Dynamic Access Control System with Runtime Policy Merging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems for computer systems, particularly in B2B interactions, face challenges in customizing security policies to meet the diverse needs of multiple users and businesses, as they often rely on pre-defined roles with limited flexibility and customization capabilities.
Innovation Solution
An access control system that merges a default security policy with custom security policies at runtime, allowing for dynamic user experiences and customizable access controls, enabling users to define complex rules and customize security policies without relying on traditional role-based access control systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional role-based access control (RBAC) is used, then access rights can be assigned based on user roles, but the system lacks flexibility and customization capability to meet diverse needs of multiple users and businesses
Solution Approach 1:
The patent segments the security policy into multiple independent components including default security policies, custom security policies, and context-specific policies. Each policy component can be independently configured, evaluated, and merged, allowing the system to achieve high customization capability without requiring a complete redesign of the entire access control system. This modular segmentation enables flexible policy composition while maintaining manageable system complexity.
2Adaptability or versatility
If multiple custom security policies are created to meet diverse user needs, then customization capability improves, but the complexity of managing multiple security policies increases
Solution Approach 1:
The patent implements a policy merging mechanism that automatically combines default security policies with custom security policies to form a unified effective security policy. The system merges these policy components by evaluating their conditions and actions together, allowing multiple custom policies to coexist without requiring manual management of each individual policy. This automatic merging process reduces policy management complexity while preserving the customization benefits of having multiple policies.
Solution Approach 2:
The patent incorporates context evaluation as a feedback mechanism that dynamically assesses whether security policies should be applied based on the current operational context. The system evaluates context attributes (such as user identity, resource type, operation type, and environmental conditions) and uses this feedback to determine which policies are relevant and should be enforced. This context-driven feedback loop simplifies policy management by automatically filtering and applying only the necessary policies rather than managing all possible custom policies.
3Measurement precision
If granular permissions are implemented to enhance security, then access control precision improves, but the complexity of defining and managing permissions increases
Solution Approach 1:
The patent applies local quality by allowing different security policies to be applied to different contexts, resources, and operations. Each security policy can specify precise conditions (such as specific user roles, resource types, operation types, and environmental conditions) that determine when and where the policy should be enforced. This enables granular access control precision by tailoring security rules to specific local contexts rather than applying uniform rules system-wide, while the modular policy structure keeps management complexity manageable.
Data Source
AI summary
Systems and methods for providing controlled access to a system by a user device include receiving, from a user device, a request including a current context. The method includes receiving a request for access to a computing resource, the request including a current context, the current context defining a user space and a resource space. The user device evaluates the current context against a security policy. The user device determines that the user device is permitted to access the computing resource based on the request in response to the evaluating the current context against the security policy. In response to determining that the user device is permitted to access the computing resource, accessing the computing resource as requested.