Access Control Constraint Generation via 3D Model Conversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access control systems in computer systems lack efficiency and comprehensiveness in managing access rights, particularly in controlling actions on documents, as they rely on traditional methods that do not effectively utilize advanced logical representations and interactive exploration of access relationships.
Innovation Solution
The method involves storing roles, document types, and permissions in a three-dimensional model, converting it into two-dimensional models, and using description logic to generate constraints for access rights, with interactive attribute exploration to supplement and refine these models, ensuring comprehensive control over access rights in a computer system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional access control methods are used, then the system is simpler to implement, but the efficiency and comprehensiveness of managing access rights deteriorates
Solution Approach 1:
The patent transforms the traditional two-dimensional access control matrix (users × documents) into a three-dimensional model (roles × document types × permissions). This dimensional expansion allows the system to manage access rights more comprehensively by incorporating role-based access control, document type classification, and permission categories simultaneously, thereby improving efficiency without proportionally increasing complexity
Solution Approach 2:
The three-dimensional access control model serves multiple functions simultaneously: it manages user permissions, categorizes documents by type, defines role hierarchies, and establishes permission rules all within a single unified framework. This multi-functionality improves the comprehensiveness of access rights management while avoiding the need for separate systems for each function
2Reliability
If advanced logical representations and interactive exploration are implemented, then the comprehensiveness of access control improves, but the complexity of the system increases
Solution Approach 1:
The patent introduces description logic as an intermediary formalism that bridges the three-dimensional access control model and the actual access control enforcement mechanism. This logical framework provides a rigorous yet manageable way to represent and reason about access rights, improving comprehensiveness while keeping the system complexity controllable through standardized logical operations
Solution Approach 2:
The system performs preliminary analysis and constraint generation from the three-dimensional model before actual access control enforcement. By pre-processing the access control policies into constraints using attribute exploration and description logic, the system ensures comprehensive control is built-in from the start, reducing the need for complex runtime decision-making
Data Source
AI summary
In one embodiment the present invention includes a computer-implemented method for generating constraints for use in an access control system. In one embodiment, roles, document types, and permissions are stored in a 3-D model, such as a matrix or table. The 3-D model is converted to 2-D models, where users are inserted for roles and documents are inserted for document types. The 3-D model and 2-D models represent access rights. Supplemental information about the access rights is added to the 2-D tables. In one embodiment, attribute exploration is used to generate supplemental information. Constraints are generated from the 2-D tables for use in controlling access rights in a computer system.