Distributed Attribute-Based Access Control for Sensitive Record Investigations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems struggle to manage access to sensitive data in large quantities of user activity telemetry where unique resource-identifiers are unclear, necessitating a more nuanced approach to handle complex access scenarios involving multiple attributes and contexts.
Innovation Solution
A distributed attribute-based access control system that utilizes a micro-service architecture with an authorization engine to evaluate access requests based on attributes of principals, resources, and context, allowing for conditional access decisions through a templating engine.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional access control systems (DAC or RBAC) are used to manage access to sensitive data, then the system structure is simple and easy to implement, but the system cannot handle complex access scenarios involving multiple attributes and contexts in large quantities of user activity telemetry
Solution Approach 1:
The patent segments the access control system into multiple independent components: policy definition module, policy evaluation module, attribute extraction module, and access control module. Each component handles specific aspects of access control, allowing the system to manage complex scenarios while maintaining modularity and reducing overall system complexity through clear separation of concerns
Solution Approach 2:
The patent introduces attribute-based access control as an additional dimension beyond traditional role-based or discretionary access control. By evaluating access requests based on multiple attributes (user attributes, resource attributes, context attributes) rather than just roles or permissions, the system gains the ability to handle complex access scenarios involving multiple dimensions of data
2Reliability
If access control policies are evaluated centrally to ensure security and compliance, then access control accuracy is improved, but system performance and response time deteriorate due to the large quantities of data to be processed
Solution Approach 1:
The patent implements policy compilation that transforms access control policies into pre-compiled evaluation rules before runtime. This preliminary action allows the system to evaluate access requests more efficiently during runtime, as the complex policy logic has already been processed and optimized in advance, reducing the computational burden during actual access control decisions
Solution Approach 2:
The patent introduces an attribute extraction module that acts as an intermediary between data sources and the policy evaluation module. This intermediary efficiently extracts and standardizes attributes from various sources (user profiles, resource metadata, context information) before passing them to the evaluation module, reducing the processing overhead and improving overall system performance
Data Source
AI summary
A distributed system provides access by a principal to a resource associated with sensitive data. Micro-services in communication with an authorization engine each include a resource provider that receives a resource action request from the principal to access the resource, determines a context for the request, and transmits the context to the authorization engine in an authorization request. The authorization engine receives the authorization request, resolves the authorization request context against a plurality of pre-defined resource conditions, and responds to the resource provider with an authorization response of allow, deny, or allow-with-conditions. The context for the request includes metadata regarding attributes of the principal, and each of the resource conditions includes a logical expression operating upon the attributes.