Conditioned Permissions and Security Interceptors for Resource Queries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems require application code to make authorization decisions for resource collection queries, complicating security compliance and code correctness, and lack support for expressing user intent and resource collection scope in policy statements.
Innovation Solution
Implementing a security interceptor that enforces access control decisions using conditioned permissions, allowing authorization to be made entirely in a trusted computing base, with policy expressions that include URI query parameters to specify user intent and support resource collection queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If application code makes authorization decisions for resource collection queries, then authorization flexibility is improved, but code complexity and security compliance difficulty increase
Solution Approach 1:
The patent extracts authorization logic from application code into a dedicated security interceptor component. The interceptor evaluates access control policies independently, separating security concerns from business logic. This reduces application code complexity while maintaining authorization flexibility through policy-based control.
Solution Approach 2:
The security interceptor acts as an intermediary between the query operation and the resource collection service. It mediates authorization decisions by evaluating policies against user intent and resource scope parameters, preventing direct authorization logic in application code while preserving flexible access control.
2Reliability
If security interceptor enforces all access control decisions, then security compliance is improved, but processing time increases
Solution Approach 1:
The system performs preliminary evaluation of user intent and resource collection scope parameters before executing the query. By pre-processing these parameters and making authorization decisions upfront in the security interceptor, the system ensures security compliance without adding time overhead during actual query execution.
Solution Approach 2:
The security interceptor evaluates only the necessary policy conditions relevant to the specific query parameters rather than performing exhaustive checks. This partial evaluation approach maintains security compliance while minimizing processing time by focusing only on critical authorization criteria.
Data Source
AI summary
A system can receive a request, and identify an attribute-based access control policy comprising a permission policy and a condition policy that is associated with performing an operation with respect to a group of computing resources with a first scope of the operation. The system can determine whether the account satisfies the permission policy for the operation, wherein determining whether the account satisfies the condition policy evaluates to true based on account attributes of the account and resource attributes of the group of computing resources in the first scope of the query operation. The system can, in response to determining that the account satisfies the condition policy, send an indication of the request as constrained by the first scope and a second scope that is based on the condition policy to a service, the service performing the operation to produce a result, and responding to the request with the result.