Entitlement Space Range-Based Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As the number of content pieces and users increases, access control checks become resource-intensive, leading to performance degradation in information technology systems, making it burdensome to determine authorized access efficiently.
Innovation Solution
The implementation of an entitlements system using access rules organized as ranges in an entitlement space, where a child rule is completely covered by its parent, allowing for quick entitlement checking by reusing calculated permitted ranges, and supporting implied permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control lists are used to check user authorization for each content piece, then access control can be implemented, but the process consumes considerable resources and leads to performance degradation when the number of content pieces and users increases
Solution Approach 1:
The patent pre-computes and stores permitted ranges in the entitlement space before actual access checks are needed. By organizing access rules as ranges and pre-calculating which ranges are permitted for each user, the system avoids performing complex authorization checks at the time of content access, thereby resolving the contradiction between maintaining accurate access control and improving authorization check speed
Solution Approach 2:
The patent creates a simplified representation (copy) of the access control logic in the form of permitted ranges in the entitlement space. Instead of checking against the full set of access control lists for each content piece, the system uses these pre-computed range representations to quickly determine authorization, maintaining accuracy while dramatically improving performance
2Reliability
If access control lists are checked for every content request, then user authorization can be verified, but the process becomes burdensome and resource-intensive as content volume and user numbers increase
Solution Approach 1:
The system performs authorization computations in advance by pre-calculating permitted ranges in the entitlement space based on user profiles and access rules. This preliminary computation stores the results in an optimized format that requires minimal processing during actual content access, thereby reducing computational resource consumption while maintaining reliable authorization verification
Solution Approach 2:
The patent segments the entitlement space into distinct ranges and organizes access rules as separate range definitions. This segmentation allows the system to process and store authorization information in a structured, efficient manner, enabling quick range-based comparisons during access checks without requiring exhaustive evaluation of all access control lists
3Reliability
If detailed access control lists are maintained for each user and content piece, then precise authorization can be determined, but the complexity of managing and checking these lists increases significantly
Solution Approach 1:
The patent transforms the access control representation from discrete user-content permission mappings to a continuous range-based model in the entitlement space. By changing the parameterization from individual access control list entries to range boundaries, the system maintains precise authorization determination while significantly simplifying the structural complexity of managing access rules
Data Source
AI summary
Entitlements to resources can be determined by using access rules that are organized as respective ranges in an entitlement space. An access rule can represent a range between two rational numbers in the entitlement space; the range can be represented by a single rational number. Due to the way the rational numbers are chosen, a child rule is completely covered by its parent, and a parent has remaining room in the entitlement space for unlimited additional children. Entitlement checking for a large batch of resources can be performed quickly based on reusing calculated permitted ranges in the entitlement space. Implied permissions can be supported. Content can easily be added, and the access rules can be modified without unduly impacting the underlying tree structure, if at all.