Dynamic Role Assignment Validation Against Security Properties

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing role-based access control systems struggle to dynamically ensure adherence to invariant security properties, leading to potential compromises of sensitive data due to dynamic changes in roles, permissions, and resources, without prior conformance checks.

Innovation Solution

A method to determine whether a proposed role assignment conforms to security properties before implementation by generating a static policy from impacted role assignments and comparing it to a specification, using logical artifacts to ensure compliance with security boundaries.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If role-based access control is made dynamic to allow frequent changes in users, resources, and permissions, then adaptability and responsiveness to changing organizational needs are improved, but the ability to guarantee adherence to invariant security properties deteriorates

Engineering Contradiction:

Improvedynamic role assignmentVSAvoidsecurity property adherence

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system performs preliminary conformance checking of proposed role assignments against invariant security properties before the assignments are implemented. This advance validation ensures that dynamic changes to access control do not compromise security boundaries, resolving the contradiction by preventing security violations before they occur.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system provides feedback about conformance to security properties by comparing proposed role assignments against defined security properties and threat models. This feedback mechanism allows the system to maintain security adherence even as role assignments change dynamically, addressing the reliability concern.

Inventive Principle:

Principle #23Feedback

2Reliability

If manual determination of access control conflicts is required to ensure security, then security property adherence is improved, but the complexity and time required for access control management increases

Engineering Contradiction:

Improvesecurity property adherenceVSAvoidaccess control management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system replaces manual determination of access control conflicts with an automated computer-implemented method. The processor automatically checks proposed role assignments against security properties, eliminating the need for manual analysis while maintaining security adherence, thus reducing complexity without sacrificing reliability.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The access control system performs self-validation by automatically checking whether proposed role assignments conform to security properties. This self-service capability eliminates the need for external manual verification, reducing management complexity while ensuring security property adherence.

Inventive Principle:

Principle #25Self-service

3Reliability

If comprehensive security checks are performed on all role assignments, then security property adherence is improved, but the time and computational resources required increase

Engineering Contradiction:

Improvesecurity property adherenceVSAvoidconformance checking time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system extracts and checks only the specific invariant security properties that are relevant to the proposed role assignment, rather than performing exhaustive checks on all possible security aspects. This selective approach maintains security adherence while reducing the time and computational resources required for conformance checking.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS12452249B2Action based on pre-implementation determination whether a proposed role assignment associated with a role hierarchy conforms to security properties

Publication Date: 2025.10.21 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Techniques are described herein that are capable of performing an action based on a pre-implementation determination whether a proposed role assignment associated with a dynamic role hierarchy conforms to security properties. Role assignments, assigning roles to principals, and a proposed role assignment are identified. Impacted role assignments are selected from the role assignments. A static policy, which is defined by the impacted role assignments and the proposed role assignment, is generated. The static policy is converted into a first logical artifact. A specification and a relationship property are converted into a second logical artifact. The specification includes security properties defining boundaries of allowed actions and disallowed actions. The relationship property defines a relationship between the specification and the static policy. Prior to implementation of the proposed role assignment, the first and second logical artifacts are compared to determine whether the proposed role assignment conforms to the security properties.