Dynamic Authorization Policy Data Structure for Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern access control systems face inefficiencies due to the costly and slower evaluation processes associated with dynamic attributes, which can take several Round Trip Times (RTTs) to retrieve and evaluate, compared to traditional static policy evaluation.
Innovation Solution
Implementing a method that uses a policy data structure defining both predetermined authorizations and dynamic access requirements, where dynamic authorizations are added to the policy data structure for user requests lacking determinative authorizations, allowing for efficient evaluation by converting attribute-based decisions into authorizations, thus reducing the need for costly dynamic attribute evaluation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If dynamic attribute evaluation is used for access control, then adaptability and security are improved, but processing speed and system response time deteriorate
Solution Approach 1:
The system performs preliminary action by evaluating dynamic access requirements and attributes in advance during the authorization determination phase. By pre-evaluating whether dynamic attributes satisfy access requirements before actual resource access is attempted, the system reduces the need for costly RTT-based attribute retrieval during the actual access operation, thereby improving processing speed while maintaining adaptability.
Solution Approach 2:
The system introduces an intermediary mechanism - a policy data structure that mediates between the access control system and dynamic attribute evaluation. This intermediary layer determines whether dynamic evaluation is necessary by first checking predetermined authorizations, and only invokes full dynamic attribute evaluation when needed, thus resolving the contradiction between adaptability and processing speed.
2Reliability
If dynamic access requirements are evaluated for every request, then security and privacy protection are improved, but processing time and system performance deteriorate
Solution Approach 1:
The system segments the access control evaluation process into distinct phases: first evaluating predetermined authorizations in the policy data structure, then only invoking dynamic access requirement evaluation when necessary. This segmentation allows the system to quickly reject unauthorized requests without time-consuming dynamic attribute evaluation, reducing authorization determination time while maintaining security through selective dynamic evaluation.
Solution Approach 2:
The system applies partial action by evaluating only the necessary portion of access control requirements. Instead of always performing full dynamic attribute evaluation, the system first checks if predetermined authorizations apply, and only performs dynamic evaluation when the partial check indicates authorization is needed, thus reducing processing time while maintaining adequate security protection.
3Measurement precision
If attribute retrieval is performed for every access request, then access control accuracy is improved, but network latency and processing cost increase
Solution Approach 1:
The policy data structure acts as an intermediary that filters access requests before triggering expensive attribute retrieval operations. By first determining whether predetermined authorizations or dynamic access requirements apply, the system avoids unnecessary attribute retrieval for requests that can be decided by static policy rules, thus reducing network latency and processing cost while maintaining access control accuracy for cases where dynamic evaluation is actually needed.
Data Source
AI summary
A policy data structure defines predetermined authorizations, each relating to authorization of at least one user to access at least one resource as well as to dynamic access requests. Each dynamic access request indicates a condition to be satisfied by a respective set of attributes associated with a user request to access a resource and for the request to be granted in absence of an authorization determinative of the request. If the structure does not define an authorization for a request to access a resource, it is determined whether the structure defines a dynamic access requirement determinative for the request, and if so, whether to grant the request in accordance with the respective set of attributes associated with the request. For at least one request, after determining whether to grant the request, a dynamic authorization relating to authorization to access the resource within the request is added to the structure.