Residual Access Policy Indexing for Low-Latency Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identity and access management systems face challenges in scalability and performance, particularly due to synchronous access request evaluations by the Policy Decision Point (PDP), leading to increased latency and potential bottlenecks that affect user experience and competitiveness.
Innovation Solution
Implement policy optimization and verified policy compilation techniques, including pre-computing certain policy sections (residual policies) and transforming policies into an efficient format, to simplify and accelerate access request evaluations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If synchronous access request evaluation is used by the Policy Decision Point, then authorization decisions can be made with high accuracy and completeness, but request latency increases and user experience deteriorates
Solution Approach 1:
The system performs preliminary actions by pre-evaluating access control policies and pre-computing authorization decisions for common access patterns. This allows the PDP to make faster decisions during runtime without sacrificing accuracy, as the complex policy evaluation is done in advance for frequently accessed resources.
Solution Approach 2:
The system creates a simplified copy of the access control policy structure that can be evaluated more quickly. By using a reduced representation of the policy (residual policy) that captures the essential authorization logic without the full complexity, the system achieves faster decision-making while maintaining necessary accuracy.
2Reliability
If comprehensive policy evaluation is performed to ensure secure access control, then security is maintained, but processing throughput decreases and the PDP becomes a bottleneck
Solution Approach 1:
The access control policy is segmented into multiple independent components and evaluation stages. The system divides the policy evaluation into mandatory access control checks, discretionary access control checks, and attribute-based access control checks, allowing parallel processing and reducing the sequential processing time that creates bottlenecks.
Solution Approach 2:
The system changes the parameters of policy evaluation by using different evaluation strategies based on the access request type and resource sensitivity. For high-security resources, comprehensive evaluation is performed; for less critical resources, simplified evaluation is used, optimizing throughput while maintaining security where needed.
3Measurement precision
If complex access control policies are evaluated in detail, then authorization accuracy is improved, but evaluation time increases and user experience suffers
Solution Approach 1:
The system applies partial action by evaluating only the necessary portions of the access control policy for each specific access request. Instead of always performing complete policy evaluation, the system determines the minimum required evaluation depth needed to make an accurate authorization decision, reducing time for cases where full evaluation is not necessary.
Solution Approach 2:
The system introduces an intermediary layer between the access request and the full policy evaluation. This intermediary (the residual policy) acts as a mediator that provides sufficient authorization information without requiring direct evaluation of the complete complex policy, reducing evaluation time while maintaining precision.
Data Source
AI summary
Techniques include optimizing a base access control policy, resulting in a residual access control policy, which is then indexed. Upon receiving an access request, the system retrieves the residual access control policy from the index using the request's attributes. The access request is then evaluated against the residual policy to make an authorization decision, which is promptly returned. This streamlined process efficiently evaluates and determines authorization, enhancing the speed and accuracy of access control decisions.