Processing authentication requests for unified access management systems and applications using frequently invoked policies
Disclosed are apparatuses, systems, and techniques that improve efficiency and decrease latency of processing of authorization requests by cloud-based access servers that evaluate access rights to access various cloud-based services. The techniques include but are not limited to generating and processing advanced authorization requests that anticipate future authorization requests that may be generated by cloud-based services. The techniques further include processing of frequently accessed policies and policy data dependencies and preemptive generation and processing of authorization requests that are replicated from existing authorization requests.
1 . A method comprising:
detecting, by an access server, a triggering event pertaining to a cloud service associated with a plurality of policies, wherein at least one policy of the plurality of policies is associated with a corresponding policy data and wherein the access server is independent of the cloud service;
responsive to detecting the triggering event and prior to receiving one or more authorization requests to access a resource provided by the cloud service, downloading, by the access server, policy data associated with at least one policy of a subset of policies of the plurality of policies, wherein the subset of policies is selected based on one or more statistics corresponding to one or more policies, of the plurality of policies, applied to past authorization requests received over a predetermined interval of time; and
applying the downloaded policy data to evaluate the one or more authorization requests generated after the triggering event.
2 . The method of claim 1 , wherein the cloud service supports at least one of a gaming application, a video streaming application, an audio streaming application, or a database application.
3 . The method of claim 1 , wherein the one or more authorization requests made after the triggering event are generated by the cloud service in response to a user requesting an access to the cloud service.
4 . The method of claim 1 , wherein one or more policies of the plurality of policies comprise one or more unified access management (UAM) policies specifying access rights for the cloud service, and wherein the downloaded policy data comprises at least a portion of the policy data associated with each of the subset of policies.
5 . The method of claim 1 , wherein the triggering event comprises an initialization request for a user accessing the cloud service.
6 . The method of claim 1 , wherein the triggering event comprises a time associated with an anticipated access of the cloud service by a user.
7 . The method of claim 1 , wherein the triggering event comprises an invocation of a trigger policy.
8 . The method of claim 1 , wherein the subset of policies is selected in view of a number of times each of the subset of policies was invoked during handling of the past authorization requests received over the predetermined interval of time.
9 . The method of claim 1 , wherein the subset of policies comprises a first policy and a second policy, the second policy having a predicted likelihood of being invoked, in conjunction with the first policy, with at least a threshold probability over the predetermined interval of time.
10 . The method of claim 1 , wherein the one or more statistics comprise one or more correlations between at least some of the policies of the subset of policies.
11 . The method of claim 1 , wherein the downloaded policy data associated with at least one policy of the subset of policies comprises a portion of stored policy data accessed, during handling of the past authorization requests, with at least a threshold frequency.
12 . A system comprising:
a memory device; and
one or more processing devices, communicatively coupled to the memory device, to:
detect, by an access server, a triggering event pertaining to a cloud service associated with a plurality of policies, wherein at least one policy of the plurality of policies is associated with a corresponding policy data and wherein the access server is independent of the cloud service;
responsive to detecting the triggering event and prior to receiving one or more authorization requests to access a resource provided by the cloud service, download, by the access server, policy data associated with at least one policy of a subset of policies of the plurality of policies, wherein the subset of policies is selected based on one or more statistics corresponding to one or more policies, of the plurality of policies, applied to past authorization requests received over a predetermined interval of time; and
apply the downloaded policy data to evaluate the one or more authorization requests generated after the triggering event.
13 . The system of claim 12 , wherein the cloud service supports at least one of a gaming application, a video streaming application, an audio streaming application, or a database application.
14 . The system of claim 12 , wherein the one or more authorization requests made after the triggering event are generated by the cloud service in response to a user initiating a request for access to the cloud service.
15 . The system of claim 12 , wherein at least one policy of the plurality of policies comprises one or more unified access management (UAM) policies specifying access rights for the cloud service, and wherein the downloaded policy data comprises at least a portion of the policy data associated with each of the subset of policies.
16 . The system of claim 12 , wherein the triggering event comprises at least one of:
an initialization request for a user accessing the cloud service,
a time associated with an anticipated access of the cloud service by a user, or
an invocation of a trigger policy.
17 . The system of claim 12 , wherein the subset of policies is selected in view of a number of times each of the subset of policies was invoked during handling of the past authorization requests received over the predetermined interval of time.
18 . The system of claim 12 , wherein the subset of policies comprises a first policy and a second policy, the second policy having a predicted likelihood of being invoked, in conjunction with the first policy, with at least a threshold probability over the predetermined interval of time.
19 . The system of claim 12 , wherein the one or more statistics comprise correlations between at least some of the policies of the subset of policies.
20 . A non-transitory computer-readable medium storing instructions thereon, wherein the instructions, when executed by a processing device, cause the processing device to:
detect, by an access server, a triggering event pertaining to a cloud service associated with a plurality of policies, wherein at least one policy of the plurality of policies is associated with a corresponding policy data and wherein the access server is independent of the cloud service;
responsive to detecting the triggering event and prior to receiving one or more authorization requests to access a resource provided by the cloud service, download, by the access server, policy data associated with at least one policy of a subset of policies of the plurality of policies, wherein the subset of policies is selected based on one or more statistics corresponding to one or more policies, of the plurality of policies, applied to past authorization requests received over a predetermined interval of time; and
apply the downloaded policy data to evaluate the one or more authorization requests generated after the triggering event.