Granted Patent B2

US 12,476,972 · App. 17/731,592 · Granted Nov 18, 2025

Inventors: Leigh Griffin (Waterford, IE); Pierre-Yves Chibon (Paris, FR)

Assignee: Red Hat, Inc.

H04L63/101H04L9/0643H04L63/102H04L63/20

Abstract

Claims (104)

1 . A non-transitory computer-readable medium comprising program code that is executable by a processor for causing the processor to:

receive a first access request from a client device of a user for accessing a particular resource in a computer network;

receive, from a role-based access control (RBAC) system of the computer network, a first response approving or denying the first access request based on an access control policy selected by the RBAC from among a plurality of access control policies, wherein the access control policy is selected by the RBAC from among the plurality of access control policies based on multiple factors including the user, the particular resource to be accessed, and a particular action to be performed with respect to the particular resource;

store a data entry indicating the first response to the first access request;

in an operation distinct from storing the data entry, set a flag to a first value, wherein the flag comprises a binary value and is distinct from the data entry and the first response;

subsequent to setting the flag to the first value:

receive a second access request from the client device for accessing the particular resource;

based on receiving the second access request, determine whether the flag is set to the first value; and

based on determining that the flag is set to the first value:

extract the first response from the data entry; and

use the extracted first response as a second response for the second access request, the second response being generated without using the access control policy; and

dynamically switch the flag between the first value and a second value over time based on changing operating conditions in the computer network, wherein when the flag is set to the first value, access requests from the client device for the particular resource are handled using the stored first response in the data entry rather than the access control policy, and wherein when the flag is set to the second value, access requests from the client device for the particular resource are handled using the access control policy rather than the stored first response in the data entry.

2 . The non-transitory computer-readable medium of claim 1 , further comprising program code that is executable by the processor for causing the processor to, prior to receiving the second access request:

determine a number of times that access requests have been received for accessing the particular resource;

determine that the number of times exceeds a predetermined threshold;

in response to determining that the number of times exceeds the predetermined threshold:

store the data entry in a datastore; and

set the flag to the first value.

3 . The non-transitory computer-readable medium of claim 1 , wherein the data entry includes a correlation between the first access request and the first response.

4 . The non-transitory computer-readable medium of claim 1 , wherein the flag is a first flag, and further comprising program code that is executable by the processor for causing the processor to:

determine a number of times that access requests have been received for accessing the particular resource;

determine that the number of times is below a predetermined threshold; and

in response to determining that the number of times is below the predetermined threshold, set a second flag for causing future access requests for the particular resource to be handled using the access control policy rather than the data entry, the second flag being different from the first flag.

5 . The non-transitory computer-readable medium of claim 4 , further comprising program code that is executable by the processor for causing the processor to, subsequent to setting the second flag:

receive an access request for accessing the particular resource;

determine that the second flag is set; and

in response to determining that the second flag is set, determine a response to the access request based on the access control policy rather than the data entry.

6 . The non-transitory computer-readable medium of claim 1 , further comprising program code that is executable by the processor for causing the processor to:

receive an access request for the particular resource;

determine an amount of computing resources that are being consumed;

determine that the amount of computing resources exceeds a predetermined threshold; and

in response to determining that the amount exceeds the predetermined threshold:

set the flag to the first value; and

determine a response to the access request based on the data entry rather than the access control policy.

7 . The non-transitory computer-readable medium of claim 1 , wherein the flag is a first flag, and further comprising program code that is executable by the processor for causing the processor to:

receive an access request for the particular resource;

determine an amount of computing resources that are being consumed;

determine that the amount of computing resources is less than a predetermined threshold; and

in response to determining that the amount is less than the predetermined threshold:

set a second flag for causing the response to the access request to be determined based on the access control policy rather than the data entry, wherein the second flag is different from the first flag; and

determine the response to the access request based on the access control policy rather than the data entry.

8 . The non-transitory computer-readable medium of claim 1 , wherein the data entry includes a hash of the first access request and a hash of the first response.

9 . The non-transitory computer-readable medium of claim 1 , further comprising program code that is executable by the processor for causing the processor to:

determine the first response based on a plurality of nested access control policies;

generate a nested hash based on the first response; and

store the nested hash in relation to the first access request in a graph database, the data entry including the nested hash.

10 . The non-transitory computer-readable medium of claim 1 , further comprising program code that is executable by the processor for causing the processor to store the data entry in a cache memory.

