ABAC Permissions Provisioning via ACL Lookup Tables

Solution Overview

Problem

Current access control systems face limitations in expressing policies that depend on resource metadata and location, and scaling issues lead to increased storage and processing demands, making complex policies infeasible and risky.

Innovation Solution

A permissions provisioning module that interacts with a computer system to generate and deploy access control lists (ACLs) based on attribute-based access control (ABAC) policies, using a policy evaluator and data adapter to derive attribute values from system metadata, enabling flexible and fine-grained access control.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If attribute-based access control policies are used to express fine-grained access rules, then flexibility and precision in access control is improved, but device complexity and processing requirements increase

Engineering Contradiction:

Improveflexibility in defining access rulesVSAvoidcomplexity of access control mechanism

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system performs preliminary computation by pre-calculating and storing access control decisions in a lookup table during system initialization or periodic updates. This allows the complex ABAC policy evaluation to be performed once in advance, and then simple table lookups are used during actual access requests, reducing real-time processing complexity while maintaining policy flexibility

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The invention creates a simplified representation of the complex ABAC policy by generating a lookup table that copies the essential access control logic into a format that can be quickly queried. This lookup table is a condensed version of the policy that maintains the necessary access control semantics while enabling faster execution

Inventive Principle:

Principle #26Copying

2Measurement precision

If complex access control policies are implemented to manage fine-grained access, then access control precision is improved, but storage requirements and processing power increase

Engineering Contradiction:

Improveprecision of access control decisionsVSAvoidstorage and processing resources

Core Design Contradiction:

Measurement precisionVSQuantity of substance

Solution Approach 1:

The system performs preliminary computation by pre-calculating and storing access control decisions in a lookup table during system initialization or periodic updates. This allows the complex ABAC policy evaluation to be performed once in advance, and then simple table lookups are used during actual access requests, reducing real-time processing complexity while maintaining policy flexibility

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The invention creates a simplified representation of the complex ABAC policy by generating a lookup table that copies the essential access control logic into a format that can be quickly queried. This lookup table is a condensed version of the policy that maintains the necessary access control semantics while enabling faster execution

Inventive Principle:

Principle #26Copying

3Ease of operation

If traditional ACL management is used, then ease of operation is maintained, but adaptability to dynamic policies and maintenance burden increase

Engineering Contradiction:

Improveease of ACL managementVSAvoidadaptability to dynamic access control needs

Core Design Contradiction:

Ease of operationVSAdaptability or versatility

Solution Approach 1:

The system implements automated feedback mechanisms where policy changes are automatically detected and propagate through the lookup table generation process. When access control policies are updated, the system automatically regenerates the lookup table and notifies relevant components, creating a closed-loop system that maintains adaptability without manual intervention

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The system performs self-service by automatically generating and updating lookup tables based on policy changes without requiring manual administration. The lookup table generation process is automated, and the system self-manages its own access control decisions, reducing maintenance burden while maintaining high adaptability to dynamic policies

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS10404707B2Provisioning system-level permissions using attribute-based access control policies

Publication Date: 2019.09.03 AXIOMATICS

AI summary

A permissions provisioning module includes a data adapter and a permissions calculator associated with a policy evaluator operable to evaluate an ABAC policy. The module is adapted to interact with a computer system including resources, metadata and an access control mechanism enforcing, in respect of each resource, an access control list associated with the resource. In operation, the data adapter receives metadata for said computer system and assigns values to attributes in the policy based on the metadata. The permissions calculator queries the policy evaluator on combinations of resources and principals of the system using the attribute values thus assigned, and returns permission data. The data adapter formats said permission data into ACLs, for deployment in the computer system.