Distributed Access Control Lists Using Blessing Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed systems, authentication and authorization mechanisms face challenges such as complex group management, unintended circularities, and high communication costs, particularly when group definitions are not readily available or equally trusted, leading to inefficiencies and security concerns.
Innovation Solution
A system generates an access control list (ACL) that includes blessing patterns and group references, allowing for conditional access control by parsing clauses to determine whether to grant or deny access, with optional group server lookups to verify membership, ensuring secure and efficient access management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If group definitions are distributed across multiple participants in a distributed system, then the system can achieve decentralized authorization management, but group lookups incur high communication costs and require security measures
Solution Approach 1:
The patent applies preliminary action by pre-computing and caching group membership information before authorization checks are needed. Group definitions and membership data are stored in advance in the distributed system, allowing participants to perform local lookups without incurring high communication costs during actual authorization decisions. This pre-positioning of data resolves the contradiction by maintaining decentralization while reducing runtime communication overhead.
2Productivity
If group definitions are made available at all participants, then authorization checks can be performed locally without remote communication, but the system complexity and security risks increase
Solution Approach 1:
The patent applies segmentation by dividing the system into distinct components: some participants store and manage group definitions, while others perform authorization checks using cached information. This segmentation allows fast local authorization checks at checking participants without requiring all participants to maintain full group definition data, thus reducing overall system complexity while maintaining high productivity for authorization operations.
3Ease of operation
If ACLs include references to groups for simplified policies, then ACL management becomes easier, but circular group references and unintended consequences become harder to detect
Solution Approach 1:
The patent applies feedback by implementing validation mechanisms that analyze group definitions and ACL references to detect circular dependencies and unintended consequences. The system provides feedback to administrators about potential issues in group configurations, allowing them to correct problems before they cause authorization failures. This maintains the simplicity of group-based ACL management while enabling detection of circularities through automated analysis and reporting.
Data Source
AI summary
In a method of controlling sharing of an object between entities in a distributed system, a processor will identify an object and generate an access control list (ACL) for the object so that the ACL includes a list of clauses. Each clause will include a blessing pattern that will match one or more blessings, and at least one of the clauses also may include a reference to one or more groups. Each group represents a set of strings that represent blessing patterns or fragments of blessing patterns. The processor may generate each clause of the ACL as either a permit clause or a deny clause to indicate whether an entity or entities that have a blessing matched by the blessing pattern are permitted to access the object. The processor will save the ACL to a data store for use in responding to a request to access the object.