Centralized Authorization Engine in UI Framework
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional decentralized authorization checking in database systems is complex, lacks transparency, and makes it difficult for developers and administrators to manage and enhance access permissions, as authorization checks are scattered across multiple enforcement points within application logic, making it hard to foresee or modify authorization requirements.
Innovation Solution
Implementing modeled authorization checking within a user interface framework using a centralized authorization engine that references authorization objects stored in a meta data repository, following a Model, View, and Control (MVC) design pattern, providing a single enforcement point for authorization requests and enhancing database queries with authorization constraints.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If decentralized authorization checking is implemented with multiple enforcement points within application logic, then authorization flexibility and granular control are improved, but system complexity and difficulty in managing authorization transparency worsen
Solution Approach 1:
The patent merges multiple decentralized authorization enforcement points into a single centralized authorization engine. This consolidation maintains authorization flexibility while significantly reducing system complexity by eliminating the need to manage multiple scattered enforcement points across different application logic modules.
Solution Approach 2:
The patent introduces an authorization engine as an intermediary component that sits between the user interface framework and the database layer. This mediator handles all authorization checks centrally, providing a single point of control while maintaining the flexibility to manage complex authorization scenarios without distributing enforcement logic throughout the application.
2Adaptability or versatility
If decentralized authorization checking is implemented with multiple enforcement points, then authorization granular control is improved, but difficulty in establishing comprehensive where-used-list and foreseeing authorization changes worsens
Solution Approach 1:
The patent implements a feedback mechanism where the centralized authorization engine provides comprehensive information about authorization usage back to the user interface framework. This enables the system to maintain granular control over authorizations while providing full transparency through centralized logging and monitoring of authorization decisions.
Solution Approach 2:
The patent segments authorization management into distinct components: authorization definitions are separated from enforcement logic, which is centralized in the authorization engine. This segmentation allows granular control over individual authorization rules while maintaining transparency through the centralized enforcement point that can comprehensively track and report on all authorization usage.
3Ease of manufacture
If conventional decentralized authorization checking is used, then implementation simplicity is maintained, but difficulty in maintaining authorizations by administrator and foreseeing enhancements worsens
Solution Approach 1:
The patent implements self-service capabilities where the centralized authorization engine automatically handles authorization enforcement without requiring manual intervention in multiple scattered locations. The system maintains implementation simplicity while making authorization maintenance easier through centralized administration and automated enforcement.
Solution Approach 2:
The patent performs preliminary actions by pre-defining authorization rules and configurations in the centralized engine before they are needed at runtime. This allows the system to maintain implementation simplicity while improving authorization maintenance ease through centralized pre-configuration and automated enforcement at execution time.
Data Source
AI summary
Access by a user to a database layer, is governed by modeled authorization checking implemented with authorization objects present in an overlying application layer. At design time, the authorization checking is modeled as part of an existing user interface (UI) model, which may conform to a Model, View, and Control (MVC) design pattern. Authorization objects created during design time, are stored in a meta data repository. At runtime, an authorization engine references the authorization objects and the operations supported by those authorization objects. The authorization check is thus implemented centrally in the UI framework itself using this modeled information. Embodiments avoid complexity, potential lack of internal consistency, and low visibility of conventional de-centralized authorization checking schemes that rely upon a plurality of enforcement points hard-coded at multiple locations within application logic.