Execution-Path Authorization to Cut Access Control Latency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing centralized and decentralized authorization systems face inefficiencies and latency issues due to the need for constant synchronization of sidecar services with centralized authorization, leading to delayed or prevented access control based on the execution path status of services.
Innovation Solution
A method and system that identify and rank execution paths based on probability, automatically generating node access authorizations based on the most probable path, allowing dynamic access control and reducing synchronization needs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized authorization system is used, then authorization decisions are made by a dedicated service, but network authorization requests and waiting for decisions cause latency and delay access control
Solution Approach 1:
The system pre-calculates and stores execution paths and their probabilities in prior authorization data before runtime. When authorization is needed, the system quickly retrieves pre-computed path information rather than calculating it in real-time, significantly reducing authorization latency while maintaining accurate decision-making based on the most probable execution path.
2Speed
If a decentralized authorization system with sidecar services is used, then authorization decisions are fulfilled locally, but constant synchronization with centralized service is required causing complexity and potential synchronization delays
Solution Approach 1:
The system extracts the synchronization requirement by using pre-computed execution path data that can be periodically updated without requiring constant real-time synchronization. The sidecar services store local copies of authorization data with execution paths, allowing fast local decisions while reducing synchronization frequency and complexity compared to continuous synchronization requirements.
3Adaptability or versatility
If access control depends on runtime status of current service, then dynamic path selection is possible, but frequent authorization updates and synchronization are needed increasing latency and connectivity requirements
Solution Approach 1:
The system pre-computes multiple possible execution paths and their probabilities during off-peak times or during service deployment. These pre-computed paths are stored in the authorization data and can be quickly selected at runtime based on current service status without requiring real-time calculation or frequent synchronization updates, thus maintaining dynamic adaptability while reducing update time.
4Reliability
If multiple execution paths are monitored with dynamic authorization, then accurate access control is achieved, but constant synchronization and path monitoring increase system complexity and latency
Solution Approach 1:
The system implements path monitoring and probability calculation in a centralized location offline, then distributes the results to sidecar services. Each sidecar service maintains local authorization data with pre-computed execution paths and their probabilities, allowing accurate access control decisions locally without requiring complex distributed monitoring infrastructure across all services.
Data Source
AI summary
A method is provided for dynamic authorization based on execution path status. The method includes identifying a plurality of execution paths in prior authorization data, in which each execution path contains a plurality of nodes. The identified plurality of execution paths are ranked according to probability. At least part of a most probable execution path from among the ranked plurality of execution paths is determined for a current user based on a current node. Node access authorizations are automatically generated based on the at least part of the determined most probable execution path.