Token-Based Context Caching for Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems face inefficiencies in managing access to resources due to the need to process large numbers of attributes for access decisions, which can slow down the access control process.
Innovation Solution
A token-based system that uses tokens to represent sets of attributes, allowing for faster and more efficient access control by examining tokens rather than individual attributes, and includes mechanisms for caching and updating attributes based on token changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the security system processes all attributes for access decisions, then the access control is comprehensive and secure, but the processing time increases and efficiency decreases
Solution Approach 1:
The patent segments attributes into two categories: cached attributes (those that change infrequently and can be pre-processed) and non-cached attributes (those that change frequently and require real-time processing). This segmentation allows the system to process only necessary attributes during access decisions, reducing processing time while maintaining security through selective attribute evaluation.
Solution Approach 2:
The system performs preliminary processing by caching attributes that are likely to be required for future access decisions. These cached attributes are prepared in advance and stored for quick retrieval, eliminating the need to re-process them during each access decision, thus reducing processing time while maintaining comprehensive security checks.
2Speed
If the system caches all attributes for quick access, then the access control speed improves, but the memory requirements and system complexity increase
Solution Approach 1:
The patent applies local quality by caching only specific attributes that are most likely to be required for access decisions, rather than caching all attributes uniformly. The system determines which attributes to cache based on their likelihood of being needed, creating a selective cache that optimizes speed while minimizing memory usage and complexity.
Solution Approach 2:
The system dynamically adjusts cache management parameters based on changing conditions. When attributes change (detected through tokens indicating changes during sessions), the system updates or removes affected cached attributes. This dynamic parameter adjustment allows the system to maintain optimal cache performance without excessive complexity.
3Productivity
If the system maintains a large cache of attributes, then the processing efficiency improves, but the memory consumption increases
Solution Approach 1:
The system implements partial caching by storing only the subset of attributes that are most frequently needed for access decisions, rather than caching all possible attributes. This partial action approach achieves significant productivity improvement while avoiding the excessive memory consumption that would result from caching every attribute.
Solution Approach 2:
The cache is designed to be dynamic, automatically updating or removing attributes based on change tokens received during sessions. This dynamic behavior allows the cache size to adapt to actual needs, maintaining high processing efficiency while preventing unnecessary memory consumption from storing static or obsolete attributes.
Data Source
AI summary
According to one embodiment, an apparatus may receive a token that indicates a change that occurs during a session. The session may facilitate access to a resource. The token may indicate a risk token should be computed. The apparatus may determine, from the token, a first set of attributes. The first set of attributes may include attributes required to compute the risk token. The apparatus may determine that a cache contains a set of cached attributes. The apparatus may examine an attribute in the set of cached attributes, and determine the attribute in the set of cached attributes is not in the first set of attributes. The apparatus may then remove the attribute in the set of cached attributes from the cache.