ABAC Policy Translation to Local ACLs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access control systems face challenges in efficiently managing and enforcing attribute-based access control (ABAC) policies, particularly in local host systems, where policy analytics and ACL management are cumbersome and inefficient, making it difficult to grant or deny user access rights effectively, especially in big data processing and supercomputing environments.
Innovation Solution
The proposed system centrally manages ABAC policies and locally computes decisions using native ACL mechanisms, expressing policies in terms of user and object attributes, and formulating ACLs for resource repositories, allowing for efficient policy analytics and enforcement with minimal changes to local host systems beyond the implementation of agent software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional access control systems are used in local host systems, then policy analytics and ACL management become cumbersome and inefficient, but implementing full ABAC policy systems in every local host system would increase device complexity and require significant changes to local systems
Solution Approach 1:
The access control system is segmented into a centralized ABAC policy system that handles policy analytics and a local host system that handles enforcement. The centralized system produces RACLs that are then translated into local RRACLs, dividing the complex functionality into manageable segments that can be efficiently distributed.
Solution Approach 2:
An intermediary translation layer is introduced between the centralized ABAC policy system and local host systems. This intermediary converts ABAC policies into native ACL formats for each host system, enabling policy analytics efficiency without requiring significant changes to local systems.
2Productivity
If ABAC policies are centrally managed and translated to local ACLs, then access control performance is improved, but the system requires additional agent software and translation mechanisms
Solution Approach 1:
The system performs preliminary translation of ABAC policies into native ACL formats before they are needed for access control decisions. By pre-computing and caching these translations, the system achieves fast access request processing without adding complexity during the actual access decision process.
Solution Approach 2:
The system creates copies of ABAC policies in a translated format suitable for local host systems. These copied policies are stored and reused for multiple access control decisions, improving performance while keeping the translation mechanism contained and manageable.
3Ease of operation
If native ACL mechanisms are used in local host systems, then ease of operation is maintained, but the ability to enforce complex ABAC policies is limited
Solution Approach 1:
The system changes the representation parameters of access control policies by translating ABAC policies into native ACL formats specific to each host system. This allows complex ABAC policies to be enforced while maintaining the simplicity and ease of operation of native ACL mechanisms.
Solution Approach 2:
The centralized ABAC policy system serves multiple functions: it provides policy analytics, generates RACLs, translates policies to native formats, and enforces access control. This universal system can operate with minimal changes to various local host systems while maintaining their operational simplicity.
Data Source
AI summary
An access control system for managing and enforcing an attribute based access control (ABAC) policy includes: a minimum ABAC implementation that produces a representation access control list in an ABAC policy system; and a local host system that produces a resource repository access control list in the local host system such that the resource repository access control list is based on the representation access control list.