Partial Evaluation for Remote Attribute Retrieval in Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems face inefficiencies in evaluating attribute-based access control policies due to the need to fetch all attributes from remote sources, leading to high latency and poor scalability, especially when policies are large or nested.
Innovation Solution
Implement a method that reduces the policy by substituting attribute values and caching implicit references, allowing for partial evaluation and efficient retrieval of only necessary attribute values from remote sources, thereby reducing the number of calls and improving processing speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all attributes are fetched from remote sources to evaluate access control policies, then complete policy evaluation can be achieved, but latency increases and scalability deteriorates
Solution Approach 1:
The patent applies preliminary action by performing partial evaluation of the access control policy before actually fetching remote attributes. The system analyzes the policy structure and request attributes in advance to determine which remote attributes are actually needed, fetching only those specific attributes rather than all possible attributes. This preliminary analysis step reduces unnecessary remote calls and latency while ensuring complete evaluation of only the necessary policy conditions.
Solution Approach 2:
The patent extracts only the necessary remote attributes from the complete set of possible attributes. By analyzing the policy rules and request context, the system identifies and extracts specifically which remote attributes are required for evaluation, ignoring irrelevant attributes. This extraction principle reduces the number of remote calls made while maintaining complete policy evaluation for the relevant attributes.
2Measurement precision
If all attributes are fetched from remote sources, then accurate access decisions can be made, but the number of remote calls increases and processing speed decreases
Solution Approach 1:
The system performs preliminary analysis of the access control policy and request attributes to pre-determine which remote attributes are necessary for accurate decision-making. This preliminary action allows the system to fetch only the essential attributes needed for accurate access decisions, maintaining measurement precision while reducing the total number of remote calls and improving processing speed.
Solution Approach 2:
The patent applies partial action by fetching only the subset of remote attributes that are necessary for accurate access decisions, rather than fetching all possible attributes. The partial evaluation approach retrieves exactly the right amount of information needed for accurate decisions without the overhead of excessive attribute fetching, thereby improving productivity while maintaining decision accuracy.
3Reliability
If complete policy evaluation is performed by fetching all remote attributes, then all policy conditions can be checked, but system scalability is poor
Solution Approach 1:
The system performs preliminary analysis to identify only the necessary remote attributes for the specific access request and policy combination. This preliminary action enables the system to scale efficiently by avoiding unnecessary remote calls while maintaining complete evaluation of relevant policy conditions. The approach adapts to different policies and requests dynamically, improving system scalability without sacrificing evaluation completeness.
Solution Approach 2:
The patent implements partial evaluation by fetching only the necessary subset of remote attributes required for the specific access decision, rather than all attributes. This partial approach allows the system to handle larger numbers of requests and policies efficiently, improving scalability while maintaining complete evaluation of the relevant policy conditions for each request.
Data Source
AI summary
An attribute-based policy defining subjects' access to resources is enforced by a computer system. A processing means (PDP) in the system communicates with a nearby attribute value source and at least one remote attribute value source and is adapted to evaluate the policy for an access request containing one or more explicit attribute values, which together with the policy define at least one implicit reference to a further attribute value, which is retrievable from one of said attribute value sources. The processing means reduces the policy by substituting attribute values for attributes in the policy if they are contained in the request or retrievable from the nearby source. References to further attributes retrievable from a remote source only are cached together with intermediate results. All attribute values from a given remote source are retrieved on one occasion, and the intermediate results are used to terminate the evaluation.