Access Control Request Caching for Low-Latency Policy Decisions

Solution Overview

Problem

Policy-based access control systems face challenges in maintaining near real-time response times when handling unexpected increases in access requests, leading to latency and wastage of computing resources due to repetitive evaluation of identical requests.

Innovation Solution

Implementing a system that stores responses to access requests and selectively reuses these stored responses using flags, switching between policy-based and memory-based access control systems based on system conditions to reduce CPU load and latency.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the policy-based access control system evaluates each access request using access control policies, then accurate access control decisions are made, but latency increases and CPU load increases during high request volumes

Engineering Contradiction:

Improveaccess control decision accuracyVSAvoidresponse latency

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary evaluation of access requests and stores the results in a cache before they are needed. When identical requests are received, the pre-computed results are retrieved from cache, eliminating the need to re-evaluate the same access control policies repeatedly, thus reducing latency while maintaining decision accuracy.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system creates copies of access control decisions and stores them in a cache data structure. Instead of re-evaluating identical requests, the system retrieves copied decision results from the cache, significantly reducing processing time and CPU load during high request volumes while preserving the accuracy of original policy evaluations.

Inventive Principle:

Principle #26Copying

2Reliability

If the policy-based access control system evaluates each access request using access control policies, then accurate access control decisions are made, but computing resources are wasted due to repetitive evaluation of identical requests

Engineering Contradiction:

Improveaccess control decision accuracyVSAvoidCPU load

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The system performs preliminary evaluation of access requests and stores the results in a cache before they are needed. When identical requests are received, the pre-computed results are retrieved from cache, eliminating the need to re-evaluate the same access control policies repeatedly, thus reducing processing time and CPU load during high request volumes while preserving decision accuracy.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system creates copies of access control decisions and stores them in a cache data structure. Instead of re-evaluating identical requests, the system retrieves copied decision results from the cache, significantly reducing processing time and CPU load during high request volumes while preserving the accuracy of original policy evaluations.

Inventive Principle:

Principle #26Copying

3Loss of time

If the system stores responses to access requests and reuses them, then response time decreases during high request volumes, but system complexity increases

Engineering Contradiction:

Improveresponse latencyVSAvoidsystem architecture complexity

Core Design Contradiction:

Loss of timeVSDevice complexity

Solution Approach 1:

The system introduces a cache data structure as an intermediary component between the access control policy evaluation logic and the request processing flow. This cache acts as a mediator that stores and retrieves access control decisions, reducing the complexity of implementing response time optimization without compromising the core access control functionality.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12476972B2Managing access requests for policy-based access control systems in computer networks

Publication Date: 2025.11.18 RED HAT INC

AI summary

Access requests for policy-based access control systems can be managed according to some examples. In one example, a system can receive, from a client device, a first access request for accessing a particular resource. The system can determine a first response approving or denying the first access request based on an access control policy. The system can store a data entry indicating the first response to the first access request. The system can set a flag to indicate that a future access request for the particular resource is to be handled using the data entry. Subsequent to setting the flag, the system can receive a second access request from the client device for accessing the particular resource. Based on determining that the flag is set, the system can determine a second response to the second access request based on the data entry rather than the access control policy.