Distributed Directory Caching for Secure Resource Access

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Centralized storage of directory data in security services increases the attack surface, leads to inefficiencies, and requires management of multiple privileged accounts, causing performance issues and unreliability in large computing networks.

Innovation Solution

Implementing distributed directory caching techniques where directory data is cached locally on client devices, eliminating the need for centralized storage and reducing the requirement for privileged accounts, with optional use of digital signatures or encryption for enhanced security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Device complexity

If directory data is stored centrally in a security service, then security management is simplified, but the attack surface increases and system reliability decreases

Engineering Contradiction:
Improvesecurity management complexityVSAvoidattack surface
Core Design Contradiction:
Device complexityVSObject-affected harmful factors

Solution Approach 1:

The patent segments the centralized directory data storage into distributed client-side caches. Each client device maintains its own local directory data cache, eliminating the single point of failure and reducing the attack surface. The security service no longer holds all directory data centrally, but rather verifies credentials against distributed local caches across multiple clients.

Inventive Principle:
Principle #1Segmentation

2Stability of the object's composition

If directory data is stored centrally in a security service, then data consistency is maintained, but performance efficiency deteriorates due to network dependencies

Engineering Contradiction:
Improvedata consistencyVSAvoidresource access performance
Core Design Contradiction:
Stability of the object's compositionVSProductivity

Solution Approach 1:

The patent implements preliminary action by pre-caching directory data locally on each client device before it is needed for authentication. Clients retrieve and store directory data in advance, so that when resource access is requested, the security service can verify credentials using local cached data without network delays, significantly improving performance while maintaining data consistency through periodic updates.

Inventive Principle:
Principle #10Preliminary action

3Ease of operation

If centralized directory data storage is used, then security policy enforcement is simplified, but system reliability decreases due to single point of failure

Engineering Contradiction:
Improvesecurity policy enforcementVSAvoidsystem availability
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The patent segments the centralized security infrastructure into distributed client-side authentication capabilities. Each client device with a local directory data cache can independently verify credentials and enforce security policies without requiring continuous connection to the central security service, eliminating the single point of failure and improving system reliability while maintaining policy enforcement through local verification logic.

Inventive Principle:
Principle #1Segmentation

4Reliability

If multiple privileged accounts are managed for security service access, then directory service functionality is ensured, but account management complexity increases

Engineering Contradiction:
Improvedirectory service functionalityVSAvoidaccount management complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the need for multiple privileged accounts by enabling unprivileged client devices to cache and verify directory data locally. Instead of requiring the security service to manage multiple privileged accounts for different clients, each client independently caches its own directory data and uses it for self-verification, eliminating the complexity of privileged account management while maintaining directory service functionality.

Inventive Principle:
Principle #2Taking out (Extraction)

Data Source

PatentEP3934197B1Distributed directory caching techniques for secure and efficient resource access
Publication Date: 2024.06.26 CYBER ARK SOFTWARE LTD
  • EP3934197B1 patent drawingFigure 1
  • EP3934197B1 patent drawingFigure 2A
  • EP3934197B1 patent drawingFigure 2B

AI summary

The disclosed embodiments relate to systems and methods for secure and efficient resource access using distributed directory caching techniques. Techniques include obtaining, from a directory service, client directory data associated with a client; providing the client directory data to a computing device associated with the client for caching on the computing device; identifying a request from the client; receiving, from the computing device, the client directory data that was cached on the computing device; and evaluating the request based on the received client directory data.