US 12,598,172 B2Granted

Identity sharded cache for the data plane data

AssigneeOracle International Corporation

InventorsVenkata Rama Prasad Tammana, Kedar Nitin Mishra, Matthew Hoover, Girish Nagaraja, Arsalan Ahmad

Life of this patent

Estimating the term…

Loading patent…

Abstract

In some aspects, an authentication service may divide authentication data into one or more data stripes, the authentication data including at least one of: user identifier (userID); group identifier (groupID); group membership; client identifier (clientID); dynamic group (DG) membership; or dynamic group identifier. The authentication service may store the one or more data stripes in one or more databases, the databases being contained in a host machine of a fleet, where the fleet contains one or more host machines. The authentication service may update the databases from the data stripe via a background thread. Numerous other aspects are described.

Claims20

Dependent claims

A computer-implemented method, comprising:

dividing, by an authentication service, authentication data into data stripes, the authentication data including at least one of:
group membership data;
dynamic group (DG) membership data;
or
dynamic group identifier data;
storing, by the authentication service, the data stripes in databases, the databases being implemented on a fleet of machines, and the fleet of machines containing host machines;
updating, by the authentication service, the databases from data stripes via background computing threads where each database of the databases is updated by a separate background computing thread of the background computing threads;
receiving, by the authentication service, a first request to authenticate an entity, the first request comprising at least a user identifier that corresponds to requested authentication data;
identifying, by the authentication service, an identified host machine of the host machines of the fleet of machines, the identified host machine storing the requested authentication data;
retrieving, by the authentication service, the requested authentication data from the identified host machine;
storing, by the authentication service, the requested authentication data in a local cache of the identified host machine;
receiving, by the authentication service, a second request to authenticate the entity, the second request comprising at least the user identifier that corresponds to the requested authentication data;
identifying, by the authentication service, the identified host machine of the host machines of the fleet of machines using at least the user identifier;
retrieving, by the authentication service, the requested authentication data from the local cache of the identified host machine;
and
authenticating, by the authentication service, the entity in response to the second request using at least the requested authentication data.

13 more elements

A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of an authentication service, cause the authentication service to:
divide authentication data into data stripes, the authentication data including at least one of:
group membership data;
dynamic group (DG) membership data;
or
dynamic group identifier data;
store the data stripes in databases, the databases being implemented on a fleet of machines, and the fleet of machines containing host machines;
update the databases from the data stripes via background computing threads where each database of the databases is updated by a separate background computing thread of the background computing threads;
receive a first request to authenticate an entity, the first request comprising at least a user identifier that corresponds to requested authentication data;
identify an identified host machine of the host machines of the fleet of machines, the identified host machine storing the requested authentication data;
retrieve the requested authentication data from the identified host machine;
store the requested authentication data in a local cache of the identified host machine;
receive a second request to authenticate the entity, the second request comprising at least the user identifier that corresponds to the requested authentication data;
identify the identified host machine of the host machines of the fleet of machines using at least the user identifier;
retrieve the requested authentication data from the local cache of the identified host machine;
and
authenticate the entity in response to the second request using at least the requested authentication data.

14 more elements

An authentication service, comprising:

one or more memories;
and
one or more processors, communicatively coupled to the one or more memories, configured to:
divide authentication data into data stripes, the authentication data including at least one of:
group membership data;
dynamic group (DG) membership data;
or
dynamic group identifier data;
store the data stripes in databases, the databases being implemented on a fleet of machines, and the fleet of machines contain host machines;
update the databases from the data stripes via background computing threads where each database of the databases is updated by a separate background computing thread of the background computing threads;
receive a first request to authenticate an entity, the first request comprising at least a user identifier that corresponds to requested authentication data;
identify an identified host machine of the host machines of the fleet of machines, the identified host machine storing the requested authentication data;
retrieve the requested authentication data from the identified host machine;
store the requested authentication data in a local cache of the identified host machine;
receive a second request to authenticate the entity, the second request comprising at least the user identifier that corresponds to the requested authentication data;
identify the identified host machine of the host machines of the fleet of machines using at least the user identifier;
retrieve the requested authentication data from the local cache of the identified host machine;
and
authenticate the entity in response to the second request using at least the requested authentication data.

16 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/956,227Filed 29 Sep 2022 · us provisional application
Priority: 30 Sep 2021
Published: US 2023/0101303 A130 Mar 2023
Granted: 7 Apr 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

H04L 63/08
Network architectures or network communication protocols for network security: for authentication of entities
H04L 63/0815
For authentication of entities: providing single-sign-on or federations
H04L 63/102
For controlling access to devices or network resources: entity profiles
H04L 63/104
For controlling access to devices or network resources: grouping of entities