Bit String Entitlement System for Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for managing entitlements to computer applications are cumbersome and time-consuming, particularly when multiple users require different access rights to various components, often necessitating the creation of multiple LDAP profiles, which can be inefficient and labor-intensive.
Innovation Solution
A computer-implemented method and system that uses an electronic entitlement database to store component enumerations and access rights, generating a bit string based on user and application IDs to quickly grant or deny access, allowing administrators to easily manage and update user entitlements without the need for multiple LDAP profiles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If LDAP profiles are used to manage user access rights to application components, then access control is achieved, but the process becomes time-consuming and labor-intensive requiring multiple profiles
Solution Approach 1:
The patent segments the monolithic LDAP profile approach into fine-grained entitlements that can be independently assigned. Instead of creating multiple LDAP profiles for different access levels, the system divides access rights into discrete entitlements (e.g., read, write, execute) that can be combined and assigned to users individually, reducing the complexity of profile management.
Solution Approach 2:
The patent introduces a new dimension to access control by implementing a bit string-based entitlement system. Each entitlement is represented by a bit in a bit string, allowing multiple entitlements to be encoded in a single data structure. This dimensional transformation from multiple LDAP profiles to a single bit string per user dramatically reduces the time and effort required to manage access rights.
2Adaptability or versatility
If multiple LDAP profiles are created to provide different access rights to various application components, then user-specific access control is achieved, but the complexity of managing multiple profiles increases
Solution Approach 1:
The patent changes the parameter representation of access rights from LDAP profile structures to bit string parameters. Each bit in the bit string corresponds to a specific entitlement, allowing for flexible and customized access rights without requiring multiple profiles. This parameter transformation enables the system to represent complex access permissions using a simple, manageable data structure.
3Ease of manufacture
If LDAP is maintained on a different server by a different administrator, then centralized directory management is achieved, but the coordination and communication overhead increases
Solution Approach 1:
The patent implements a self-service entitlement management system where application developers can directly assign entitlements to users without requiring coordination with LDAP administrators. The system provides automated entitlement assignment capabilities that eliminate the need for inter-administrator communication and coordination, allowing developers to independently manage user access rights.
Data Source
AI summary
The invention relates to a computer-implemented system and method for controlling access by users of an organization to one or more components of a computer application. The method may be conducted on a specially programmed computer system comprising one or more computer processors, electronic storage devices, and networks. The method may comprise the steps of storing, in an electronic entitlement database, an enumeration that identifies the plurality of components of the application; storing, in the electronic entitlement database, an electronic lookup table containing entitlement data that specifies access rights to the plurality of components for a user or a defined group of users; receiving from a user computing device a request for access to at least one of the plurality of components of the application; transmitting to the electronic entitlement database a security ID (SID) of the user and an application ID; generating an electronic bit string specifying access to the plurality of components of the application based on the SID and the application ID; transmitting the bit string to the application; and granting access or denying access to the user computing device to the requested component of the application based on the bit string.