Parallel Search Access Control for Nested Group Permissions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing identity management systems face delays in access control due to the time-consuming process of exploring complex nested group memberships, which adversely affects user experience and server processing burden.
Innovation Solution
Implementing a parallel search approach and a bidirectional search approach to reduce the time required for access control by performing multiple searches in stages and using simultaneous forward and backward searches to determine user permissions, respectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If traditional sequential search approach is used to explore nested group memberships, then access control accuracy is maintained, but access control time increases significantly
Solution Approach 1:
The patent segments the access control process into multiple independent search tasks that can be executed in parallel. Instead of performing a single sequential search through nested group memberships, the system divides the search into multiple branches that explore different group hierarchy paths simultaneously, thereby reducing the total time required to determine user permissions.
Solution Approach 2:
The patent performs preliminary actions by pre-computing and caching group membership information before actual access control decisions are needed. The system proactively explores and stores group hierarchy relationships in advance, so that when access control is required, the information is already available or can be quickly retrieved, reducing the time penalty for complex nested group structures.
2Reliability
If comprehensive group membership exploration is performed to ensure accurate permission determination, then access control reliability is improved, but server processing burden increases
Solution Approach 1:
The patent segments the complex permission determination process into multiple independent parallel search tasks. Each search task handles a specific branch of the group hierarchy, allowing the server to process different parts of the permission structure simultaneously rather than sequentially, thereby maintaining comprehensive exploration while reducing processing complexity.
Solution Approach 2:
The patent introduces an intermediary caching mechanism that stores pre-computed group membership information. This intermediary layer between the user and the permission verification system reduces the direct processing burden on the server by providing quickly accessible cached data, while still ensuring accurate permission determination through comprehensive initial exploration.
3Ease of operation
If parallel search approach is implemented to reduce access control time, then user experience is improved, but system resource consumption increases
Solution Approach 1:
The patent applies partial action by implementing parallel search with limited concurrency control. Instead of launching unlimited parallel search tasks, the system performs a controlled number of parallel searches simultaneously, balancing the need for fast access control with reasonable resource consumption. The parallelism is applied selectively to the most critical search paths.
Solution Approach 2:
The patent uses periodic action through staged permission granting. Instead of waiting for complete permission verification before any resource access, the system grants permissions in stages as search results become available, providing improved user experience early in the process while continuing background searches to refine permissions, thereby spreading resource consumption over time.
Data Source
AI summary
An example method is provided for a computing device to perform access control for a user account. The method may comprise receiving a request for the user account to access a resource; determining a first permission set and a second permission set required to access the resource; and performing a first search and a second search in parallel. Prior to receiving results from the second search and in response to determination that the user account is assigned to the first permission set based on results of the first search, permitting the user account to access the resource using the first permission set; and in response to determination that the user account is assigned to the second permission set based on results of the second search, permitting the user account to access the resource using the second permission set.