Delegation Metasystem for Composite Service Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Composite services face limitations in scope and complexity due to the requirement of operating within a single trust domain or including access control mechanisms to call other services, and they need to be updated whenever the called services or access control details change.
Innovation Solution
A delegation metasystem that allows composite services to define generic resource requirements at design time, with actual resources selected and access rights delegated at runtime using plug-ins that correspond to specific access control models, enabling dynamic selection and adaptation based on user, location, and other factors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If composite services include access control mechanisms to call services in other domains, then the scope and applicability of the composite service is improved, but the complexity of the composite service increases
Solution Approach 1:
The patent extracts access control mechanisms from the composite service itself and places them in a separate delegation metasystem. The composite service only contains a high-level definition of required resources, while the metasystem handles the complex access control logic, authentication, and delegation to actual services. This separation reduces the complexity within the composite service while maintaining its ability to access services across domains.
Solution Approach 2:
The delegation metasystem acts as an intermediary between the composite service and the actual services it needs to call. It handles the complex access control mechanisms, authentication, and service resolution, allowing the composite service to access services in other domains without directly implementing access control logic. This intermediary approach enables cross-domain access while keeping the composite service simple.
2Reliability
If composite services include access control mechanisms, then authentication with services in other domains is enabled, but the complexity of the composite service increases
Solution Approach 1:
Authentication and access control logic are extracted from the composite service and implemented in the delegation metasystem. The composite service only specifies its resource requirements at a high level, while the metasystem handles authentication with services in other domains. This extraction maintains authentication capability while reducing complexity within the composite service.
Solution Approach 2:
The delegation metasystem serves as an intermediary that handles authentication with external services. It manages the complex access control mechanisms and authentication protocols, allowing the composite service to reliably authenticate with services in other domains without directly implementing authentication logic, thus maintaining reliability while reducing complexity.
3Device complexity
If composite services are restricted to operate within a single trust domain, then the complexity is reduced, but the scope and applicability is limited
Solution Approach 1:
The delegation metasystem provides a universal framework that enables composite services to operate across multiple trust domains while maintaining simple service definitions. The metasystem handles domain-specific access control logic, allowing the same composite service definition to work across different domains without modification. This universality approach expands scope and applicability while keeping the composite service itself simple.
4Reliability
If the composite service includes specific access control details, then access control is configured, but updates are required when access control details change
Solution Approach 1:
The system dynamically resolves access control details at runtime rather than requiring static configuration. The delegation metasystem automatically adapts to changes in access control requirements by selecting appropriate services and configuring access dynamically based on current conditions. This dynamic approach maintains reliable access control while eliminating the need for manual updates when access control details change.
Solution Approach 2:
The delegation metasystem automatically manages access control configuration without requiring manual intervention. When access control details change, the metasystem self-adjusts by selecting appropriate services and configuring access based on updated requirements. This self-service capability maintains proper access control configuration while eliminating maintenance effort for updating access control details.
5Reliability
If the composite service includes specific resource details, then the service is configured to call specific services, but updates are required when the called services change
Solution Approach 1:
The system uses dynamic service resolution where the composite service defines generic resource requirements rather than specific service details. At runtime, the delegation metasystem dynamically selects and binds to appropriate services that meet the requirements. This dynamic approach ensures reliable service configuration while automatically adapting when called services change, eliminating the need for manual updates.
Solution Approach 2:
The composite service uses universal, generic definitions of resource requirements that can be satisfied by multiple different services. When the specific services change, the same composite service definition continues to work by binding to different services that meet the requirements. This universality maintains reliable configuration while reducing maintenance effort.
Data Source
AI summary
A delegation metasystem for composite services is described, where a composite service is a service which calls other services during its operation. In an embodiment, the composite service is defined using generic descriptions for any services (and their access control models) which may be called by the composite service during operation. At run time, these generic descriptions and potentially other factors, such as the user of the composite service, are used to select actual available services which may be called by the composite service and access rights for the selected services are delegated to the composite service. These access rights may subsequently be revoked when the composite service terminates.