Attribute-Based Access Control Policy Partitioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems face inefficiencies in converting attribute-based access control (ABAC) policies into legacy systems, leading to high computational loads due to the need for duplicating resources and subjects, especially when policies are frequently updated, and existing conversion methods do not optimize computational complexity effectively.
Innovation Solution
A method that partitions elements into equivalence classes based on primary and secondary categories, reducing the number of numerical operations required for policy evaluation by grouping elements that influence policy decisions similarly, allowing for efficient conversion of ABAC policies into access matrix form suitable for legacy systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If ABAC policies are converted into legacy access control systems by duplicating resources and subjects, then compatibility with legacy systems is achieved, but computational load increases significantly
Solution Approach 1:
The patent segments the conversion process by partitioning subjects and resources into equivalence classes based on their attribute characteristics. Instead of duplicating all subjects and resources individually, the system identifies and groups equivalent elements, converting policies at the equivalence class level rather than the individual element level. This segmentation dramatically reduces the computational load while maintaining compatibility with legacy access control systems.
2Adaptability or versatility
If policies are frequently updated in legacy access control systems, then adaptability to changing requirements is improved, but computational complexity increases due to repeated conversions
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing equivalence classes of subjects and resources before policy updates occur. When policies need to be updated, the system leverages the pre-established equivalence class structure to perform conversions more efficiently. This preliminary organization of data allows frequent policy updates without proportionally increasing computational complexity, as the heavy lifting of identifying equivalent elements has already been done.
3Manufacturing precision
If individual elements are evaluated for policy conversion, then conversion accuracy is maintained, but the number of numerical operations becomes unmanageable
Solution Approach 1:
The patent merges the evaluation process by combining multiple individual element evaluations into a single equivalence class evaluation. Subjects and resources with identical or equivalent attribute profiles are grouped together, and the policy conversion is performed once for the entire group rather than individually for each element. This merging maintains conversion accuracy because all elements in an equivalence class produce the same conversion result, while dramatically improving productivity by reducing the total number of numerical operations required.
Data Source
Figure 1~3
Figure 2
AI summary
An attribute-based access control policy (e.g., XACML policy) for a set of elements depends on attributes carried by elements in one of several predefined categories. In order to evaluate such policy for a set of elements, the invention provides a method including the steps of (I) selecting a primary category; (II) partitioning the elements in the primary category into equivalence classes with respect to their influence on the policy; and (III) using the equivalence classes to replace at least one policy evaluation by a deduction. The result of the evaluation may be represented as an access matrix in backward- compatible format. The efficiency of the policy evaluation may be further improved by applying partial policy evaluation at intermediate stages, by forming combined equivalence classes containing n-tuples of elements and/or by analyzing the influence of each element by extracting functional expressions of maximal length from the policy.