Hybrid Policy Execution for Low-Latency Network Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing policy enforcement mechanisms face limitations in flexibility and efficiency, with remote execution causing high latency and network overhead, and local execution being limited to lightweight policies, leading to user experience and security vulnerabilities.
Innovation Solution
A hybrid policy execution mechanism that distributes policy execution between client-side and server-side, allowing for rich policies with context-based filters, enabling partial execution on the client and call-backs to the server for complex conditions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If policy execution is performed remotely at a back-end cloud computing system, then policy enforcement flexibility and security control are improved, but system latency and network communication overhead increase
Solution Approach 1:
The policy execution function is segmented into two parts: a policy engine that remains at the back-end cloud computing system for complex policy evaluation, and a policy cache at the client device for storing pre-evaluated policy decisions. This segmentation allows routine policy checks to be performed locally without network latency, while complex policies can still be evaluated remotely when needed.
Solution Approach 2:
The system performs preliminary policy evaluation at the back-end cloud computing system and caches the results at the client device before they are needed for actual policy enforcement. By pre-evaluating policies and storing decision outcomes in the policy cache, the system avoids repeated network communications for the same policy checks, thereby reducing latency while maintaining enforcement flexibility.
2Productivity
If policy execution is performed locally at the client device, then system latency and network overhead are reduced, but policy complexity and security control capabilities are limited
Solution Approach 1:
The policy cache acts as an intermediary between the client device's local execution capabilities and the back-end cloud computing system's complex policy engine. It stores pre-evaluated policy decisions that can be executed locally with high efficiency, while still allowing the system to access and evaluate complex policies remotely when the cache does not contain applicable decisions or when policy updates are needed.
3Reliability
If full policies are executed remotely for every client action, then comprehensive security evaluation is achieved, but network communication overhead and duplication of effort increase
Solution Approach 1:
The system discards the need to repeatedly transmit full policy details over the network for each client action. Instead, it recovers and stores essential policy decision outcomes in the policy cache at the client device. This allows the system to maintain comprehensive security evaluation capabilities while dramatically reducing network communication overhead by reusing cached policy decisions rather than re-transmitting and re-evaluating full policies for every action.
Data Source
AI summary
A “hybrid” policy execution mechanism is provided herein. A hybrid policy execution server uses initial context data received from a client device is to partially execute a ‘full’ policy, resulting in a (simplified) local policy that can be implemented at the client device. The local policy indicates an action and associated local condition that can be evaluated locally at the client device, enabling the client device to determine whether to perform the action in response to a first trigger event without a further call to the hybrid policy execution server. In certain embodiments, the local policy may indicate a call-back condition, which triggers a call-back to the hybrid policy execution server in response to a second trigger event, e.g. with additional context that is now available to the client device. The call-back mechanism can incorporate richer policy conditions that are evaluated server-side.