Dynamic Role-Based Access Control for Software Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software platforms for managing data lack flexibility in managing user access rights, requiring reprogramming and redevelopment to modify access permissions, leading to inefficiencies and potential security breaches.
Innovation Solution
The introduction of a user-configurable area of authority within the software platform allows administrators to define and set access rights on a user basis without requiring recoding or redeployment, enabling on-the-fly configuration of access permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access rights are hardcoded into the application at development time, then system security and access control are ensured, but any modification to access rights requires complete reprogramming, testing, and deployment cycles
Solution Approach 1:
The patent implements dynamic access rights by replacing static hardcoded permissions with a runtime-configurable role-based access control system. Administrators can modify user roles and their associated access rights without reprogramming the application. The system dynamically evaluates access requests against the current role definitions stored in the database, allowing access rights to adapt flexibly while maintaining security through structured role hierarchies and permission inheritance.
Solution Approach 2:
The patent changes the parameter of access rights from fixed compile-time constants to modifiable runtime parameters. Role definitions, including access permissions, are stored as data records in the database rather than hardcoded in the application code. This allows administrators to change access rights by updating database records, effectively separating the data (access rights) from the code (application logic) and enabling flexible modification without reprogramming.
2Adaptability or versatility
If new roles and access rights are added to the system, then user-specific access control is improved, but the development time and operational costs increase due to complete sprint development cycles
Solution Approach 1:
The patent performs preliminary action by pre-defining a set of roles with hierarchical relationships and associated access rights during system design. These roles and permissions are structured in advance and stored in the database, creating a ready-to-use framework. When new access rights are needed, administrators can configure them by combining and modifying these pre-defined roles rather than creating everything from scratch, significantly reducing configuration time and effort.
Solution Approach 2:
The patent creates universal role definitions that can serve multiple purposes and user types. Each role is designed with a set of access rights that can be inherited and combined, allowing a single role definition to be reused across different users and contexts. This multi-functional role system eliminates the need to create separate access control configurations for each user scenario, reducing both development time and operational complexity.
3Adaptability or versatility
If the application is reprogrammed to modify access rights, then access control flexibility is improved, but system stability and reliability may be compromised due to code changes
Solution Approach 1:
The patent extracts access right definitions from the application code and places them in the database as separate data entities. This separation isolates the configurable access control parameters from the core application logic, allowing modification of access rights without touching or risking the stability of the underlying system code. The application code remains unchanged and stable, while the extracted access right data can be freely modified through standard database operations.
Solution Approach 2:
The patent uses copying by creating role templates and permission sets that can be replicated and inherited. When new roles or access rights are needed, administrators can copy existing role definitions and modify them, rather than creating new configurations from scratch or changing core code. This copying mechanism ensures consistency and reliability while enabling flexible customization of access rights.
Data Source
AI summary
A method for setting access rights to project data in an application by defining an area of authority for a user, includes: determining a plurality of fields of data for a project in the application; determining a topology of one or more fields, from among the determined plurality of fields, for which the area of authority is to be settable; setting an area of authority for a registered user of the application, based on a field of the determined topology; and preventing access by the registered user to data for which a value of the field does not comply with the set area of authority.