Authorization Operator Layer for Role-Based Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional role-based access control methods in large-scale application systems are cumbersome and prone to errors due to complex permission management, especially when user permissions change or when users are transferred between roles, leading to increased workload and potential security vulnerabilities.
Innovation Solution
A method where multiple authorization operators are configured, each with clear understanding of permissions, allowing for independent role management, where roles are unique to users and can only be related to one user, simplifying permission adjustments and reducing errors by eliminating the need to consider commonalities across multiple users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If role-based access control is implemented with one role corresponding to multiple users, then permission management efficiency is improved, but authorization errors increase and reliability deteriorates
Solution Approach 1:
The patent segments the authorization relationship by introducing an intermediate authorization operator layer between roles and users. Instead of directly assigning roles to multiple users (which causes errors), the system divides the authorization process into: (1) role definition, (2) authorization operator assignment to role, (3) authorization operator granting permissions to users. This segmentation isolates errors to specific authorization operators rather than affecting all users of a role.
Solution Approach 2:
The patent introduces authorization operators as intermediary entities that mediate between roles and users. The authorization operator serves as a mediator that understands the specific permission requirements and can make informed authorization decisions. This intermediary layer prevents direct mechanical role-to-user assignment, allowing for nuanced permission management while maintaining the efficiency of role-based control.
2Adaptability or versatility
If user permissions are adjusted by creating new roles or direct authorization, then adaptability to permission changes is improved, but device complexity and operation difficulty increase
Solution Approach 1:
The patent implements dynamic authorization where authorization operators can be dynamically assigned to roles and can dynamically grant permissions to users. The system allows real-time adjustment of authorization relationships without requiring system reconfiguration or creation of new roles. This dynamic approach enables flexible permission changes while maintaining a stable role structure, reducing complexity compared to static role creation methods.
Solution Approach 2:
The authorization operator serves multiple functions: (1) understanding role permissions, (2) making authorization decisions, (3) granting permissions to specific users. This multi-functional entity replaces the need for multiple specialized components (role managers, permission administrators, etc.), simplifying the overall system while providing adaptable permission management.
3Ease of operation
If direct authorization to users is performed, then ease of operation is improved, but workload and time consumption increase
Solution Approach 1:
The patent applies preliminary action by pre-assigning authorization operators to roles before actual user authorization occurs. The authorization operator is prepared and configured in advance with knowledge of the role's permissions and requirements. When authorization is needed, the pre-configured operator can quickly and accurately grant permissions without requiring time-consuming analysis or configuration at the moment of authorization.
Data Source
AI summary
Disclosed in the present invention is a method for authorizing an authorization operator in a system, comprising: a system operator selects one or more authorization operators, configuring one or more grantees for each authorization operator; respectively configuring, by each authorization operator, a permission for each grantee requiring permission configuration among all the grantees corresponding to the authorization operator; and executing, by said grantee, a corresponding operation according to the configured permission. According to the present invention, a plurality of the authorization operators may be configured, and each grantee may be authorized by the corresponding authorization operator having a clear understanding of the permission of the grantee, so that an error will not easily occur in an authorization operation.