Session Authorization Re-Execution for Dynamic Policy Changes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authorization processes in cloud computing networks do not effectively adapt to changes in access policies during a session, leading to potential misalignment between authorized actions and actual permissions.
Innovation Solution
Periodically or intermittently re-executing authorization processes during a session to determine updated sets of authorized actions based on current access policies, triggered by time intervals or events, and utilizing cached identity information to streamline the process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If authorization process is executed only once at session start, then system performance and efficiency are improved, but authorization accuracy and policy alignment deteriorate
Solution Approach 1:
The authorization process is re-executed periodically at predetermined intervals during the session rather than only once at the beginning. This periodic re-execution ensures that access policies are continuously evaluated and updated, maintaining authorization accuracy while optimizing the timing of re-executions to balance system efficiency.
Solution Approach 2:
The system implements feedback mechanisms where changes in access policies are detected and trigger re-execution of the authorization process. This feedback loop ensures that when policies change, the authorization status is automatically re-evaluated, maintaining reliability without requiring continuous periodic checks.
2Reliability
If authorization process is re-executed frequently, then authorization accuracy and policy alignment are improved, but system performance and processing overhead worsen
Solution Approach 1:
The system re-executes authorization at predetermined intervals rather than continuously, achieving a balance between policy alignment and processing efficiency. The periodic nature allows the system to maintain accurate authorization status while avoiding excessive processing overhead.
Solution Approach 2:
The authorization re-execution frequency is made dynamic rather than static. The system adjusts the timing and frequency of re-executions based on session context, policy change rates, and system load, optimizing the balance between reliability and productivity for different operational conditions.
3Adaptability or versatility
If authorization process is re-executed during session, then adaptability to policy changes is improved, but session continuity and user experience worsen
Solution Approach 1:
The system performs periodic authorization re-executions at predetermined intervals that are designed to minimize disruption to session continuity. By spacing re-executions appropriately, the system maintains adaptability to policy changes while preserving user experience and session flow.
Solution Approach 2:
The system evaluates authorization changes in advance of when they would impact the user session. By re-executing authorization periodically and proactively, the system can detect and respond to policy changes before they disrupt session continuity, maintaining both adaptability and user experience.
Data Source
AI summary
A system executes an authorization process for initiating a session with a computing entity. Executing the authorization process includes determining an identity associated with the computing entity, identifying a current set of access policies associated with the identity, and determining, based on the current set of access policies, a first set of actions that the computing entity is authorized to perform. While executing the session, the system executes a first action in accordance with the current set of access policies. Subsequent to executing the first action, the set of access policies is modified. The system detects an occurrence of a trigger condition, and in response, re-executes the authorization process for the session, including determining, based on the modified set of access policies, a second set of actions the computing entity is authorized to perform that differs from the first set of actions.