Dynamic Access Control for Computer Resources
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for managing access to and modification of computer resources lack effective constraints, leading to unauthorized changes and resource wastage due to unrestricted privileged access, resulting in negative consequences such as unintended service actions and production outages.
Innovation Solution
A system utilizing machine learning to determine privileged access requirements and blockchain for validating modifications, ensuring that only authorized changes are made by generating and using encrypted configuration files to restrict access to specific resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If privileged access is granted to allow modifications to computer resources, then the ability to implement changes and modifications is improved, but the risk of unauthorized access and accidental changes increases
Solution Approach 1:
The patent introduces an intermediary system that sits between the user and the computer resources. This intermediary evaluates change requests using multiple criteria (validity, justification, timing, resource state) and only permits modifications that pass all checks. The intermediary acts as a mediator that enables authorized changes while blocking unauthorized ones, thus resolving the contradiction between ease of operation and reliability.
Solution Approach 2:
The system performs preliminary evaluation of change requests before allowing modifications to occur. It validates the request, checks justification, verifies timing appropriateness, and assesses resource state before permitting any changes. This preliminary action prevents unauthorized or inappropriate modifications from occurring in the first place.
2Reliability
If access constraints are implemented to prevent unauthorized changes, then system reliability is improved, but productivity decreases due to restricted access
Solution Approach 1:
The system implements partial constraints rather than complete restrictions. It applies access controls selectively based on the specific change request, evaluating each request against multiple criteria and permitting modifications that meet the criteria while blocking only those that don't. This partial action approach maintains reliability by blocking inappropriate changes while preserving productivity by allowing valid changes to proceed.
Solution Approach 2:
The access control system is dynamic rather than static. It evaluates each change request in real-time based on current system state, timing, justification quality, and resource conditions. The constraints adapt to each specific scenario, permitting access when appropriate and blocking when inappropriate, thus maintaining both reliability and productivity.
3Measurement precision
If multiple validation checks are performed on change requests, then the precision of access control is improved, but the complexity of the system increases
Solution Approach 1:
The validation system is segmented into distinct evaluation components, each responsible for a specific aspect of change request validation (validity check, justification check, timing check, resource state check). This segmentation allows each component to perform its specific function with high precision while keeping the overall system manageable through modular organization.
Data Source
AI summary
Systems, computer program products, and methods are described herein for dynamically permitting and restricting access to and modification of computer resources. The present invention may be configured to receive a change request identifying computer resources to be modified, determine whether privileged access is required to modify the computer resources, and receive credentials from a user device. The present invention may be further configured to generate an encrypted configuration file, determine whether the change request is valid, and further encrypt the encrypted configuration file based on determining that the change request is valid. The present invention may be further configured to determine whether the credentials authorize access to the computer resources, further encrypt the encrypted configuration file based on determining that the credentials authorize access to the computer resources, and permit and restrict access of the user device to computer resources based on the encrypted configuration file.