Dynamic Access Control for Protected Data Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access control methods require authentication for all users, including non-authenticated users, which restricts access to protected electronic resources and prevents public availability of information within a protected data environment, and do not allow dynamic changes to security constraints without restarting the web application.
Innovation Solution
A resource access control method that defines an exception list of Uniform Resource Identifiers (URIs) for public access, creates One-Time URIs, and applies drill-down depth restrictions to allow non-authenticated users to access specific resources within a protected data environment without relocating or duplicating data, using cascading-depth or predecessor-successor algorithms to control access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication is required for all users accessing protected electronic resources, then security is improved, but accessibility to public information deteriorates
Solution Approach 1:
The patent applies local quality by differentiating access control based on the specific resource being accessed. Public resources within the protected data environment are made accessible without authentication, while protected resources require authentication. This is achieved by examining the resource type and applying appropriate access policies locally, allowing coexistence of both public and secure access mechanisms within the same system.
2Reliability
If security constraints are defined declaratively in web applications, then access control is improved, but system availability deteriorates due to restart requirements
Solution Approach 1:
The patent implements dynamics by transitioning from static declarative security constraints to dynamic access control mechanisms. The system dynamically determines access rights based on resource properties and user characteristics at runtime, eliminating the need for declarative policy definitions that require application restarts. This dynamic approach maintains security while ensuring continuous system availability.
3Reliability
If all electronic resources are stored in a protected data environment, then security is improved, but public availability of information deteriorates
Solution Approach 1:
The patent applies segmentation by dividing electronic resources within the protected data environment into distinct categories: public resources and protected resources. This segmentation allows the system to maintain security for protected resources while enabling public access to designated public resources, resolving the contradiction between security and information availability.
Data Source
AI summary
User access is controlled through a computer network within a protected data environment of a computer environment. An exception list comprising an Identifier stored within the protected data environment for granting user access of an unauthorized user is defined. At least one allowed access property relation for user access is defined when accessed by the unauthorized user. An Identifier of a user access request of the unauthorized user is checked in the exception list. A One-Time Identifier is created. The One-Time Identifier is assigned to the electronic data resource according to the allowed property relation. The requested resource is delivered to the unauthorized user by using the assigned One-Time Identifier.