# US 12,120,152 B2 · Preemptive processing of authentication requests for unified access management systems and applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,152 B2 - Document ID: US12120152B2 - Status: Granted - Kind: B2 - Application number: 17/869,653 - Filed: 2022-07-20 - Published: 2024-01-25 - Granted: 2024-10-15 - Earliest claimed: 2022-07-20 - Assignees: NVIDIA Corporation - Applicants: NVIDIA Corporation - Inventors: Dhruva Lakshmana Rao Batni - Web page: https://patentgrep.com/patent/US12120152B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/102: {Entity profiles} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed are apparatuses, systems, and techniques that improve efficiency and decrease latency of processing of authorization requests by a cloud service. The techniques include obtaining, from an access server, a snapshot associated with processing an authorization request to evaluate an access to a resource of the cloud service and generating, using the snapshot, preemptive authorization requests by modifying the authorization request with a new user identity or a new resource identity. The techniques further include receiving, from the cloud service, a subsequent authorization request to evaluate an authorization of a user to access a particular resource of the cloud service, determining that the subsequent authorization request corresponds to one of preemptive authorization requests, and providing, to the cloud service, an authorization response for the user to access the resource, based on evaluation of this preemptive authorization request. ## Claims ### Claim 1 A method comprising: obtaining, from an access server, a processing snapshot associated with processing one or more authorization requests, wherein at least one request of the one or more authorization requests is to evaluate an authorization, corresponding to a user of a cloud service, to access a resource of a plurality of resources supported by the cloud service; generating, using the processing snapshot, a plurality of preemptive authorization requests, wherein at least one preemptive request of the plurality of preemptive authorization requests is generated by modifying an authorization request of the one or more authorization requests with at least one of a new user identity or a new resource identity; receiving, from the cloud service, a first authorization request to evaluate an authorization of a first user to access a first resource of the plurality of resources of the cloud service; determining that the first authorization request corresponds to a first preemptive authorization request of the plurality of preemptive authorization requests; and providing, to the cloud service, a first authorization response indicative of an authorization of the first user to access the first resource, wherein the first authorization response is based on evaluation of the first preemptive authorization request. ### Claim 2 (depends on 1) The method of claim 1, wherein the first resource comprises at least one of a gaming application, a video streaming application, an audio streaming application, or a database application. ### Claim 3 (depends on 1) The method of claim 1, wherein the access server comprises a unified access management (UAM) server. ### Claim 4 (depends on 1) The method of claim 1, wherein the processing snapshot comprises one or more policy codes executed by the access server during processing of the one or more authorization requests, wherein at least one policy code of the one or more policy codes implements a respective policy specifying access rights for at least one resource of the plurality of resources supported by the cloud service. ### Claim 5 (depends on 4) The method of claim 4, wherein the processing snapshot further comprises at least one policy dependency referenced in at least one policy code of the one or more policy codes executed by the access server. ### Claim 6 (depends on 1) The method of claim 1, further comprising: prior to receiving the first authorization request, evaluating the first preemptive authorization request to obtain the first authorization response. ### Claim 7 (depends on 1) The method of claim 1, further comprising: evaluating a second preemptive authorization request to obtain a second authorization response, wherein the second preemptive authorization request is to evaluate an authorization corresponding to a second user to access a second resource; obtaining, from the access server, a ground truth authorization response reflective of the authorization corresponding to the second user to access the second resource; and verifying correctness of the second authorization response based on a comparison of the second authorization response and the ground truth authorization response. ### Claim 8 (depends on 1) The method of claim 1, wherein the first preemptive authorization request is generated by a replay server that is different from the access server, and wherein the first authorization request is received by the replay server responsive to determining that the first preemptive authorization request has been generated by the replay server. ### Claim 9 A system comprising: a memory device; and one or more processing devices, communicatively coupled to the memory device, to: obtain, from an access server, a processing snapshot associated with processing of one or more authorization requests, wherein at least one of the request of the one or more authorization requests is to evaluate an authorization, corresponding to a user of a cloud service, for the user to access a resource of a plurality of resources supported by the cloud service; generate, using the processing snapshot, a plurality of preemptive authorization requests, wherein at least one preemptive request of the plurality of preemptive authorization requests is generated by modifying an authorization request of the one or more authorization requests with at least one of a new