Policy decision offload accelerator and associated methods thereof

Patent metadata

Field	Value
Publication number	US-10685128-B2
Application number	US-201815897594-A
Country	US
Kind code	B2
Filing date	Feb 15, 2018
Priority date	Feb 15, 2018
Publication date	Jun 16, 2020
Grant date	Jun 16, 2020

Abstract

Methods and systems for a networked computing system are provided. One method includes detecting that a processor executable, policy decision point (PDP) has not responded to a request for accessing data associated with a storage system; predicting a response to the request using a machine-learned, request-response association maintained by a processor executable training device; and presenting the predicted response to a processor executable, policy enforcement point (PEP) for granting access to the data and denying access to the data, based on the predicted response.

First claim

What is claimed is:

1. A machine implemented method, comprising:
receiving a request from a policy enforcement point (PEP) for an access policy decision for accessing data stored by a storage system;
sending the request to a policy decision point (PDP);
when the PDP provides a response to the request including a policy-based access decision within a time duration:
presenting the response to the PEP to determine whether to grant access to the data for the request; and
providing the request and response from the PDP to a training module for updating stored, machine learned associations between received requests and corresponding responses received from the PDP;

when the PDP does not respond to the request within the time duration:
generating a predicted response to the request including a predicted access policy decision based on the learned associations maintained by the training module;

and
presenting the predicted response to the PEP;
wherein the PEP uses the predicted response to determine whether to grant or deny access to the data.

2. The method of claim 1 , wherein when the predicted response violates a veto rule, then the request is denied.

3. The method of claim 1 , wherein when the PDP is available, then a response to the request is provided via a fast path.

4. The method of claim 3 , wherein the response via the fast path and the request are stored in a data structure for the training device for responding to the future access requests.

5. The method of claim 3 , wherein the request is saved at a request queue and provided to a processor executable, associator for maintaining a relationship between the request and the response via the fast path for training responses to the future access requests.

6. The method of claim 1 , further comprising: detecting that the predicted response does not violate a veto rule associated with the storage system.

7. The method of claim 1 , wherein the request is associated with storage space provided by a cloud provider.

8. A non-transitory machine-readable storage medium having stored thereon instructions for performing a method, comprising machine executable code which when executed by at least one machine, causes the machine to:
receive a request from a policy enforcement point (PEP) for an access policy decision for accessing data stored by a storage system;
send the request to a policy decision point (PDP);
when the PDP provides a response to the request including a policy-based access decision within a time duration:
present the response to the PEP to determine whether to grant access to the data for the request; and
provide the request and response from the PDP to a training module for updating stored, machine learned associations between received requests and corresponding responses received from the PDP;

when the PDP does not respond to the request within the time duration:
generate a predicted response to the request including a predicted access policy decision based on the learned associations maintained by the training module;

and present the predicted response to the PEP;
wherein the PEP uses the predicted response to determine whether to grant or deny access to the data.

9. The non-transitory storage medium of claim 8 , wherein when the predicted response violates the veto rule, then the request is denied.

10. The non-transitory storage medium of claim 8 , wherein when the PDP is available, then a response to the request is provided via a fast path.

11. The non-transitory storage medium of claim 10 , wherein the response via the fast path and the request are stored in a data structure for the training device for responding to the future access requests.

12. The non-transitory storage medium of claim 10 , wherein the request is saved at a request queue and provided to a processor executable, associator for maintaining a relationship between the request and the response via the fast path for training responses to the future access requests.

13. The non-transitory storage medium of claim 8 , wherein the machine executable code, further causes the machine to: detect that the predicted response does not violate a veto rule associated with the storage system.

14. The non-transitory storage medium of claim 8 , wherein the request is associated with storage space provided by a cloud provider.

15. A system, comprising:
a memory containing machine readable medium comprising machine executable code having stored thereon instructions;
and a processor coupled to the memory to execute the machine executable code to:
receive a request from a policy enforcement point (PEP) for an access policy decision for accessing data stored by a storage system;
send the request to a policy decision point (PDP);
when the PDP provides a response to the request including a policy-based access decision within a time duration:
present the response to the PEP to determine whether to grant access to the data for the request; and
provide the request and response from the PDP to a training module for updating stored, machine learned associations between received requests and corresponding responses received from the PDP;

when the PDP does not respond to the request within the time duration:
generate a predicted response to the request including a predicted access policy decision based on the learned associations maintained by the training module;

and present the predicted response to the PEP;
wherein the PEP uses the predicted response to determine whether to grant or deny access to the data.

16. The system of claim 15 , wherein when the predicted response violates a veto rule, then the request is denied.

17. The system of claim 15 , wherein when the PDP is available, then a response to the request is provided via a fast path.

18. The system of claim 17 , wherein the response via the fast path and the request are stored in a data structure for the training device for responding to the future access requests.

19. The system of claim 17 , wherein the request is saved at a request queue and provided to a processor executable, associator for maintaining a relationship between the request and the response via the fast path for training responses to the future access requests.

20. The system of claim 19 , wherein the machine executable code, further causes to: detect that the predicted response does not violate a veto rule associated with the storage system.

Assignees

• Netapp Inc

Inventors

• Slik David Anthony
• Kelley James Alan
• Shah Peter

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06N20/00

  Machine learning · CPC title

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title