Group Membership Record Maintenance for Directory Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current directory services, such as Active Directory, do not efficiently identify indirect relationship changes or provide historical membership data within group membership hierarchies, making electronic discovery and audit processes time-consuming and resource-intensive, especially in large organizations.
Innovation Solution
A computer-implemented method and system for maintaining group membership records that track direct and indirect relationships, update records based on membership updates, and provide historical records by deducing changes in indirect relationships using a membership hierarchy, allowing for efficient identification and management of group information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If traditional directory services (e.g., Active Directory) are used to track group membership relationships, then direct relationship changes can be identified, but indirect relationship changes cannot be identified and historical membership data is not provided
Solution Approach 1:
The system performs preliminary actions by maintaining a cached copy of the entire group membership hierarchy and pre-computing all direct and indirect relationships. When a membership change occurs, the system has already prepared the data structure to quickly deduce indirect relationship changes without needing to traverse the entire hierarchy at query time.
Solution Approach 2:
The system creates a copy of the group membership hierarchy in a cache structure that mirrors the directory service. This copy contains all objects and their relationships, allowing the system to perform relationship deductions locally without querying the original directory service, thereby capturing both direct and indirect relationships efficiently.
2Measurement precision
If electronic discovery applications traverse the entire Active Directory to identify group membership information, then complete membership data can be obtained, but the process takes weeks and consumes significant resources
Solution Approach 1:
The system pre-computes and caches all direct and indirect relationships between objects in the group membership hierarchy before electronic discovery is needed. This preliminary computation builds a complete relationship map that can be queried instantly, eliminating the need for time-consuming traversals during actual discovery operations.
Solution Approach 2:
The system introduces a cached relationship map as an intermediary between the directory service and the electronic discovery application. This intermediary structure pre-stores computed relationships, allowing the discovery application to query relationships directly from the cache without traversing the original directory hierarchy, thus dramatically reducing query time while maintaining completeness.
3Ease of operation
If recursive traversal of Active Directory is performed to identify group membership changes, then current membership information can be obtained, but the process is unreliable due to run-time errors and cannot provide historical data
Solution Approach 1:
The system creates a stable cached copy of the group membership hierarchy that captures the state at a specific point in time. This copy is updated incrementally as changes occur, providing a reliable historical record that can be queried without risking run-time errors associated with traversing the live directory structure.
Solution Approach 2:
The system performs preliminary actions by establishing a snapshot of the membership hierarchy and pre-computing all relationships within that snapshot. This preliminary computation ensures data consistency and reliability, as the relationships are determined once during cache population rather than being computed dynamically during queries, eliminating run-time errors.
4Measurement precision
If full synchronization of the entire group membership hierarchy is performed frequently to capture changes, then current and historical data accuracy is improved, but the computational resources and time required increase significantly
Solution Approach 1:
The system performs partial synchronization by updating only the portions of the cached hierarchy that have changed, rather than re-synchronizing the entire structure. When a membership change is detected, the system identifies only the affected objects and their relationships, updating the cache incrementally to maintain accuracy while minimizing computational overhead.
Solution Approach 2:
The system uses feedback mechanisms to detect changes in the group membership hierarchy and triggers selective cache updates only when changes occur. This event-driven approach allows the system to maintain high accuracy by continuously syncing with the directory service while avoiding unnecessary full synchronizations, thus improving productivity.
Data Source
AI summary
A method for maintaining group membership records includes 1) maintaining a record of group memberships for a membership hierarchy, the membership record identifying a direct relationship between a first object and a second object in the membership hierarchy, 2) receiving a membership update indicating that, as of a first point in time, a direct relationship between the second object and a third object changed, 3) updating the record of group memberships to reflect the change in the relationship between the second object and the third object, 4) deducing, based on the membership update and the record of group memberships, a change in an indirect relationship between the first object and the third object as of the first point in time, and 5) providing a view of object relationships within the membership hierarchy as the object relationships exist at the first point in time and a historical record of object relationships.