user identity or a new resource identity; receive, from the cloud service, a first authorization request to evaluate an authorization corresponding to a first user of the cloud service to access a first resource of the plurality of resources; determine that the first authorization request corresponds to a first preemptive authorization request of the generated plurality of preemptive authorization requests; and provide, to the cloud service, a first authorization response indicative of the authorization corresponding to the first user to access the first resource, wherein the first authorization response is based on evaluation of the first preemptive authorization request. ### Claim 10 (depends on 9) The system of claim 9, wherein the first resource comprises at least one of a gaming application, a video streaming application, an audio streaming application, or a database application. ### Claim 11 (depends on 9) The system of claim 9, wherein the access server comprises a unified access management (UAM) server. ### Claim 12 (depends on 9) The system of claim 9, wherein the processing snapshot comprises one or more policy codes executed by the access server during processing of the one or more authorization requests, wherein at least one policy code of the one or more policy codes implements a respective policy specifying access rights for at least one resource of the plurality of resources supported by the cloud service. ### Claim 13 (depends on 12) The system of claim 12, wherein the processing snapshot further comprises at least one policy dependency referenced in at least one policy code of the one or more policy codes executed by the access server. ### Claim 14 (depends on 9) The system of claim 9, wherein the one or more processing devices are further to: prior to receiving the first authorization request, evaluate the first preemptive authorization request to obtain the first authorization response. ### Claim 15 (depends on 9) The system of claim 9, wherein the one or more processing devices are further to: evaluate a second preemptive authorization request to obtain a second authorization response, wherein the second preemptive authorization request is to evaluate an authorization corresponding to a second user to access a second resource; obtain, from the access server, a ground truth authorization response reflective of accessibility of the second resource to the second user; and verify correctness of the second authorization response based on a comparison of the second authorization response and the ground truth authorization response. ### Claim 16 (depends on 9) The system of claim 9, wherein the first preemptive authorization request is generated by a replay server that is different from the access server, and wherein the first authorization request is received by the replay server responsive to determining that the first preemptive authorization request has been generated by the replay server. ### Claim 17 A non-transitory computer-readable medium storing instructions thereon, wherein the instructions, when executed by a processing device, cause the processing device to: obtain, from an access server, a processing snapshot associated with processing of one or more authorization requests, wherein at least one request of the one or more authorization requests is to evaluate an authorization, corresponding to a user of a cloud service, of the user to access a resource of a plurality of resources supported by the cloud service; generate, using the processing snapshot, a plurality of preemptive authorization requests, wherein at least one preemptive request of the plurality of preemptive authorization requests is generated by modifying an authorization request of the one or more authorization requests with at least one of a new user identity or a new resource identity; receive, from the cloud service, a first authorization request to evaluate an authorization of a first user of the cloud service to access a first resource of the plurality of resources; determine that the first authorization request corresponds to a first preemptive authorization request of the generated plurality of preemptive authorization requests; and provide, to the cloud service, a first authorization response indicative of the authorization corresponding to the first user to access the first resource, wherein the first authorization response is based on evaluation of the first preemptive authorization request. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the first resource comprises at least one of a gaming application, a video streaming application, an audio streaming application, or a database application, and wherein the access server comprises a unified access management (UAM) server. ### Claim 19 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the processing snapshot comprises: one or more policy codes executed by the access server during processing of the one or more authorization requests, wherein at least one policy code of the one or more policy codes implements a respective policy specifying access rights for at least one resource of the plurality of resources supported by the cloud service; and at least one policy dependency referenced in at least one policy code of the one or more policy codes executed by the access server. ### Claim 20 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the instructions cause the processing device further to: evaluate a second preemptive authorization request to obtain a second authorization response, wherein the second preemptive authorization request is to evaluate an authorization corresponding to a second user to access a second resource; obtain, from the access server, a ground truth authorization response reflective of accessibility of the second resource to the second user; and verify correctness of the second authorization response based on a comparison of the second authorization response and the ground truth authorization response.