Distributed Policy Graphs for Temporal Access Control Governance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The XACML architecture for access control is inefficient and impractical due to its reliance on a single point in time and location for policy decision-making, which overlooks temporal components and scalability, leading to implementation issues and difficulty in handling obligations such as audit or data retention requirements.
Innovation Solution
A method involving the use of policy data units (PDUs) that are processed across a distributed compute environment in time and space, with incremental evaluation as software is built, tested, and deployed, and a directed graph is used to assess the access policy rule for correctness, completeness, and consistency, generating a signed access token for user access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single Policy Decision Point (PDP) is used to make access decisions at one point in time, then the access control system is simple to implement, but it cannot handle temporal components and distributed enforcement requirements
Solution Approach 1:
The patent segments the centralized PDP into multiple distributed Policy Decision Points across different time and space locations. Each PDP can independently evaluate policy rules and make access decisions based on local context, enabling the system to handle temporal components and distributed enforcement requirements while maintaining policy consistency through the directed graph structure that tracks policy rule relationships.
2Productivity
If policy decisions are made at a single point in time, then the decision-making process is efficient, but it cannot accommodate future obligations such as audit or data retention requirements
Solution Approach 1:
The patent implements preliminary action by evaluating and caching policy rule results in advance before they are needed for actual access decisions. The directed graph structure pre-computes and stores policy evaluation states, allowing the system to quickly retrieve and apply pre-evaluated policies during runtime while also planning for future obligations like audit and data retention that may be required at later times.
Solution Approach 2:
The patent introduces an intermediary directed graph structure that mediates between policy rules and access decisions. This graph acts as a temporal buffer, storing policy evaluation results and obligation requirements across different time points, allowing the system to maintain efficient real-time decision-making while accommodating future obligations through the graph's ability to represent and query historical and future policy states.
3Reliability
If the XACML architecture is used with multiple enforcement mechanisms, then comprehensive access control is achieved, but the system becomes difficult to scale and implement
Solution Approach 1:
The patent implements universality by creating a unified directed graph structure that can represent and enforce multiple types of access control policies across different enforcement mechanisms simultaneously. The graph structure serves as a universal framework that handles functional access control, data access control, audit requirements, and retention policies through a single coherent model, eliminating the need for separate complex implementations for each enforcement mechanism.
4Adaptability or versatility
If policy rules are evaluated incrementally during software development, then the system adapts to changing requirements, but the evaluation process becomes more complex
Solution Approach 1:
The patent implements dynamics by making the directed graph structure adaptive and mutable during software development. The graph can be dynamically updated, extended, and re-evaluated as software requirements change. The incremental evaluation process leverages the graph's dynamic nature to efficiently update only the affected portions of the policy model rather than re-evaluating the entire system, thus managing complexity while maintaining adaptability.
Data Source
AI summary
A method for governing a policy for providing access to a system is provided. The method includes: receiving a plurality of policy data units, each respective policy data unit including information that relates to an access determination with respect to the system; processing the plurality of policy data units by constructing a first directed graph of policy data unit processors, and obtaining an access policy rule as a result of the processing; evaluating the obtained access policy rule across a compute environment that is distributed in time and space by using the first directed graph; generating a signed access token that relates to a predetermined user based on the obtained access policy rule; and transmitting the signed access token to the predetermined user.