Entity Security Implied by Asset in Repository System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Repository systems face performance burdens when managing access to large numbers of objects, as existing methods either administer access coarsely, leading to inefficiencies, or finely, resulting in significant processing time to determine access rights for individual objects.
Innovation Solution
Implementing a system that manages access to entities based on entitlements associated with assets, where access policies grant rights to perform actions on entities by determining permissions through roles, reducing the need for individual object access checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If access is administered in a coarse-grained fashion based on the entire asset, then access control is simplified and processing time is reduced, but access precision to individual objects is lost
Solution Approach 1:
The patent segments the asset into individual objects (components, services, references) while maintaining the asset as a container. Each object can have its own access control settings, allowing fine-grained access control to individual objects while still benefiting from the asset-level organization and some coarse-grained access determination.
Solution Approach 2:
The patent applies different access control characteristics to different parts of the asset. Each object within the asset can have localized access control settings tailored to its specific security requirements, while the asset itself can have overarching access policies. This allows simultaneous coarse and fine-grained access control.
2Measurement precision
If access is administered in a fine-grained manner to each object, then access precision is improved, but processing time and system performance burden increase significantly
Solution Approach 1:
The patent performs preliminary access determination at the asset level before evaluating individual objects. The system first checks if the user has access to the asset as a whole, then only evaluates access to individual objects if needed. This preliminary filtering reduces the overall processing burden while maintaining fine-grained control where necessary.
Solution Approach 2:
The patent merges asset-level access control with object-level access control into a unified framework. The access determination process combines both coarse-grained asset-level checks and fine-grained object-level checks, allowing the system to leverage both approaches simultaneously rather than choosing one over the other.
3Reliability
If access control evaluates each object individually, then access security is strengthened, but system performance and processing capacity are burdened
Solution Approach 1:
The patent implements periodic or staged access evaluation, first checking asset-level access controls, then proceeding to object-level checks only when necessary. This staged approach maintains strong security by evaluating all relevant access controls while optimizing performance by avoiding unnecessary detailed object-level evaluations for users who lack asset-level access.
Solution Approach 2:
The patent creates a universal access control framework that handles both asset-level and object-level access control through a single unified mechanism. This multi-functional system can operate at different granularities as needed, providing both strong security and acceptable performance by adapting its evaluation depth to the specific access request.
Data Source
AI summary
Techniques are described for managing access to a repository system storing information (e.g. metadata) about objects (e.g. an application a process or a service) in a computing environment. The repository system can store a data structure (an “entity”) that includes information about an object. An entity can have an association with one or more collections of entities (“assets”) that classify a collection of entities. Access to perform actions (e.g. create read update or delete) an entity can be managed based on an entitlement which grants a right to access information in the entity and/or at least one asset having an association with the entity. The repository system can manage access to one or more entities based on rights implied by an entitlement to access one or more assets associated with those entities.