Comprehension Indexing for Large-Scale API Policy Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems face inefficiencies in evaluating large data sets and do not support aggregation operations or mutation, particularly in declarative languages, leading to time-consuming policy evaluations.
Innovation Solution
A policy agent performs offline and online processes to generate indices and tree structures for policy statements, allowing efficient evaluation of API-authorization requests by indexing comprehensions that meet specific conditions, and caching results for rapid traversal.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If access control rules are evaluated on large data sets using traditional methods, then policy evaluation can be performed, but the evaluation becomes time consuming and inefficient
Solution Approach 1:
The system performs preliminary actions by pre-compiling policies into optimized representations and pre-computing indices for common query patterns before actual authorization requests arrive. This allows the policy agent to quickly retrieve and evaluate pre-processed policy structures during runtime, significantly reducing evaluation time for large data sets.
Solution Approach 2:
The patent segments the policy evaluation process into multiple components: policy compilation, index generation, query matching, and authorization decision. By dividing the evaluation into these discrete segments and using indices to quickly locate relevant policy portions, the system avoids scanning entire policies for every request, thereby improving productivity.
2Ease of operation
If declarative languages are used to define access control rules, then policy definition is simplified, but aggregation operations and mutation support are lost
Solution Approach 1:
The system introduces an intermediary layer between the declarative policy language and the execution engine. This intermediary includes an index generation component that translates declarative policies into optimized data structures and indices, enabling aggregation operations and mutations to be performed efficiently without changing the simplicity of the declarative language itself.
Solution Approach 2:
The patent changes parameters by transforming policy representations from raw declarative forms into optimized internal representations with associated indices. This allows the system to maintain simple declarative syntax for policy definition while using transformed parameter representations during execution to enable aggregation and mutation operations.
3Productivity
If policies are evaluated without indexing, then implementation is simpler, but performance on large data sets deteriorates
Solution Approach 1:
The system performs preliminary index generation and policy compilation actions during off-peak times or at policy deployment, storing the results in optimized data structures. This preliminary action reduces the complexity burden during actual evaluation, as the heavy lifting of index construction is done beforehand, improving productivity without significantly increasing operational complexity.
Solution Approach 2:
The patent creates copies of policy data in optimized formats and stores them in indices. Instead of working with the original complex policy structures during every evaluation, the system uses simplified copies and references stored in indices, reducing the effective complexity during evaluation while maintaining full policy functionality.
Data Source
AI summary
Some embodiments of the invention provide a method for defining code-based policies. The method generates a policy-builder first view of a policy for display in a graphical user interface (GUI) by processing a syntax tree that is generated from a code second view of the policy. The method receives, through the policy-builder first view, a modification to a portion of the policy. To reflect the modification, the method updates a portion of the syntax tree that corresponds to the portion of the policy that is affected by the modification. Based on the updating of the syntax tree, the method updates the code second view by modifying a portion of the code second view that corresponds to the updated portion of the syntax tree.