Dynamic Management Scope for Application Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control methods struggle to grant precise access privileges within applications, especially in scenarios where multiple users share responsibility for managing resources, as they rely on operating system groups that cannot determine access privileges for specific operations, leading to increased management complexity and error-prone solutions.
Innovation Solution
Implementing a dynamic management scope for transactions within applications, which generates a collection of permissions based on roles and resource administration rights assigned to the operator initiating the transaction, allowing for evaluation against other operators' scopes to determine if alterations can be made, using rules such as equal or superset relationships.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If OS-level access control groups are used for application access control, then access control can be implemented at the operating system level, but access control for specific operations within applications cannot be achieved
Solution Approach 1:
The patent segments access control into two distinct layers: OS-level access control groups for general resource access and application-level operation scopes for specific operation control. This segmentation allows each layer to handle the type of access control it is best suited for, resolving the contradiction between ease of implementation and operation-specific control capability.
Solution Approach 2:
The patent implements a nested structure where application-level operation scopes are embedded within the broader OS access control framework. The operation scope contains detailed permissions for specific operations, which are nested within the user's OS-level access control group context, enabling both layers to work together harmoniously.
2Adaptability or versatility
If new security resources are added to control operations, then access control for specific operations can be achieved, but management complexity increases
Solution Approach 1:
The operation scope serves as a universal mechanism that can control any operation within an application context. Rather than creating separate security resources for each operation, the operation scope provides a multi-functional framework that can be applied across different operations and applications, reducing overall management complexity.
Solution Approach 2:
The patent adds a new dimension to access control by introducing the operation scope concept that operates within the application layer. This dimensional addition allows fine-grained control of specific operations without requiring complex modifications to the existing OS-level access control structure, managing complexity through hierarchical organization.
3Ease of operation
If static role assignments are used for access control, then access management is simplified, but dynamic authorization for multiple operators cannot be achieved
Solution Approach 1:
The operation scope is designed to be dynamic rather than static. It can be created, modified, and deleted based on operational requirements, and can be assigned to different operators as needed. This dynamic nature allows the system to adapt to changing authorization requirements while maintaining manageable complexity through the structured scope definition.
Data Source
AI summary
A technique to implement access control from within an application begins by dynamically-generating a “management scope” for a transaction associated with a set of managed resources. The management scope is a collection of permissions defined by at least one of: a set of roles, and a set of resource administration rights, that are assigned to a first operator that issues the transaction. As the transaction executes, a request to alter the transaction is then received from a second operator. According to the technique, the management scope for the transaction and associated with the first operator is then evaluated against a management scope associated with the second operator. Upon determining the management scope associated with the first operator has a given relationship to the management scope for the second operator, the transaction is permitted to be altered in response to the request. The given relationship is scoped by one or more rules.