Prefetching Access Control Attributes to Reduce Network Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed enterprise systems, the evaluation of access control requests is delayed due to substantial network communication required for resolving attributes through a trial and error approach between centralized policy decision points and distributed policy enforcement points.
Innovation Solution
Prefetching all required attributes before the evaluation process by constructing a mapping of attributes and storing them in a prefetch database, allowing the centralized policy decision point to resolve global and PDP attributes without needing communication with client applications, while the PEP module resolves and transmits service attributes initially.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If the trial and error approach is used to resolve attributes through iterative communication between centralized policy decision point and distributed policy enforcement points, then the system maintains stateless operation and simple architecture, but the network communication overhead increases substantially and evaluation time is delayed
Solution Approach 1:
The patent applies preliminary action by prefetching and caching all required attributes at the policy enforcement point before the access control evaluation begins. This is achieved by the PEP module identifying and retrieving all attributes needed for evaluation in advance, storing them locally, and making them available immediately when evaluation is requested, thereby eliminating iterative network communication during the actual evaluation process.
2Device complexity
If the trial and error approach is used to resolve attributes, then the centralized policy decision point remains stateless, but substantial network communication is required between centralized policy decision point and distributed policy enforcement points
Solution Approach 1:
The patent extracts the attribute resolution process from the centralized policy decision point and relocates it to the distributed policy enforcement point. The PEP module independently identifies, retrieves, and caches all required attributes locally, removing the need for repeated network communication with the centralized PDP for attribute resolution, thereby reducing network overhead while maintaining the stateless nature of the PDP.
3Reliability
If attributes are resolved through iterative requests in the trial and error approach, then the policy decision point can evaluate access control requests using available information, but the evaluation process is repeated multiple times increasing network load
Solution Approach 1:
The patent applies preliminary action by having the PEP module prefetch and cache all required attributes before the access control evaluation begins. This ensures that when evaluation is requested, all necessary attributes are already available locally at the PEP, allowing the centralized PDP to perform accurate evaluation in a single pass without repeated requests, thereby improving both reliability and productivity.
Data Source
AI summary
In an embodiment, a method is provided for prefetching attributes used in access control evaluation. In this method, an access control policy that comprises rules is retrieved. These rules further comprise parameters. At least one of the rules is categorized into a class from multiple classes based on at least one of the parameters. Here, the class is a grouping based on at least one of these parameters. An attribute associated with the at least one of these parameters is identified and this attribute is mapped to the class.