Access Control Policy Conversion with Auxiliary Constraints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The conversion of access control policy data structures from systems with primary authorizations subject to auxiliary constraints to single-authorization-query systems, such as XACML, is challenging due to the lack of mechanisms to handle auxiliary constraints effectively.
Innovation Solution
A method is developed to analyze and convert source policy data structures by identifying primary and auxiliary authorizations, generating access rules with wildcard elements for auxiliary constraints, and combining them using logical algorithms to ensure evaluation consistency with the source policy, allowing auxiliary constraints to be encoded and evaluated within the single-authorization-query system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If access control policy data structures from systems with auxiliary constraints are converted to single-authorization-query systems, then system compatibility and standardization are improved, but the ability to accurately represent auxiliary constraints is lost
Solution Approach 1:
The patent segments the conversion process into distinct phases: analyzing the source policy data structure to identify primary and auxiliary authorizations, generating separate access rules for each authorization type, and combining them using logical algorithms. This segmentation allows accurate representation of auxiliary constraints while maintaining compatibility with single-authorization-query systems.
Solution Approach 2:
The patent introduces an intermediary conversion mechanism that translates auxiliary constraints into equivalent access rules with wildcard elements. This intermediary layer preserves the semantic meaning of auxiliary constraints while formatting them for compatibility with single-authorization-query systems, thus resolving the contradiction between standardization and accuracy.
2Reliability
If auxiliary constraints are encoded as separate access rules with wildcard elements, then evaluation consistency with source policy is maintained, but policy data structure complexity increases
Solution Approach 1:
The patent merges multiple access rules (primary authorizations and auxiliary constraints) into a unified policy data structure that can be evaluated consistently. By combining these rules using logical algorithms and maintaining them in a single structured format, the system achieves evaluation consistency without proportionally increasing complexity.
Solution Approach 2:
The patent applies parameter changes by transforming auxiliary constraint elements into wildcard elements within the access rules. This parameter transformation allows the system to maintain evaluation consistency with the source policy while using a standardized rule format, thereby managing complexity through controlled parameter variation.
3Adaptability or versatility
If access rules use wildcard elements for auxiliary constraints, then single-authorization-query system compatibility is achieved, but precision in matching specific authorization conditions is reduced
Solution Approach 1:
The patent applies local quality by using wildcard elements selectively only where necessary to represent auxiliary constraints, while maintaining specific matching for primary authorization conditions. This localized application of wildcards preserves compatibility with single-authorization-query systems while maintaining precision for the specific authorization conditions that require it.
Data Source
AI summary
Methods and apparatus are provided for generating an access control policy data structure for a single-authorization-query access control system from a source policy data structure of an access control system in which primary authorizations can be subject to auxiliary constraints. Authorizations in the data structures are defined in terms of subject, resource and action elements. For each resource in a set of resources in the source policy data structure, the data structure is analyzed to identify primary authorizations relating to that resource. For each primary authorization, policy data which represents a policy defining an access rule expressing that authorization is generated and stored in system memory and analyzed to identify any auxiliary constraints associated with that primary authorization. For each auxiliary constraint so identified, policy data is generated and stored in system memory.