11 . A system comprising:

a processor; and

a memory comprising instructions that are executable by the processor for causing the processor to:

receive a first access request from a client device of a user for accessing a particular resource in a computer network;

receive, from a role-based access control (RBAC) system of the computer network, a first response approving or denying the first access request based on an access control policy selected by the RBAC from among a plurality of access control policies, wherein the access control policy is selected by the RBAC from among the plurality of access control policies based on multiple factors including the user, the particular resource to be accessed, and a particular action to be performed with respect to the particular resource;

store a data entry indicating the first response to the first access request;

in an operation distinct from storing the data entry, set a flag to a first value, wherein the flag comprises a binary value and is distinct from the data entry and the first response;

subsequent to setting the flag to the first value:

receive a second access request from the client device for accessing the particular resource;

based on receiving the second access request, determine whether the flag is set to the first value; and

based on determining that the flag is set to the first value:

extract the first response from the data entry; and

use the extracted first response as a second response for the second access request, the second response being generated without using the access control policy; and

dynamically switch the flag between the first value and a second value over time based on changing operating conditions in the computer network, wherein when the flag is set to the first value, access requests from the client device for the particular resource are handled using the stored first response in the data entry rather than the access control policy, and wherein when the flag is set to the second value, access requests from the client device for the particular resource are handled using the access control policy rather than the stored first response in the data entry.

12 . The system of claim 11 , further comprising instructions that are executable by the processor for causing the processor to, prior to receiving the second access request:

determine a number of times that access requests have been received for accessing the particular resource;

determine that the number of times exceeds a predetermined threshold;

in response to determining that the number of times exceeds the predetermined threshold:

store the data entry in a datastore; and

set the flag to the first value.

13 . The system of claim 11 , wherein the data entry includes a correlation between the first access request and the first response.

14 . The system of claim 11 , further comprising instructions that are executable by the processor for causing the processor to:

determine a number of times that access requests have been received for accessing the particular resource;

determine that the number of times is below a predetermined threshold; and

in response to determining that the number of times is below the predetermined threshold, configure one or more flags in a particular way to cause future access requests for the particular resource is to be handled using the access control policy rather than the data entry, the one or more flags being different than the data entry and the first response.

15 . The system of claim 14 , further comprising instructions that are executable by the processor for causing the processor to, subsequent to configuring the one or more flags in the particular way:

receive an access request for accessing the particular resource;

determine that the one or more flags are configured in the particular way; and

in response to determining that the one or more flags are configured in the particular way, determine a response to the access request based on the access control policy rather than the data entry.

16 . A method comprising:

receiving, by a processor, a first access request from a client device of a user for accessing a particular resource in a computer network;

receiving, by the processor and from a role-based access control (RBAC) system of the computer network, a first response approving or denying the first access request based on an access control policy selected by the RBAC from among a plurality of access control policies, wherein the access control policy is selected by the RBAC from among the plurality of access control policies based on multiple factors including the user, the particular resource to be accessed, and a particular action to be performed with respect to the particular resource;

storing, by the processor, a data entry indicating the first response to the first access request;

in an operation distinct from storing the data entry, setting, by the processor, a flag to a first value, wherein the flag comprises a binary value, the flag being distinct from the data entry and the first response;

subsequent to setting the flag to the first value:

receiving, by the processor, a second access request from the client device for accessing the particular resource;

based on receiving the second access request, determining, by the processor, whether the flag is set to the first value; and

based on determining that the flag is set to the first value:

extracting, by the processor, the first response from the data entry; and

using, by the processor, the extracted first response as a second response for the second access request, the second response being generated without using the access control policy; and

dynamically switching the flag between the first value and a second value over time based on changing operating conditions in the computer network, wherein when the flag is set to the first value, access requests from the client device for the particular resource are handled using the stored first response in the data entry rather than the access control policy, and wherein when the flag is set to the second value, access requests from the client device for the particular resource are handled using the access control policy rather than the stored first response in the data entry.

17 . The method of claim 16 , wherein the changing operating conditions include a change in resource consumption by the computer network.

18 . The method of claim 16 , wherein the changing operating conditions include a change in a volume of access control requests received from the client device over a time window.

19 . The method of claim 16 , further comprising, prior to receiving the second access request:

determining a number of times that access requests have been received for accessing the particular resource;

determining that the number of times exceeds a predetermined threshold;

in response to determining that the number of times exceeds the predetermined threshold:

storing the data entry in a datastore; and

setting the flag to the first value.

20 . The method of claim 16 , further comprising:

determining a number of times that access requests have been received for accessing the particular resource;

determining that the number of times is below a predetermined threshold; and

in response to determining that the number of times is below the predetermined threshold, configuring one or more flags in a particular way for causing future access requests for the particular resource to be handled using the access control policy rather than the data entry, the one or more flags being different from the data entry and the first response, and the one or more flags including the flag.

21 . The method of claim 20 , further comprising, subsequent to configuring the one or more flags in the particular way:

receiving an access request for accessing the particular resource;

determining that the one or more flags are configured in the particular way; and

in response to determining that the one or more flags are configured in the particular way, determining a response to the access request based on the access control policy rather than the data entry.

Assignments (1)

Continuity (1)

References Cited (12)