Attribute-Based Access Control With Scoped Roles And Conditioned Permissions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control frameworks lack a comprehensive and unified architecture to manage complex and large-scale business management scenarios, particularly in multi-cloud environments, leading to overly complex policy languages and increased management complexity.
Innovation Solution
Implementing an attribute-based access control (ABAC) system with scoped roles and conditioned permissions, where permissions and conditions are expressed as Boolean expressions, and roles are scoped to specific resources, allowing dynamic policy application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional access control frameworks are used to manage complex business scenarios, then basic access control functionality is provided, but the policy language becomes overly complex and management complexity increases
Solution Approach 1:
The access control policy is segmented into distinct components: roles, permissions, conditions, and scope. Each component serves a specific function - roles define user identities, permissions define access rights, conditions define constraints, and scope defines resource boundaries. This segmentation allows complex access control requirements to be managed through simple, composable elements rather than complex monolithic policies.
Solution Approach 2:
The patent creates a universal access control framework that can handle diverse business scenarios through a common set of abstractions. The role-based model with scoped permissions and conditions provides a multi-functional solution that adapts to different business contexts (multi-cloud environments, hierarchical organizations, resource sharing scenarios) without requiring scenario-specific policy languages.
2Adaptability or versatility
If traditional access control frameworks are used, then basic access control is provided, but management complexity increases in large-scale environments
Solution Approach 1:
The system segments access control management into reusable role templates that can be independently defined and configured. Each role encapsulates a specific set of permissions and conditions that can be applied to multiple users or groups, enabling centralized management of access control in large-scale environments without proportionally increasing management complexity.
Solution Approach 2:
The patent implements preliminary action by pre-defining role templates with common permission sets and conditions before they are needed. These templates can be reused across multiple scenarios and users, eliminating the need to manually configure access control for each individual case and significantly reducing management overhead in large-scale deployments.
3Adaptability or versatility
If scoped roles with conditioned permissions are implemented, then flexible access control decisions are enabled, but system complexity increases
Solution Approach 1:
The system segments the evaluation process into distinct stages: role matching, permission verification, condition evaluation, and scope validation. Each stage handles a specific aspect of access control and can be independently implemented and tested. This segmentation manages system complexity by breaking down the complex decision-making process into manageable, well-defined components.
Solution Approach 2:
The patent implements dynamic access control where permissions and conditions are evaluated at runtime based on current system state and user context. The scoped role model allows permissions to be dynamically activated or deactivated based on scope matching and condition satisfaction, providing flexibility without requiring complex static policy configurations.
Data Source
AI summary
A system can identify an attribute-based access control policy that comprises a pair comprising a permission policy and a condition policy that is associated with performing an operation on a computing resource. The system can identify that the attribute-based access control policy corresponds to a role policy that is associated with the account. The system can determine whether the account and the role policy satisfy the attribute-based access control policy with respect to the operation, wherein the determining comprises evaluating whether the computing resource and a required permission of the permission policy is declared in the role policy, and evaluating whether the account and the role policy satisfy the condition policy evaluates to true based on attributes of the account and attributes of the computing resource. The system can, in response to determining that the account satisfy the permission policy and the condition policy, perform the operation on the computing resource.