Dynamic Access Control Policies via Finite State Automata

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Centralized access control systems with static policy specifications are inadequate for large facilities that require dynamic, context/state-dependent access control policies, as they cannot scale to manage complex access rules based on changing parameters like occupancy and temporal conditions.

Innovation Solution

A formal logical language, such as Monadic Second Order Logic, is used to specify dynamic access control policies, which are then converted into executable finite state automata to enable decentralized access control decisions without relying on a central controller.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If centralized access control systems with static policy specifications are used, then access control decisions can be made for all users, but the system cannot scale to meet the requirements for securing large facilities with a large number of users

Engineering Contradiction:

Improveadaptability to dynamic access control requirementsVSAvoidsystem complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent segments the centralized access control system into distributed components: access control policies are divided and distributed to multiple access control devices throughout the facility. Each device independently evaluates access requests against its assigned policies, eliminating the need for a single centralized decision-making point and enabling the system to scale to large facilities.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces dynamic access control policies that can change based on contextual factors such as time of day, occupancy levels, and user roles. These policies are automatically evaluated by access control devices without requiring manual reconfiguration, allowing the system to adapt to changing security requirements in real-time.

Inventive Principle:

Principle #15Dynamics

2Adaptability or versatility

If static access control policies are used, then the system is simple to implement, but it cannot enforce dynamic context-dependent access control rules

Engineering Contradiction:

Improvedynamic policy enforcement capabilityVSAvoidease of policy management

Core Design Contradiction:

Adaptability or versatilityVSEase of operation

Solution Approach 1:

Access control devices are equipped with the capability to autonomously evaluate access requests against distributed policy rules without requiring continuous intervention from administrators. The devices self-manage the evaluation process by comparing contextual information from access requests against their locally stored policies, enabling dynamic policy enforcement while reducing operational complexity.

Inventive Principle:

Principle #25Self-service

3Adaptability or versatility

If dynamic context-dependent access control policies are implemented, then access decisions can be made based on changing parameters like occupancy and temporal conditions, but continuous communication with a central controller is required

Engineering Contradiction:

Improvecontext-dependent access control capabilityVSAvoidcommunication delay

Core Design Contradiction:

Adaptability or versatilityVSLoss of time

Solution Approach 1:

Access control policies are pre-processed and distributed to access control devices before they are needed for making access decisions. This preliminary distribution of policy rules enables devices to evaluate access requests independently without requiring real-time communication with a central controller, eliminating communication delays while maintaining dynamic policy enforcement.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS7853987B2Policy language and state machine model for dynamic authorization in physical access control

Publication Date: 2010.12.14 HONEYWELL INTERNATIONAL INC

AI summary

An automaton capable of providing an access control decision upon receiving an access control request is produced by processing context based access control policies specified in a formal descriptive language, and by converting the context based access control policies to the automaton.