Delegated-Right Access Control for Service Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control methods for computer applications fail to provide secure and fine-grained administration of user data access, especially when applications from different vendors interact, leading to potential malicious access and regulatory compliance issues.
Innovation Solution
Implementing a delegated-right system where a service-application is provisioned with limited service-rights, allowing it to access and operate on behalf of a delegator-user through a delegated-to principal, using a limited access path to prevent unauthorized access to other users' information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If System-Rights are provided to service-application for accessing user information, then the service-application can perform operations on user data, but security is compromised because the service-application gains access to information from all users without fine-grained control
Solution Approach 1:
The patent segments the monolithic System-Rights into fine-grained delegated-rights that are divided by user, operation type, and data scope. Each delegated-right represents a specific authorization granted to the service-application for a particular user and operation, breaking down the comprehensive access control into manageable, isolated units that can be individually managed and revoked.
Solution Approach 2:
The patent implements local quality by granting the service-application different levels of access rights for different users and operations. Instead of uniform System-Rights, each delegated-right has specific scope and constraints tailored to the particular user-service-application relationship, allowing precise control over what the service-application can access and modify for each user.
2Object-affected harmful factors
If fine-grained administration of Access Control Policies is implemented to protect each user's information, then security is improved, but the system becomes difficult and error-prone to manage
Solution Approach 1:
The patent enables self-service by allowing users to directly grant delegated-rights to service-applications through their own interfaces and control mechanisms. Users can independently manage which service-applications access their data and what operations they can perform, eliminating the need for administrators to manually configure complex access control policies for each user-service-application pair.
Solution Approach 2:
The patent creates a universal delegated-right framework that serves multiple functions: it provides fine-grained access control, enables user autonomy, simplifies administration, and maintains security. The delegated-right mechanism is designed to be broadly applicable across different users, service-applications, and operation types, reducing the need for custom policy configurations.
3Device complexity
If the service-application operates under the assumption of trusted behavior, then system simplicity is maintained, but security assumptions are weakened when applications are from different vendors
Solution Approach 1:
The patent applies preliminary anti-action by preemptively restricting the service-application's access capabilities through delegated-rights before any malicious or erroneous operations can occur. Instead of relying on post-hoc security measures or trust assumptions, the system pre-configures precise access boundaries that prevent the service-application from accessing data or performing operations beyond its authorized scope, regardless of its origin or behavior assumptions.
Data Source
AI summary
Apparatus, methods, and computer program products are disclosed that present a delegated-right to a delegation system by a service-application provisioned with the delegation system. The delegated-right enables the service-application to perform an operation/access on behalf of a delegator-user. The method then attempts to perform the operation/access.