Access Control System Managing Derivation Limits
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control technologies face challenges in managing access to information across various media types, particularly in controlling the number of times information can be replicated and managing the abundance ratio of each media type, which is crucial for preventing information leakage or damage.
Innovation Solution
An access control system comprising a deriving operation request device, a deriving operation control device, and an information resource derivation management device, which manage derivation control information and attributes to determine the feasibility of operations based on predefined limits and abundance ratios for each media type.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If access control policy format is used to describe allowable conditions and detailed function limits, then flexibility and detail of access control is improved, but device complexity and system overhead increases
Solution Approach 1:
The access control system is segmented into multiple independent components: policy definition module, policy storage module, policy evaluation module, and enforcement module. This segmentation allows the complex access control functionality to be distributed across separate modules, reducing the complexity burden on any single device while maintaining overall system flexibility.
Solution Approach 2:
An intermediary policy evaluation module is introduced between the policy storage and enforcement components. This intermediary translates high-level access control policies into actionable decisions, reducing the complexity of direct policy enforcement while preserving the flexibility of policy-based control.
2Reliability
If replication control is implemented for electronic information, then information security is improved, but adaptability to various media types deteriorates
Solution Approach 1:
The access control system is designed with universal policy structures that can apply to multiple media types (electronic information, physical documents, digital assets). The policy language and evaluation mechanisms are media-agnostic, allowing the same framework to enforce replication controls across diverse media while maintaining information security.
Solution Approach 2:
The system uses parameterized policy definitions where media-specific attributes (such as media type, storage location, replication limits) are defined as configurable parameters. This allows the core access control logic to remain consistent while adapting to different media types through parameter variation, thereby maintaining both security and adaptability.
3Measurement precision
If detailed derivation control information is managed for each information resource, then control precision is improved, but device complexity and management overhead increases
Solution Approach 1:
Instead of managing detailed derivation control information for each individual information resource, the system creates template copies of control policies that can be replicated and applied to multiple resources. This copying mechanism maintains precise control over derivation operations while significantly reducing management complexity through reuse of standardized policy templates.
Solution Approach 2:
The system implements self-service mechanisms where derivation control policies are automatically applied and enforced without requiring manual configuration for each resource. The policy engine automatically evaluates and enforces controls based on predefined rules, reducing the burden of detailed manual management while maintaining precise control.
Data Source
AI summary
According to one embodiment, a deriving operation control device obtains derivation control information and a derivation attribute. A deriving operation propriety determination unit extracts the number of times of previously-performed derivation from the derivation attribute. The deriving operation propriety determination unit extracts the upper limit number of times enabling derivation from the derivation control information and determines that a deriving operation is possible when the number of times of previously-performed derivation is equal to or below the upper limit number of times enabling derivation. A deriving operation execution unit executes the deriving operation.