Preemptive Authentication Request Processing for Cloud Access Servers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based access servers face high latency in processing authentication requests due to the need to download and evaluate multiple data dependencies for each user access, which can lead to decreased user satisfaction and increased load on Universal Access Management (UAM) servers.
Innovation Solution
Implementing a system that anticipates future authentication requests by pre-loading dependent data and using statistical analysis to identify 'hot' policies and data dependencies, allowing for preemptive processing and evaluation of authorization requests, with the assistance of a replay server to generate and evaluate additional requests based on snapshots from the UAM server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the access server downloads and evaluates multiple data dependencies for each authentication request, then the authentication decision can be made accurately, but the processing latency increases significantly
Solution Approach 1:
The system performs preliminary actions by anticipating future authentication requests and pre-loading dependent data before it is actually needed. The access server uses statistical analysis to identify 'hot' policies and data dependencies that are likely to be requested, then pre-loads this data into memory, thereby eliminating the need to download and evaluate it when the actual authentication request arrives, thus reducing latency while maintaining accuracy
Solution Approach 2:
The system dynamically adapts its data loading strategy based on observed authentication patterns. By continuously analyzing which policies and data dependencies are most frequently accessed and adjusting the pre-loading strategy accordingly, the system optimizes the balance between having sufficient data available (for accuracy) and minimizing unnecessary data loading (for reduced latency)
2Reliability
If the UAM server processes all authentication requests sequentially with full data evaluation, then security and accuracy are maintained, but the server load increases and throughput decreases
Solution Approach 1:
The system performs preliminary evaluation of authentication requests using pre-loaded data and statistical models before the requests reach the UAM server. This preliminary processing filters out obviously authorized or denied requests, reducing the number of full evaluations needed by the UAM server while maintaining security through the accuracy of pre-loaded policy data
Solution Approach 2:
The authentication processing is segmented into multiple stages: (1) preliminary filtering using pre-loaded hot policies and statistical analysis, (2) partial evaluation using cached data, and (3) full evaluation by the UAM server only for requests that require it. This segmentation allows the system to maintain security through comprehensive evaluation when needed while improving throughput by handling routine requests more efficiently
Data Source
AI summary
Disclosed are apparatuses, systems, and techniques that improve efficiency and decrease latency of processing of authorization requests by a cloud service. The techniques include obtaining, from an access server, a snapshot associated with processing an authorization request to evaluate an access to a resource of the cloud service and generating, using the snapshot, preemptive authorization requests by modifying the authorization request with a new user identity or a new resource identity. The techniques further include receiving, from the cloud service, a subsequent authorization request to evaluate an authorization of a user to access a particular resource of the cloud service, determining that the subsequent authorization request corresponds to one of preemptive authorization requests, and providing, to the cloud service, an authorization response for the user to access the resource, based on evaluation of this preemptive authorization request.