Distributed Access Control via Local Policy Compilation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems, such as XACML, face inefficiencies due to high network resource consumption from serialization and deserialization of data in distributed systems, especially with millions of resources and heavy access, necessitating a method to facilitate access control without these issues.
Innovation Solution
A system that distributes access control services to local nodes by compiling policy files into optimized data structures, such as nested hash maps, for efficient local lookups of permissions, reducing the need for network traffic and serializations by storing these structures in memory for quick access control decisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If access control decisions are made by a centralized server with XML serialization/deserialization, then access control policies can be updated on the fly, but network traffic and processing overhead increase significantly
Solution Approach 1:
The patent divides the centralized access control system into distributed components. Each node in the network receives and stores local copies of access control policies, enabling decentralized decision-making. This segmentation reduces network traffic by eliminating the need to serialize and deserialize XML requests for every access control decision, while still allowing policy updates to be propagated to all nodes.
Solution Approach 2:
The patent implements preliminary action by pre-distributing access control policies to all nodes in the network before they are needed for decision-making. Nodes store these policies locally in an optimized format, so when access control decisions are required, they can be made immediately using local data without requiring real-time network communication for data retrieval.
2Loss of energy
If access control policies are distributed to all nodes, then network traffic is reduced, but keeping policies synchronized across all nodes becomes complex
Solution Approach 1:
The patent uses copying by creating and distributing identical copies of access control policies to all nodes in the network. Each node maintains a local copy of the policies in an optimized data structure, eliminating the need for complex synchronization protocols. When policy updates are needed, the updated policies are simply copied to all nodes, ensuring consistency without requiring intricate synchronization mechanisms.
3Adaptability or versatility
If XML serialization/deserialization is used for access control requests, then standardized communication is achieved, but processing time and resource consumption increase
Solution Approach 1:
The patent applies parameter changes by transforming the data format from XML serialization/deserialization to a more efficient internal representation. Nodes store access control policies in optimized data structures such as nested hash maps or decision trees, which enable faster lookup and evaluation. This parameter change in data representation maintains the ability to communicate standardized access control decisions while dramatically improving processing speed and reducing resource consumption.
Data Source
AI summary
One embodiment of the present invention provides a system for distributing an access control service to local nodes. During operation, the system receives, at a node in a network, a policy file comprising access policies for resources in the network, wherein the access policies are associated with attributes of profiles, and wherein the profiles are associated with clients. Next, the system compiles, at the node, the policy file into an optimized data structure. Finally, the system stores, at the node, the optimized data structure in memory to facilitate subsequent local lookups of permissions associated with the attributes and the resources.