Authorization Policy Matching for Hierarchical Resources
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authorization systems face scalability issues due to the large number of resources, security policies, and users, leading to inefficient processing and high computational requirements, which results in increased processing time and latency.
Innovation Solution
The implementation of optimized techniques that allow for the identification and evaluation of applicable security policies without processing all policies, using memory structures specific to resource types and filtering based on request components, subject, action, and other criteria, reducing the computational load and improving system throughput.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the authorization system processes all security policies sequentially for each authorization request, then the authorization decision is comprehensive and accurate, but the processing time increases significantly and system throughput decreases
Solution Approach 1:
The patent segments the policy evaluation process by dividing policies into different categories (e.g., resource-type specific policies vs. general policies) and evaluating them in different orders or with different priorities. This allows the system to process only relevant policies for each request rather than all policies sequentially, improving throughput while maintaining accuracy.
Solution Approach 2:
The patent performs preliminary actions by pre-classifying resources into types and pre-organizing policies into categories before authorization requests arrive. This preliminary organization allows the system to quickly identify which policies are relevant for each request without processing all policies from scratch, thereby reducing processing time while ensuring comprehensive evaluation.
2Reliability
If the authorization system processes all security policies for each request, then all possible access control rules are checked, but the computational resources required increase significantly
Solution Approach 1:
The patent applies local quality by tailoring the policy evaluation approach to the specific resource type being accessed. Different resource types (e.g., documents, databases, APIs) have different policy sets, and the system evaluates only the relevant policies for that resource type rather than processing all policies uniformly, reducing computational overhead while maintaining complete access control.
Solution Approach 2:
The patent uses partial action by evaluating only the necessary subset of policies for each authorization request based on the resource type and request characteristics, rather than processing all policies. This partial evaluation approach maintains sufficient access control coverage while significantly reducing computational resource consumption.
3Device complexity
If the authorization system uses a simple sequential policy processing approach, then the system design is straightforward, but the system cannot scale with growing numbers of resources, policies, and users
Solution Approach 1:
The patent introduces dynamics by making the policy evaluation process adaptive to the specific resource type and request characteristics. The system dynamically determines which policies to evaluate based on the resource type, allowing it to scale efficiently as the number of resources and policies grows, while maintaining a relatively simple core evaluation mechanism.
4Reliability
If the authorization system processes policies based on the total number of policies in the system, then all policies are considered, but the processing time increases with system growth
Solution Approach 1:
The patent changes the parameter for policy evaluation from the total number of policies in the system to the number of policies relevant to the specific resource type. This parameter change allows the system to maintain thorough policy evaluation for the relevant subset while reducing processing time as the overall system grows, since the evaluation scope expands proportionally with resource types rather than with total policy count.
Data Source
AI summary
Improved techniques are provided for processing authorization requests. In some embodiments, an authorization request specifying a hierarchical resource can be processed without having to sequentially process the various security policies configured for a collection of resources.