Access Control List Dependent Object for Business Objects
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems that use access control lists (ACLs) separately from business object data structures require unnecessary processing resources and increased response time due to table joins during runtime, making them inefficient for service requests.
Innovation Solution
Implementing an access control list dependent object (ACL DO) that integrates access control attributes directly within the business object, allowing for efficient access control checks by traversing an access path specified by the business object, thereby reducing processing overhead and providing granular access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control lists are stored separately from business object data structures, then access control functionality is provided, but processing resources are consumed unnecessarily and response time increases due to table joins during runtime
Solution Approach 1:
The patent merges the access control list with the business object data structure by integrating the access control list as a component within the business object itself. This eliminates the need for separate storage and table joins, allowing the system to access both data and access control information from a single unified structure during runtime, thereby improving processing efficiency while maintaining access control functionality
2Reliability
If access control lists are stored separately from business object data structures, then access control functionality is provided, but response time increases due to table joins during runtime
Solution Approach 1:
The patent merges the access control list with the business object data structure by integrating the access control list as a component within the business object itself. This eliminates the need for separate storage and table joins, allowing the system to access both data and access control information from a single unified structure during runtime, thereby improving processing efficiency while maintaining access control functionality
3Reliability
If access control is implemented at the business object level, then access control functionality is provided, but granular control over specific nodes and operations is lost
Solution Approach 1:
The patent segments the access control list into multiple entries, where each entry corresponds to a specific node within the business object hierarchy. Each access control list entry contains node-specific access control attributes that define which operations can be performed on that particular node by which users or groups. This segmentation enables granular control over individual nodes and operations while maintaining the integrated structure that improves processing efficiency
4Productivity
If access control attributes are integrated within the business object, then processing overhead is reduced, but implementation complexity increases
Solution Approach 1:
The patent implements a universal access control list structure that can be applied to any business object type and node within the hierarchy. The access control list uses a standardized format with consistent attributes (node identifier, user identifiers, permitted operations) that can accommodate different business objects and their various nodes. This universal approach simplifies implementation by providing a single, reusable pattern rather than requiring custom access control mechanisms for each business object type
Data Source
AI summary
A service request from a user is received to execute an operation on an instance of a business object. Thereafter, an access control check is performed to confirm whether the user is allowed to execute the requested operation on a type of business object corresponding to the business object specified and based on an access group associated with the user. Subsequently, the user is either provided with access to the instance of the business object to execute the operation if the access control check confirms that the user is allowed to execute the operation on the instance of the business object, or prevented from accessing the instance of the business object to execute the operation on the instance of the business object. Related apparatus, systems, techniques and articles are also described. Related apparatus, systems, techniques and articles are also described.