Dynamic Access Rights Association via Policy Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems for associating access rights with resources require processing each resource individually and permanently assigning attributes, which is inefficient and inflexible, as different clients may have varying access rights that change over time, necessitating a dynamic method for real-time attribute assignment based on client evaluations.
Innovation Solution
A method where a server receives a request from a client, requests access rights from a policy engine, and associates these rights with the resource using a rights markup language, allowing for dynamic access control decisions at the time of resource access, enabling flexible and varying attribute assignment based on real-time client information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If individual resources are processed one at a time to associate attributes before making them available to users, then access rights can be properly assigned, but significant administrative tasks are created and processing time increases
Solution Approach 1:
The system performs preliminary actions by pre-defining policies and attribute sets that can be automatically applied to resources. Instead of processing each resource individually, the system prepares access control policies in advance that can be dynamically applied based on client characteristics, reducing the administrative burden while ensuring proper access rights assignment.
Solution Approach 2:
The system enables self-service by allowing resources to be automatically associated with appropriate access rights through policy-based automation. When a resource is accessed, the system automatically evaluates client information against defined policies and assigns the appropriate attribute set without requiring manual administrative intervention, thereby improving processing efficiency while maintaining reliable access control.
2Reliability
If attributes are permanently associated with resources during processing, then access control can be enforced, but flexibility is lost when different clients require different access rights or when policies need to change
Solution Approach 1:
The system implements dynamics by making attribute assignment flexible and adaptive rather than static. Attributes are not permanently fixed to resources but are dynamically determined at access time based on client characteristics and current policies. This allows the system to enforce reliable access control while adapting to different clients and changing policy requirements without reprocessing all resources.
Solution Approach 2:
The system applies parameter changes by varying the attribute sets assigned to resources based on client-specific parameters. Instead of using a single permanent attribute set, the system changes the effective attributes dynamically based on client information, network location, time of access, and other parameters, enabling both reliable enforcement and flexible adaptation to different scenarios.
3Reliability
If all resources in an organization are re-processed to change attributes or policies, then access rights can be updated, but significant time and administrative effort are required
Solution Approach 1:
The system uses preliminary action by maintaining a centralized policy definition that can be updated independently of resource processing. When policies need to change, administrators only need to update the policy definitions, not reprocess individual resources. The updated policies are then automatically applied to future access requests, ensuring reliable updates without time-consuming reprocessing of all resources.
Solution Approach 2:
The system applies universality by using a single policy definition that can be universally applied to multiple resources and clients. When a policy needs updating, the change is made in one central location and automatically propagates to all relevant resources and access requests, eliminating the need to individually update each resource and significantly reducing the time and effort required for policy updates while maintaining reliable access control.
Data Source
AI summary
A method for dynamically associating, by a server, access rights with a resource includes the step of receiving, by the server, a request for a resource from a client. The server requests, from a policy engine, an identification of a plurality of access rights to associate with the resource, the plurality of access rights identified responsive to an application of a policy to the client. The server associates the resource with the plurality of access rights via a rights markup language. The server transmits the resource to the client with the identification of the associated plurality of access rights. An application program on the client makes an access control decision responsive to the associated plurality of access rights. The application program provides restricted access to the resource responsive to the access control decision.