Brokered Policy Authorization for Consistent Data Store Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Financial institutions face fraud risks due to inaccurate account information provided by individuals, and decentralized authorization systems for database access suffer from inefficiencies and inconsistencies, leading to maintenance challenges and errors.
Innovation Solution
A centralized, fine-grained, context-aware authorization system that mediates policy decisions through a broker application, externalizing policy enforcement from sub-databases, and a gateway application provides a unified API for information sharing, enabling risk assessment and filtered data access for partner institutions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If decentralized authorization systems are used for database access, then each sub-database can independently manage its own access control, but this leads to inconsistencies, maintenance challenges, and errors in policy enforcement
Solution Approach 1:
The patent introduces a centralized authorization service as an intermediary between clients and multiple sub-databases. This service receives access requests, evaluates them against centralized access policies, and returns authorization decisions. The mediator ensures consistent policy enforcement across all sub-databases while allowing each to maintain its own data and access control lists, thus resolving the contradiction between independent management and policy consistency.
2Ease of operation
If access policies are stored and enforced at each sub-database level, then local access control can be implemented, but this increases system complexity and makes policy updates difficult to maintain
Solution Approach 1:
The patent extracts the access policy storage and evaluation functionality from individual sub-databases and consolidates it into a centralized authorization service. Each sub-database maintains only its data and local access control lists, while the centralized service stores and evaluates access policies. This extraction simplifies maintenance by centralizing policy management while preserving local access control capabilities.
3Reliability
If fine-grained access control is implemented at the database level, then precise data protection can be achieved, but this increases the complexity of policy management and enforcement
Solution Approach 1:
The centralized authorization service acts as an intermediary that handles fine-grained access control evaluation. It receives detailed access requests, evaluates them against comprehensive access policies that can specify precise conditions (user roles, data sensitivity, operation types), and returns authorization decisions. This mediator approach enables fine-grained control without increasing complexity at the database level, as all complex policy management is centralized.
4Reliability
If centralized authorization is implemented, then consistent policy enforcement across all data stores is achieved, but this requires a centralized service that increases system architecture complexity
Solution Approach 1:
The centralized authorization service is designed as a universal component that serves multiple sub-databases through a common interface. It handles authentication, policy evaluation, and authorization decisions for all data stores in the system. This multi-functional design consolidates what would otherwise require separate authorization mechanisms for each database, achieving consistency without proportionally increasing architecture complexity.
Data Source
AI summary
A method of providing access to a data store. The method comprises receiving a request for authorization of access to a data store by a broker application, wherein the request comprises information a client identity and an identity of requested data; formatting a policy management authorization request according to a policy management application format; sending the policy management authorization request to an policy management application; looking up one or more authorization policies by the policy management application, evaluating the policy management authorization request by the policy management application based on the looked up policies; sending an authorization response by the policy management application to the broker application, wherein the authorization response is formatted according to the policy management application format; receiving the authorization response by the broker application from the policy management application; and sending one of an affirmative authorization response or a negative authorization response by the broker application.