Hierarchical Access Rights Inheritance for Multi-Tenant Governance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems face challenges in managing access rights for resources shared by multiple tenants, particularly in defining permission structures that allow namespace operators to create tenants without granting unrestricted access, and in enabling tenants to manage access rights for their sub-tenants effectively.
Innovation Solution
An inheritance-based access rights governance model that uses a hierarchical organization of metadata objects to define access rights, allowing permissions to be inherited and expressed through access control expressions, enabling flexible and secure access management across multiple levels of a tenant's organization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If namespace operators are granted unrestricted access to create tenants, then ease of operation is improved, but security and control over access rights deteriorates
Solution Approach 1:
The access rights are segmented into different levels: namespace operator level, tenant level, and sub-tenant level. Each level has specific permissions defined through access control expressions, allowing namespace operators to create tenants without granting them unrestricted access to all resources. This segmentation resolves the contradiction by enabling easy tenant creation while maintaining security through hierarchical permission control.
Solution Approach 2:
Access control expressions act as intermediaries between namespace operators and the actual resource access. These expressions define the boundary conditions for what namespace operators can and cannot do, even when creating tenants. The intermediary mechanism allows operational ease while preventing unauthorized access, thus resolving the security-ease of operation contradiction.
2Ease of operation
If tenants are given full access rights to manage sub-tenants, then ease of operation is improved, but loss of information about access control governance deteriorates
Solution Approach 1:
Different access control expressions are applied at different levels of the hierarchy. Tenant-level expressions define what tenants can do with sub-tenants, while namespace operator-level expressions define broader governance capabilities. This local quality approach allows tenants to manage sub-tenants easily without losing awareness of the overall access control governance structure, as each level operates with appropriately scoped permissions.
3Reliability
If a complex permission structure is implemented to control access rights, then access control security is improved, but device complexity increases
Solution Approach 1:
Access control expressions serve multiple functions: they define permissions for namespace operators, tenants, and sub-tenants simultaneously. The same expression mechanism governs both data access and metadata access, reducing the need for separate complex permission systems. This multi-functionality simplifies the overall structure while maintaining strong access control security.
Data Source
AI summary
A technique includes receiving a request. The request is associated with an operation, a target path and a requestor. The process includes, responsive to the request, accessing metadata that is associated with access control governance for a data resource. The metadata is stored in a directory tree and is arranged according to a hierarchical order. The technique includes, based on the metadata, associating the requestor with a role. The process includes associating the target path with a location of the directory tree structure and determining an inherited permission based on the role. Determining the inherited permission includes associating, by inheritance, the location with an ancestor permission that corresponds to a prefix of the target path. The technique includes, based on the inherited permission, determining whether to allow or deny the request.