IP Library › Granted Patent US 12675560

Granted Patent B1

US 12675560 · App. 18/424,992 · Granted Jul 7, 2026

Systems and methods for improved high-volume computer service access management

Inventors: Thomas J. Dvorachek (Kensington, CT); Anupam K. Sharma (Rocky Hill, CT); Eric Nuzzi (Avon, CT)

Assignee: The Travelers Indemnity Company

G06F21/31

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12675560
App. No.: 18/424,992
Granted: Jul 7, 2026
Kind: B1

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Systems, apparatus, methods, and articles of manufacture for improved high-volume computer service access management, such as a computerized environment that executes a specially-programmed interception application that evaluates service requests prior to forwarding such requests to a designated service or application.

Claims (61)

1 . An access management system for providing pre-authentication and authorization with respect to access to a computer service operating within a computing environment, thereby reducing a number of queries sent to an Active Directory (AD), comprising:

a server comprising a plurality of processing devices;

a cache memory in communication with the server; and

at least one non-transitory computer-readable memory device in communication with the server, the memory device storing (i) a second service, (ii) an access management tool, (iii) a directory, and (iv) instructions that when executed by at least one of the plurality of processing devices, result in:

receiving, from a client device of a client comprising a first service and by at least one of the plurality of processing devices, a call to the second service, the call comprising data defining (a) an identifier of the first service, (b) a password, and (c) an identifier of the second service;

intercepting, by the access management tool, the call to the second service;

querying, by the access management tool and utilizing the identifier of the second service, the cache memory;

identifying, by the access management tool and based on the querying of the cache memory utilizing the identifier of the second service, that the cache memory does not contain a stored record of the identifier of the first service with respect to the identifier of the second service;

querying, by the access management tool, after the identifying that the cache memory does not contain the stored record of the identifier of the first service with respect to the identifier of the second service, and utilizing the identifier of the second service, the directory;

identifying, by the access management tool and based on the querying of the directory utilizing the identifier of the second service, that the directory contains a stored record of the identifier of the second service;

querying, by the access management tool, after the identifying that the directory contains the stored record of the identifier of the second service, and utilizing the identifier of the first service, the directory;

identifying, by the access management tool and based on the querying of the directory utilizing the identifier of the first service, that the directory contains the stored record of the identifier of the first service with respect to the identifier of the second service;

querying, by the access management tool, after the identifying that the directory contains the stored record of the identifier of the first service with respect to the identifier of the second service, and utilizing the identifier of the first service and the password, the directory;

identifying, by the access management tool and based on the querying of the directory utilizing the identifier of the first service and the password, that the directory contains a stored record of the identifier of the first service with respect to the password;

storing, by the access management tool, and after the identifying (i) that the directory contains the stored record of the identifier of the second service, (ii) that the directory contains the stored record of the identifier of the first service with respect to the identifier of the second service, and (iii) that the directory contains the stored record of the identifier of the first service with respect to the password, the (a) identifier of the first service, (b) password, and (c) identifier of the second service, in the cache memory; and

forwarding, by the access management tool, and after the identifying (i) that the directory contains the stored record of the identifier of the second service, (ii) that the directory contains the stored record of the identifier of the first service with respect to the identifier of the second service, and (iii) that the directory contains the stored record of the identifier of the first service with respect to the password, the call to the service.

2 . The access management system of claim 1 , wherein the first service comprises a first service in the computing environment and the second service that is called comprises a second service in the computing environment.

3 . The access management system of claim 2 , wherein the second service comprises an application container.

4 . The access management system of claim 1 , wherein each of the access management tool and the second service are encapsulated in a single pod.

5 . The access management system of claim 4 , wherein the access management tool is configured to intercept all communications incoming to the single pod.

6 . The access management system of claim 1 , further comprising:

a router service.

7 . The access management system of claim 6 , wherein the intercepting of the call to the second service by the access management tool, comprises:

identifying, by the router service, the call to the second service;

routing the call to the second service, by the router service, to the access management tool; and

receiving, by the access management tool, the call to the second service.

8 . The access management system of claim 1 , wherein the call to the second service comprises a message packet and a message header and where the data defining the (a) identifier of the first service and (b) password are defined by the message header.

9 . The access management system of claim 1 , wherein the directory comprises a Lightweight Directory Service (LDS).

10 . The access management system of claim 1 , wherein the instructions, when executed by the at least one of the plurality of processing devices, further result in:

identifying, by the access management tool, at least one of a time and a data capacity threshold;

comparing, by the access management tool, the identified threshold to at least one of a current time and a current data usage parameter value;

identifying, by the access management tool, that the identified threshold is exceeded; and

clearing, in response to the identifying that the identified threshold is exceeded, the cache memory.

11 . An access management method for providing pre-authentication and authorization with respect to access to a computer service operating within a computing environment, thereby reducing a number of queries sent to an Active Directory (AD), comprising:

receiving, from a client device of a client comprising a first service and by at least one of a plurality of processing devices of a server, a call to a second service defined by code stored in at least one non-transitory computer-readable memory device in communication with the server, the call comprising data defining (a) an identifier of the first service, (b) a password, and (c) an identifier of the second service;

intercepting, by an access management tool stored in the at least one non-transitory computer-readable memory device, the call to the second service;

querying, by the access management tool and utilizing the identifier of the second service, a cache memory in communication with the server;

identifying, by the access management tool and based on the querying of the directory utilizing the identifier of the first service, that the directory contains a stored record of the identifier of the first service with respect to the identifier of the second service;

12 . The access management method of claim 11 , wherein the first service comprises a first service in the computing environment and the second service that is called comprises a second service in the computing environment.

13 . The access management method of claim 12 , wherein the second service comprises an application container.

14 . The access management method of claim 11 , wherein each of the access management tool and the second service are encapsulated in a single pod.

15 . The access management method of claim 14 , wherein the access management tool is configured to intercept all communications incoming to the single pod.

16 . The access management method of claim 11 , wherein the call to the second service comprises a message packet and a message header and where the data defining the (a) identifier of the first service and (b) password are defined by the message header.

17 . The access management method of claim 11 , wherein the intercepting of the call to the second service by the access management tool, comprises:

identifying, by a router service, the call to the second service;