Access Control Pipeline for Scalable Context-Based Permissions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control mechanisms, such as Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and Scope-Based Access Control (SBAC), fail to provide a unified, scalable, and manageable solution for complex business management scenarios, particularly in cloud service provider projects with channel partner resale usage, leading to complex and hard-to-manage access control systems.
Innovation Solution
A holistic architecture design combining attribute-based access control with scope-based and role-based access control, utilizing a three-stage pipeline approach: data store and resource modeling, scope-based access control, and role-based access control, to optimize policy evaluation and management, enabling efficient and scalable access control decisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If attribute-based access control is used to provide fine-grained permission control, then access control precision is improved, but policy management complexity increases
Solution Approach 1:
The patent segments the access control system into three distinct stages: data store and resource modeling, scope-based access control, and role-based access control. Each stage handles specific aspects of permission evaluation, dividing the complex policy management into manageable components that can be independently optimized and administered.
Solution Approach 2:
The patent introduces scope-based access control as an intermediary layer between data modeling and role-based permission evaluation. This intermediate stage processes and filters attributes before they reach the final permission decision, simplifying the overall policy management by handling complexity at an intermediate level rather than throughout the entire system.
2Adaptability or versatility
If complex business management scenarios are supported with detailed permission control, then adaptability is improved, but system scalability deteriorates
Solution Approach 1:
The patent divides the access control system into three independent stages that can be scaled separately. The data store and resource modeling stage handles complex business scenarios, while the scope-based and role-based stages provide scalable permission evaluation. This segmentation allows the system to accommodate complex scenarios without compromising scalability.
Solution Approach 2:
The patent adds a dimensional layer by introducing scope-based access control as an intermediate dimension between data modeling and role-based permissions. This additional dimension allows the system to process complex business scenarios through structured attribute evaluation while maintaining scalability through the hierarchical architecture.
3Ease of operation
If existing access control mechanisms are used, then ease of operation is maintained, but device complexity increases due to lack of unified approach
Solution Approach 1:
The patent merges attribute-based, scope-based, and role-based access control mechanisms into a unified three-stage pipeline system. This consolidation provides a single coherent approach to access control that maintains operational simplicity through consistent processing logic while reducing overall system complexity by eliminating the need to manage separate, incompatible mechanisms.
Solution Approach 2:
The patent creates a universal access control framework that handles multiple access control scenarios through a single unified architecture. The three-stage pipeline can process various business scenarios, permission types, and access patterns using the same fundamental mechanism, eliminating the need for multiple specialized systems and reducing operational complexity.
Data Source
AI summary
A system can maintain a first data store that stores first associations between subjects and first attributes, and a second data store that stores second associations between second attributes and permissions. The system can receive a query that identifies a user account and a resource. The system can determine, from the first data store and a context of the user account in initiating the query, first permissions for the user account with respect to the resource and given the context. The system can determine, from the second data store and the context, second permissions that are a precondition to access the resource given the context. The system can determine, based on whether there is an overlap between the first permissions and the second permissions, whether to approve the query. The system can respond to the query based on a result of the determining whether to approve the query.