational complexity increase
Solution Approach 1:
The patent pre-evaluates access policies and stores the results in a decision cache before actual access requests occur. When an access request comes in, the system checks the cache first to retrieve pre-computed decisions, avoiding repeated full policy evaluations and reducing latency while maintaining precision.
Solution Approach 2:
The patent segments the access control system into distributed policy evaluation points that can independently evaluate policies and store decisions locally. This segmentation allows parallel evaluation and reduces the computational burden on centralized decision points, lowering overall system latency while maintaining decision precision.
2Speed
If simple caching mechanisms are used for access decisions, then access speed is improved for identical requests, but the system cannot handle requests with varying attribute values
Solution Approach 1:
The patent changes the caching mechanism from storing simple binary decisions to storing decision trees that capture the relationship between attribute values and access outcomes. This allows the cache to adapt to varying attribute values by evaluating the decision tree with the new attributes while reusing previously computed sub-decisions, maintaining both speed and adaptability.
Solution Approach 2:
The patent introduces decision trees as an intermediary structure between the cache and access requests. The decision tree acts as a mediator that can handle varying attribute values by providing a structured evaluation path, allowing the system to reuse cached information while adapting to new request parameters.
3Adaptability or versatility
If distributed architecture is implemented with multiple PEPs and PDPs, then system modularity and security are improved, but communication overhead and processing time increase
Solution Approach 1:
The patent implements preliminary policy evaluation at distributed PEPs before communication with PDPs. By pre-evaluating policies locally and caching decisions, the system reduces the frequency and volume of communications between distributed components, lowering communication overhead while maintaining the modular architecture's security and adaptability benefits.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for controlling access based on multi-attribute requests for access to a portion of a computer system, the access control making it possible to authorize or refuse access to a sender of a request as a function of attribute values contained in the request, the access control being performed by an access control system according to an access policy comprising a set of previously stored rules, the access control system comprising a decision cache system, suitable for storing request attribute values in a cache and at least one calculation processor. The method uses a decision cache system in which request attribute values are stored in the form of a decision tree (50, 52, 54). For an access request in progress that comprises a plurality of attributes, the method comprises a verification, using at least one subset of the plurality of attributes from the access request, of the presence of attribute values from previous requests in the decision tree, allowing a decision to be made authorizing or refusing access to the portion of the computer system.