PAM and LDAP JIT Access Control for Time-Bound Linux Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user access management systems face challenges in balancing latency and load due to cache-based models, leading to high latency and/or high load, and there is a need for a low latency, low load access control system that enforces time-bound access rules.
Innovation Solution
A system leveraging Pluggable Authentication Modules (PAM) and Lightweight Directory Access Protocol (LDAP) for real-time access control, enabling just-in-time (JIT) access by querying LDAP directories for dynamic access rules, reducing latency to milliseconds and minimizing unnecessary queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a cache-based access control system is used, then access control functionality is provided, but latency increases and system load increases
Solution Approach 1:
The patent extracts the access control decision logic from the cache-based system and implements it through JIT-ACL (Just-In-Time Access Control Layer) that queries LDAP directories in real-time. This removes the dependency on cached data and enables dynamic access control decisions based on current user credentials and time-bound rules, thereby reducing latency while maintaining security functionality.
Solution Approach 2:
The system transitions from static cache-based access control to dynamic real-time access control. The JIT-ACL module dynamically queries LDAP directories for current user credentials and time-bound access rules at the moment of access request, allowing access decisions to adapt to changing conditions rather than relying on pre-fetched cached data.
2Reliability
If a cache-based access control system is used, then access control functionality is provided, but system load increases
Solution Approach 1:
The patent extracts the access control decision logic from the cache-based system and implements it through JIT-ACL (Just-In-Time Access Control Layer) that queries LDAP directories in real-time. This removes the dependency on cached data and enables dynamic access control decisions based on current user credentials and time-bound rules, thereby reducing latency while maintaining security functionality.
Solution Approach 2:
The system transitions from static cache-based access control to dynamic real-time access control. The JIT-ACL module dynamically queries LDAP directories for current user credentials and time-bound access rules at the moment of access request, allowing access decisions to adapt to changing conditions rather than relying on pre-fetched cached data.
3Loss of time
If cache refresh interval is reduced, then latency decreases, but system load increases
Solution Approach 1:
The system performs preliminary authentication of users against LDAP directories before access is granted. By validating user credentials and accessing time-bound rules in advance through real-time LDAP queries, the system ensures that access decisions are based on current information without requiring continuous cache refreshing, thus reducing both latency and load.
Solution Approach 2:
The JIT-ACL module serves itself by directly querying LDAP directories for the specific information needed at the moment of access, rather than relying on pre-fetched cached data. This self-service approach eliminates the need for periodic cache refresh operations and reduces system load while maintaining low latency through direct real-time queries.
Data Source
AI summary
Usage of Pluggable Authentication Module (PAM) for time bound access control to any PAM enabled Linux application predicated by rules stored in an LDAP directory including a processor to execute computer-executable instructions for receiving a user information from a user interface indicative of a user, receiving an access request via PAM indicative of the user information, a time of invocation of the access request and the host server, querying a lightweight directory access protocol directory in response to the user information and the request, receiving a plurality of attribute values associated with the user information including a time bound access limit and a host access restriction information, and coupling an access success response to the pluggable access module in response to a host server access allowance indicated by the host access restriction information for the host service and the time of invocation being within the time bound access limit.