Hierarchical Access Control Policy Lattice for Regulatory Compliance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing dynamic access control systems struggle to ensure compliance with regulatory requirements by allowing users to override access control decisions, particularly in exceptional situations, which can lead to non-compliance with regulations like the Sarbanes-Oxley Act and HIPAA, as they lack the flexibility to adapt to short-term changes and enforce static constraints dynamically.
Innovation Solution
Implementing a hierarchical ordering of access control policies using a lattice structure that includes deny policies that cannot be overridden, allowing for fine-grained overriding of negative access control decisions while ensuring compliance, through a break-glass approach that enables users to dynamically adjust permissions and enforce access control constraints in a controlled manner.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If users are allowed to override access control decisions in exceptional situations, then adaptability and flexibility are improved, but compliance with regulatory requirements deteriorates
Solution Approach 1:
The access control policy is segmented into multiple ordered policies with different precedence levels. Each policy can be independently evaluated and enforced, allowing specific compliance-critical policies to be marked as non-overridable while other policies allow flexible overrides in exceptional situations
Solution Approach 2:
The system dynamically determines which policies are active and enforceable at runtime based on the access control request context. Policies can be conditionally applied or bypassed depending on whether they represent compliance requirements or flexible access control rules
2Reliability
If multiple access control policies are enforced with hierarchical ordering, then compliance enforcement is improved, but device complexity increases
Solution Approach 1:
The complex policy evaluation is segmented into discrete, ordered policy decisions. Each policy in the hierarchy is evaluated independently in sequence, breaking down the complex multi-policy enforcement into manageable discrete steps that are easier to implement and maintain
Solution Approach 2:
The system pre-establishes the hierarchical ordering and precedence relationships between policies before runtime evaluation. This preliminary structuring of policies reduces runtime complexity by avoiding the need to dynamically determine policy relationships during access control decisions
3Reliability
If static access control constraints are used, then compliance with regulations is improved, but adaptability to short-term changes deteriorates
Solution Approach 1:
The system transitions from static to dynamic policy evaluation by determining active policies at runtime based on the specific access control request. This allows the system to adapt to short-term changes and exceptional situations while maintaining compliance through the hierarchical structure that preserves static policy relationships
Data Source
AI summary
Methods, systems, and computer-readable storage media for enforcing dynamic access control constraints of a plurality of access control policies, and actions include receiving a set of ordered policies, determining a set of active policies including one or more policies in the set of ordered policies, determining an access control decision based on at least a first policy in the set of active policies, the access control decision being based on determining whether one of a permit decision and a deny decision is inherited from a second policy in the set of ordered policies, and transmitting the access control decision for enforcement of the access control policy.