External Authorization Policy Management for Enterprise Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems face challenges in managing fine-grained authorization across multiple applications due to hard-coded authorization logic, which is not centrally controlled or audited, leading to compliance issues and increased costs in integrating a central fine-grained authorization management system.
Innovation Solution
A method to model and store authorization policies independently of runtime, generating decision sets that can be propagated to applications without requiring them to call a central fine-grained authorization management system's API, allowing for centralized policy management and auditing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If authorization logic is hard-coded into application logic, then authorization decisions can be made within the application, but centralized management and auditing of authorization policies become difficult or impossible
Solution Approach 1:
The patent extracts authorization logic from application code and places it in a separate policy management system. Authorization policies are defined externally in configuration files or databases, allowing centralized management while keeping applications simpler. The application server retrieves and enforces these external policies rather than containing hard-coded authorization logic.
Solution Approach 2:
The patent introduces an intermediary authorization policy server that mediates between the application and the centralized policy management system. This intermediary component allows applications to enforce centralized policies without direct integration with the policy management infrastructure, simplifying the application architecture while enabling centralized control.
2Reliability
If a central fine-grained authorization management system is integrated with existing applications, then centralized policy control is achieved, but recoding existing applications is required
Solution Approach 1:
The patent prepares applications for centralized authorization management in advance by establishing external policy definitions and configuration mechanisms before full integration is required. This preliminary setup allows incremental adoption and reduces the shock of full recoding by having the infrastructure ready but optional.
Solution Approach 2:
The patent creates a dynamic authorization system where policies can be changed externally without requiring application recoding. The system adapts to different policy configurations through runtime policy loading and interpretation, allowing compliance requirements to evolve without forcing application modifications.
3Measurement precision
If fine-grained authorization is implemented, then precise control over user permissions is achieved, but system complexity increases
Solution Approach 1:
The patent segments the authorization system into distinct components: policy definition, policy storage, policy interpretation, and policy enforcement. This segmentation allows fine-grained authorization capabilities to be distributed across multiple layers, with each layer handling specific aspects, thereby reducing overall system complexity while maintaining precision.
Solution Approach 2:
The patent creates a universal authorization framework that can handle multiple authorization scenarios and policy types through a common infrastructure. The policy interpretation engine provides multi-functional capabilities to evaluate different policy formats and enforcement requirements, reducing the need for separate specialized systems for each authorization scenario.
Data Source
AI summary
Access control rules can be defined for target applications of an enterprise system independent of a runtime of the target applications. The access control rules can then normalized into decision tables. These decision tables can then be used to reconcile authorization information with the target applications via user provisioning. This process can enable comprehensive reporting and analysis of enterprise access control rules without requiring direct integration of the target applications at runtime.