Access Control Validation via Decoupled Test Containers

Solution Overview

Problem

Manual validation of access control schemes in cloud-based environments is labor-intensive and error-prone, unsuitable for scaling, and often requires the creation of resource-intensive mock user profiles, which complicates the testing process.

Innovation Solution

A validation system that uses a test container to automatically validate access control schemes by decoupling test results from the user executing the tests, simulating user authorizations without creating mock user profiles, and injecting test data to verify access control enforcement through a framework that integrates with the ABAP Runtime Environment.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual validation of access control schemes is performed by creating mock user profiles, then access control testing can be conducted, but the process becomes labor-intensive and resource-intensive

Engineering Contradiction:

Improveaccess control validation accuracyVSAvoidvalidation testing efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent creates simplified mock user profiles that copy only the essential authorization characteristics needed for access control testing, rather than creating complete user profiles. This allows validation testing to proceed with reduced resource consumption and less manual effort while maintaining the reliability of access control validation.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent extracts and isolates the specific authorization attributes needed for access control testing from complete user profiles. By taking out only the relevant permission data and separating it from other user profile information, the system reduces the resource intensity and manual labor required for creating test profiles while maintaining validation accuracy.

Inventive Principle:

Principle #2Taking out (Extraction)

2Reliability

If mock user profiles are created for validation testing, then access control schemes can be tested, but the process becomes complex and error-prone

Engineering Contradiction:

Improveaccess control validation accuracyVSAvoidtesting process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent creates simplified mock user profiles that copy only the essential authorization characteristics needed for access control testing, rather than creating complete user profiles. This allows validation testing to proceed with reduced resource consumption and less manual effort while maintaining the reliability of access control validation.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The system enables automated generation and management of mock user profiles with the necessary authorization attributes, reducing manual intervention and the associated errors. The self-service approach allows the testing framework to automatically handle profile creation and configuration.

Inventive Principle:

Principle #25Self-service

3Productivity

If programmatic validation tests are used with access control permissions coupled to the validating user, then automated testing can be performed, but dependencies must be proactively removed to achieve stable results

Engineering Contradiction:

Improvevalidation testing automationVSAvoidtest dependency management

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent extracts and isolates the specific authorization attributes needed for access control testing from complete user profiles. By taking out only the relevant permission data and separating it from other user profile information, the system reduces the resource intensity and manual labor required for creating test profiles while maintaining validation accuracy.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces mock user profiles as an intermediary layer between the validation testing framework and the actual access control system. These mock profiles serve as mediators that provide the necessary authorization attributes for testing without creating direct dependencies between the validating user and the access control permissions, thereby stabilizing test results.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS10120786B2Programmatic access control validation

Publication Date: 2018.11.06 SAP SE

AI summary

Techniques of validating access controls within an application are disclosed. A validation test is performed by receiving test data comprising one or more privilege elements selected from a set of privilege elements representing a privilege scheme defined in an application. The test data and a data set are accessed. The application is executed using the data set according to the one or more privilege elements. A set of interaction indicators is generated representing interactions of the application with a portion of the data set. The set of interaction indicators is presented at a display device of a computing device.