Caching Netgroups for Fast Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network group authentication systems are inefficient as they require scanning external directory services for every access request, leading to delays and resource wastage, especially when dealing with large network structures and frequent user changes.
Innovation Solution
Implementing a caching mechanism that stores user and network group timestamps, allowing for quick verification of user membership and access control by using cached data structures, which reduces the need for frequent scans of external data structures and accelerates authentication processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If external directory services are scanned for every access request, then authentication accuracy is maintained, but system response time deteriorates and resource consumption increases
Solution Approach 1:
The patent implements a caching mechanism that pre-loads and stores network group membership data in local memory before it is needed for authentication. The cache is populated in advance from external directory services, allowing the authentication system to quickly retrieve user membership information without performing full scans of external directory services for every access request. This preliminary action maintains authentication accuracy while dramatically reducing response time.
Solution Approach 2:
The patent creates local copies of network group membership data from external directory services and stores them in a caching structure. Instead of repeatedly accessing and scanning the original external directory services, the system uses these local copies for authentication decisions. The copying approach preserves the accuracy of authentication while eliminating the time penalty of repeated external scans.
2Reliability
If external directory services are scanned for every access request, then data freshness is maintained, but computational resource consumption increases
Solution Approach 1:
The patent implements periodic refresh of the caching mechanism, where the cache is updated from external directory services at scheduled intervals or triggered by specific events (such as detected changes in network group data). This periodic action maintains data freshness and reliability while avoiding the continuous high resource consumption of scanning external directory services for every access request. The system balances data currency with resource efficiency by refreshing the cache periodically rather than on every authentication attempt.
3Speed
If full network group structure is cached, then authentication speed improves, but storage space requirements increase
Solution Approach 1:
The patent extracts and caches only the specific portions of the network group structure that are necessary for authentication operations. Rather than caching the entire hierarchical network group structure, the system identifies and caches only the user membership data and group relationships that are actually needed for access control decisions. This extraction approach maintains fast authentication speed while minimizing storage space requirements by caching only essential data.
Solution Approach 2:
The patent implements differential caching where different parts of the network group structure are cached with different levels of detail and freshness. Frequently accessed user memberships and critical group relationships are cached with high detail and updated frequently, while less critical portions are cached with lower detail or updated less frequently. This local quality approach optimizes the balance between authentication speed and storage requirements by applying different caching strategies to different parts of the data structure.
Data Source
AI summary
A method for network group based access control, the method may include (i) receiving a request to access content stored in a storage system, the request is associated with a user and a network group that is suggested to include the user; (ii) generating a user key based on an identifier of the user and the network group; (iii) determining, based in part on the user key, whether the user is a current user of the network group, and (iv) declining the request when the user is not the current user of the network group. The determining may include determining that the user is not a current user of the network group when a user finding timestamp of the user precedes a network group finding timestamp of the network group.