Hybrid Authorization Policy Evaluation With Selective Remote Attributes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Microservices architecture in cloud applications face inefficiencies in authorization processing due to large data replication or remote API calls, leading to reduced processing speed and increased response times.
Innovation Solution
A hybrid authorization system combining local and remote servers to parse policy expressions into abstract syntax trees, locally evaluating available data and retrieving necessary additional data from a remote server, optimizing computation and memory usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authorization data is replicated in the application service database, then authorization evaluation can be performed locally, but the data size becomes very large and processing speed is reduced
Solution Approach 1:
The patent segments the authorization data into multiple parts: frequently accessed authorization rules are cached locally in the application service database, while the complete authorization data remains distributed across microservice databases. This segmentation allows local evaluation of common cases while maintaining access to comprehensive data when needed.
Solution Approach 2:
The patent implements preliminary action by pre-caching authorization rules that are likely to be frequently accessed into the application service database before they are needed. This allows the system to perform local evaluation for common authorization scenarios without requiring real-time data retrieval from remote microservices.
2Productivity
If authorization data is not present in the application service database, then data size remains small, but processing speed is reduced due to remote API calls
Solution Approach 1:
The system performs preliminary action by proactively caching authorization rules into the application service database based on access patterns and importance metrics, so that frequently needed data is already available locally when authorization requests arrive, eliminating the need for remote API calls in those cases.
Solution Approach 2:
The patent changes parameters by dynamically adjusting the caching strategy based on authorization rule characteristics such as access frequency, importance level, and data size. This allows the system to optimize the balance between local cache size and remote data retrieval based on actual usage patterns.
3Loss of time
If all necessary authorization data is cached locally, then remote API calls are eliminated, but memory consumption increases significantly
Solution Approach 1:
The patent segments authorization data by caching only the most frequently accessed and important authorization rules locally, while leaving less frequently accessed rules in remote microservice databases. This selective segmentation optimizes memory usage while maintaining fast response times for common authorization scenarios.
Solution Approach 2:
The system changes parameters by dynamically adjusting cache size and eviction policies based on available memory resources and access patterns. This allows the system to adapt memory consumption to actual needs, caching more data when memory is abundant and fewer rules when memory is constrained.
4Quantity of substance
If remote authorization service is used, then data storage remains efficient, but the response data set becomes larger and processing slower
Solution Approach 1:
The patent segments the authorization evaluation process into two phases: first, evaluate cached local data to quickly determine if authorization can be granted; second, only if needed, retrieve additional data from remote microservices. This segmentation enables fast evaluation for cached cases while maintaining data storage efficiency.
Solution Approach 2:
The system applies partial action by performing authorization evaluation using only the cached subset of authorization rules when sufficient for the request, rather than always retrieving and processing the complete authorization data set from remote services. This partial evaluation achieves sufficient results faster for many cases.
Data Source
AI summary
Disclosed herein are system, method, and computer program product embodiments for hybrid-type authorization. An embodiment operates by parsing a policy expression into an abstract syntax tree (AST) and receiving, from a local server, user attribute data of a user. The embodiment further operates by traversing the AST to evaluate the user attribute data and determining whether a result of the traversing is indeterminate. In addition the embodiment operates by sending, to a remote server, a request for additional user attribute data in response to determining that the result is indeterminate, and receiving, from the remote server, the additional user attribute data. Then the embodiment operates by re-traversing the AST to evaluate the user attribute data and the additional user attribute data, authorizing the user based on at least one of the traversing or re-traversing, and outputting an authorization result.