Attribute-Based Access Control for Temporary User Permissions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to permit users who are not registered to use information processing apparatuses, even when an administrator forgets to register a user, and lack the ability to select the correct user from unauthorized users for temporary access, leading to potential misuse.
Innovation Solution
An information processing apparatus that acquires first permission information and allows users to access if the information indicates the apparatus is permitted, or grants access to a user with a predetermined attribute relationship to the denied user, using a server and log server to manage permissions and user histories.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a user registration system is implemented to control apparatus access, then security is improved, but usability deteriorates when administrators forget to register users
Solution Approach 1:
The system performs preliminary actions by registering users in advance with their attributes (department, position, etc.) in the attribute management unit. When a user attempts to access an apparatus, the system checks whether users with similar attributes have access rights, allowing legitimate users to access even if not explicitly registered for that apparatus. This preliminary registration of attributes resolves the contradiction by preparing access information beforehand, maintaining security through attribute verification while improving usability by automatically accommodating forgotten registrations.
2Ease of operation
If temporary access permission is granted to unauthorized users, then usability is improved, but security deteriorates due to inability to select correct users
Solution Approach 1:
The system uses feedback from usage history stored in the history management unit to determine temporary access permissions. When a user without explicit permission attempts to access an apparatus, the permission determination unit queries whether users with similar attributes have previously accessed the apparatus. This feedback mechanism ensures that temporary access is granted only to users with legitimate needs (those whose attribute groups have historical usage), improving usability while maintaining security through data-driven decision making.
3Adaptability or versatility
If attribute-based permission checking is implemented, then adaptability is improved, but device complexity increases
Solution Approach 1:
The system implements a universal attribute management approach where users are registered with general attributes (department, position, etc.) that can be applied across multiple apparatuses. The permission determination unit uses these universal attributes to check access rights for any apparatus, rather than requiring separate registration for each device. This multi-functional attribute system improves adaptability to different apparatuses while reducing complexity by eliminating the need for apparatus-specific user registrations.
Data Source
AI summary
An information processing apparatus includes a processor configured to: acquire first permission information indicative of an apparatus which a first user is permitted to use, permit the first user to use the information processing apparatus in a case where the first permission information indicates the information processing apparatus, and permit the first user to use the information processing apparatus in a case where the first permission information does not indicate the information processing apparatus and a second user having an attribute that is in a predetermined relationship with an attribute of the first user is permitted to use the information processing apparatus.