Dynamic Resource Access Control via Expression Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Role Based Access Control (RBAC) systems face limitations in flexibility due to their static mechanism for assigning permissions, which becomes a challenge when network storage systems undergo frequent changes.
Innovation Solution
Implementing a method and system that allows dynamic specification of resources by using expressions, such as regular expressions or queries, to identify objects upon which roles can perform operations, rather than predetermining the object identity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static mechanism is used for assigning permissions in RBAC system, then management of individual user rights is simplified, but flexibility of the system is limited when the system changes frequently
Solution Approach 1:
The patent applies dynamics by transitioning from static object identification to dynamic object identification using expressions. Instead of fixing object identities at permission assignment time, the system evaluates expressions at authorization time to dynamically determine which objects a role can access. This allows the access control system to adapt to frequent changes in the network storage system while maintaining simplified role-based management.
Solution Approach 2:
The patent changes the parameter of object identification from fixed static values to dynamic expressions. By introducing expressions that can be evaluated at runtime, the system transforms the rigid permission assignment mechanism into a flexible one that can respond to system changes. The expression evaluation process allows object identities to be determined based on current system state rather than predetermined values.
2Ease of manufacture
If static object identification is used in RBAC, then permission assignment is straightforward, but the system cannot adapt to frequent changes in network storage systems
Solution Approach 1:
The system introduces dynamic object identification through expression evaluation. Instead of assigning permissions to fixed objects, roles are assigned permissions based on expressions that are evaluated at authorization time. This dynamic approach allows the system to adapt to frequent changes in network storage systems while keeping the permission assignment process straightforward through role-based management.
Solution Approach 2:
The patent introduces an expression evaluation mechanism as an intermediary between role assignment and object access. The expression acts as a mediator that translates static role permissions into dynamic object-specific authorizations. This intermediary layer enables the system to maintain simple role-based permission assignment while achieving adaptability through runtime expression evaluation.
3Adaptability or versatility
If dynamic specification of resources is implemented, then flexibility and adaptability are enhanced, but system complexity increases
Solution Approach 1:
The patent applies universality by using a single expression evaluation mechanism to handle multiple roles and objects. Instead of creating separate complex permission management systems for each role-object pair, the system uses a universal expression evaluation approach that works across all roles and objects. This reduces overall system complexity while maintaining high flexibility and adaptability.
Solution Approach 2:
The system manages complexity by changing parameters in a controlled manner through expression evaluation. Rather than implementing complex dynamic permission management from scratch, the patent modifies the existing static RBAC parameters by introducing expression-based object identification. This parameter change approach enables flexibility enhancement while keeping the underlying RBAC structure intact, thus limiting the increase in system complexity.
Data Source
AI summary
In an RBAC system, a capability is defined as including an operation and an object on which the operation is to be performed. The capability is assigned to a role, which is in turn assigned to a user. Then the user will have the authorization to perform the operation on the object. Rather than specifying the object by predetermining the identity of the object, an expression (e.g., a regular expression, a query, etc.) may be specified in place of the predetermined object. In response to a request initiated by a user, the expression is then evaluated to determine the identity of the object(s) on which the operation may be performed.