Centralized Authorization Flow for Granular Multi-Domain Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed, multi-domain computing systems face challenges in implementing granular access control due to complexity, decentralized management, and the risk of excessive access, which complicates centralized administration and security.
Innovation Solution
A centralized authorization service that enforces granular access control policies across domains, components, and applications, with centralized auditing and logging, using attribute-based evaluations and token management to ensure consistent access decisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If fixed levels of privilege are assigned to broad roles, then access management is simplified, but granular control over permissions is lost
Solution Approach 1:
The patent segments access control into two distinct layers: a centralized policy definition layer that manages granular permission rules, and a distributed enforcement layer that executes these policies across multiple domains. This segmentation allows simplified role assignment at the enforcement level while maintaining granular control at the policy level, resolving the contradiction between ease of management and permission granularity.
Solution Approach 2:
The patent introduces a centralized authorization service as an intermediary between users and system resources. This service receives access requests, evaluates them against granular policies stored in a centralized repository, and returns authorization decisions. The intermediary enables simplified role-based request submission while maintaining granular policy enforcement, thus resolving the contradiction.
2Device complexity
If granular access controls are configured locally at each system level, then precise control is achieved, but centralized administration and security monitoring become complicated
Solution Approach 1:
The patent extracts the policy definition and management functions from individual distributed systems and consolidates them into a centralized authorization service. Granular access control policies are defined, stored, and maintained centrally, while distributed systems only need to enforce these policies locally. This extraction maintains granular control capabilities while enabling centralized administration and monitoring.
Solution Approach 2:
The patent introduces a new architectural dimension by separating policy management from policy enforcement. Instead of managing granular controls purely at the system level or purely centrally, the solution operates in both dimensions simultaneously: centralized policy definition and distributed enforcement. This dimensional separation resolves the contradiction between granular control and centralized administration.
3Ease of operation
If broad roles are used to simplify access management, then administrative overhead is reduced, but security risk increases due to excessive access
Solution Approach 1:
The patent applies local quality by allowing different granularity levels for different roles and resources. While broad roles can be used for simple access patterns, granular policies can be applied where needed. The centralized policy repository stores both role-based and attribute-based policies, enabling security-sensitive areas to enforce fine-grained controls while other areas use simplified role assignment, thus reducing overall security risk without excessive administrative overhead.
Data Source
AI summary
The present invention sets forth a technique for automatically managing access control authorization in a distributed computing system. This technique includes receiving an access request from a requesting entity and recording the access request in an audit log. The technique also includes retrieving access control policies associated with the access request and retrieving attribute data values from an entity data store. The technique further includes generating an access request evaluation based on the access request, the access control policies, and the attribute data values. The technique further includes transmitting the access request evaluation to the requesting entity.