Dynamic Limited Access Interface for Computational Resources
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems face challenges in implementing fine-grained multi-dimensional access control without compromising performance, leading to inconsistent coverage and excessive processing overhead, particularly in multi-tenant communications networks.
Innovation Solution
A method and system that determine a user's access role and target, defining a limited access interface to a subset of computational resources, thereby providing tailored access while avoiding unnecessary data replication and processing overhead, using a combination of Role-Based Access Control (RBAC) and Target-Based Access Control (TBAC) principles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If fine-grained multi-dimensional access control is implemented in services space, then access control precision is improved, but architectural complexity increases and service consistency deteriorates
Solution Approach 1:
The patent introduces an access manager as an intermediary component between users and computational resources. This access manager centrally handles fine-grained multi-dimensional access control decisions, eliminating the need to implement complex access control mechanisms in each service individually. The access manager receives access requests, evaluates them against defined policies, and grants or denies access accordingly, thus maintaining service consistency while achieving precise access control.
Solution Approach 2:
The access manager serves multiple functions: it implements role-based access control (RBAC), target-based access control (TBAC), and policy management all in one centralized component. This universal approach allows the system to achieve fine-grained access control precision without duplicating access control logic across multiple services, thereby reducing architectural complexity.
2Manufacturing precision
If fine-grained multi-dimensional access control is implemented in services space, then access control precision is improved, but service consistency deteriorates
Solution Approach 1:
The access manager acts as a centralized mediator that ensures consistent access control policies are applied across all services. By consolidating access control logic in one location, the system avoids inconsistencies that would arise from implementing access control separately in each service. The access manager maintains a unified view of access policies and applies them uniformly, ensuring service consistency while achieving fine-grained control precision.
3Manufacturing precision
If multi-dimensional access control is implemented in data repositories, then access control precision is improved, but processing throughput deteriorates
Solution Approach 1:
The system performs preliminary actions by pre-defining access policies, roles, and targets in the access manager before access requests are processed. Access control decisions are based on these pre-configured policies rather than performing complex multi-dimensional evaluations for each request. This preliminary setup enables fast access control checks that do not choke throughput, while still maintaining fine-grained precision through the structured policy framework.
Solution Approach 2:
The access manager serves as an intermediary that handles access control evaluations outside the data repository path. By moving access control logic from the data repository to the access manager, the system avoids adding processing overhead to the data repository operations. The access manager evaluates access requests against pre-defined policies and returns decisions quickly, maintaining high processing throughput while achieving precise access control.
Data Source
AI summary
A first access interface (100) of a an access control system provides access to computational resources (150). At least one access role of a user and at least one access target associated with the access role of the user are determined. Based on the at least one access role of the user and the associated at least one access target, a subset of the computational resources (150) is determined. A second access interface (110, 120) is defined which is limited to the subset of the computational resources (150). Through the second access interface (110, 120) the user is provided with access to the subset of the computational resources (150).