Dynamic Workflow Access Control for Task-Specific Permissions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control mechanisms in Workflow Management Systems rely on static authorization, leading to potential insecurity due to permissions being granted for longer periods than needed, which can result in unauthorized access and increased complexity in managing role changes.
Innovation Solution
A method and device for access control that dynamically obtains and revokes operation permissions based on a preset correspondence relationship between tasks and roles, ensuring that access is controlled according to the specific requirements of each task in a workflow, thereby aligning permissions with the task's life cycle.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static authorization is used in traditional access control mechanisms, then the system is simple to implement, but security is compromised because permissions are granted for longer periods than needed
Solution Approach 1:
The patent applies dynamics by transitioning from static authorization to dynamic authorization. The access control mechanism dynamically adjusts permissions based on the current workflow state and task requirements. Permissions are granted and revoked automatically according to task completion status, ensuring that subjects only have access to objects when needed for current workflow tasks, thereby improving security without requiring complex manual intervention.
Solution Approach 2:
The patent implements feedback mechanisms where the access control system continuously monitors workflow execution status and adjusts authorization accordingly. When tasks are completed, the system receives feedback and automatically revokes corresponding permissions. This closed-loop feedback ensures that permissions remain aligned with actual workflow needs, enhancing security while maintaining manageable system complexity through automated decision-making.
2Adaptability or versatility
If static authorization is used, then role management is straightforward, but it increases complexity when roles need to be changed or updated
Solution Approach 1:
The patent makes role management dynamic by automatically adjusting role assignments based on workflow state changes. When a subject transitions between workflow tasks, the system dynamically updates their authorized roles and permissions without manual intervention. This allows the system to adapt to role changes in real-time according to workflow requirements, improving versatility while reducing the operational complexity of role management through automation.
Solution Approach 2:
The access control system performs self-service by automatically managing role assignments and permission adjustments based on workflow execution status. The system monitors task completion and autonomously revokes or grants roles without requiring administrator intervention. This self-service capability enhances the system's ability to adapt to changing roles while simplifying administration by eliminating manual role management tasks.
3Reliability
If permissions are granted for longer periods than needed, then access control is simplified, but unauthorized access becomes more likely
Solution Approach 1:
The patent applies dynamics by making permission grants temporary and task-specific rather than long-term. Permissions are automatically adjusted based on current workflow tasks, ensuring subjects only access objects when currently needed. This dynamic approach maintains security by limiting permission duration while simplifying operation through automated permission management that eliminates manual review and adjustment requirements.
Solution Approach 2:
The system uses feedback from workflow execution status to automatically adjust permission duration. When tasks are completed, the system receives feedback and immediately revokes corresponding permissions. This feedback mechanism enhances security by preventing unauthorized access through automatic permission expiration, while maintaining ease of operation through automated decision-making that eliminates manual permission management tasks.
Data Source
AI summary
The disclosure discloses a method and device for access control. The method includes: when a group of tasks are executed, controlling an access of a subject to an object according to operation permission corresponding to each of the tasks in the group of tasks. The device comprises a control component arranged to, when a group of tasks are executed, control an access of a subject to an object according to operation permission corresponding to each of the tasks in the group of tasks.