Access Request Validation via Attribute-to-Rule Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current information security technologies are inadequate for monitoring and controlling access rights of employees across large organizations, leading to difficulties in detecting unauthorized access requests and ensuring compliance with access permissions.
Innovation Solution
A system that generates attribute-to-rule mapping tables to classify rules based on their attributes, allowing for efficient detection of unauthorized access requests by filtering rules in a single loop, reducing cyclomatic complexity and improving access request validation processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current information security technologies are used to monitor and control access rights, then basic access control is maintained, but the system cannot detect unauthorized access requests and the complexity increases with large numbers of employees and resources
Solution Approach 1:
The patent segments the access control system into distinct functional modules: an entitlement management system that stores rules and entitlements, and an information security system that detects violations. By dividing the system into separate components with specific responsibilities, the solution can reliably detect unauthorized access requests without creating a monolithic complex system that becomes unmanageable at scale.
Solution Approach 2:
The patent introduces an intermediary entitlement management system that acts as a mediator between the resource access system and the information security detection system. This intermediary layer stores and manages entitlements and rules, allowing the detection system to query and analyze access requests without direct coupling to resource systems, thereby improving detection reliability while managing complexity through abstraction.
2Reliability
If periodic access reviews are performed to ensure access rights do not exceed authority scope, then access compliance is verified, but available organizational resources are strained
Solution Approach 1:
The patent implements preliminary action by establishing entitlements and rules in advance that define authorized access patterns. The system proactively detects violations by comparing actual access requests against these pre-defined entitlements, rather than waiting for periodic manual reviews. This continuous automated detection maintains access compliance verification reliability while eliminating the need for resource-intensive periodic human reviews.
Solution Approach 2:
The information security system performs self-service by automatically detecting and reporting unauthorized access requests without requiring manual intervention. The system autonomously queries the entitlement management system, analyzes access patterns, and identifies violations, thereby maintaining reliable access compliance verification while freeing organizational resources from manual review tasks.
3Reliability
If a large volume of access rights is reviewed on a regular basis, then access compliance is maintained, but computational resources are consumed
Solution Approach 1:
The patent extracts the detection logic from comprehensive access right reviews by focusing specifically on identifying unauthorized access requests. Rather than analyzing all access rights in detail, the system extracts and analyzes only those access requests that potentially violate entitlements, significantly reducing computational resource consumption while maintaining reliable access compliance maintenance through targeted detection.
4Reliability
If current information security technologies are configured for access monitoring, then basic security is provided, but unauthorized access requests from employees cannot be detected
Solution Approach 1:
The patent implements a universal information security system that can detect unauthorized access requests across multiple contexts and resource types. The system is configured to work with the entitlement management system through standardized interfaces, providing reliable detection capability across diverse scenarios (employee access, resource access, entitlement violations) without requiring separate configurations for each case, thereby maintaining ease of operation.
Data Source
AI summary
A system for verifying a user's request to access a resource determines a set of entitlement attributes from the request. The set of entitlement requests indicates a type of permission to access a particular resource, including at least one of a write-access and a read-access to the particular resource. The system determines whether there is any rule that is violated by the set of entitlement attributes. In response to determining that there is at least one rule that is violated by the set of entitlement attributes, the system denies the request.