Graph Database Authorization Object for Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in controlling access to information within their systems, as existing methods are costly and inefficient, leading to potential security breaches and unauthorized access to sensitive documents.
Innovation Solution
A computer-implemented method using a graph database to dynamically manage access control by creating a list of authorized individuals based on an authorization object linked with documents, ensuring that only permitted actions are performed by authorized actors, leveraging the flexible graph database's ability to dynamically define relationships and update access permissions in real-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control methods are used to control employee access to information, then security is improved, but cost and operational efficiency deteriorate
Solution Approach 1:
The patent introduces an authorization object as an intermediary between users and data elements. This authorization object contains access control information and automatically generates authorization lists, serving as a mediator that simplifies the access control mechanism while maintaining security. The authorization object translates complex access control requirements into automatic list generation, reducing the burden on the access control system.
Solution Approach 2:
The system implements self-service through automatic authorization list generation. When a data element is accessed, the system automatically reads the authorization object, generates the appropriate authorization list, and performs access control without manual intervention. This self-service mechanism reduces operational complexity and improves efficiency while maintaining security requirements.
2Reliability
If manual access control management is implemented, then security is improved, but time consumption and productivity deteriorate
Solution Approach 1:
The patent applies preliminary action by pre-defining authorization objects with access control information before actual data access occurs. The authorization objects are configured in advance with the necessary permissions and restrictions, so that when access is needed, the system can quickly generate authorization lists without manual intervention. This preliminary setup significantly reduces the time required for access control operations while maintaining security reliability.
Solution Approach 2:
The system performs self-service by automatically generating authorization lists based on pre-configured authorization objects. The automatic generation process eliminates manual time-consuming operations while ensuring consistent and reliable access control. The system reads the authorization object, generates the appropriate list of authorized individuals, and executes access control decisions without human intervention, thereby reducing time loss while maintaining security.
3Reliability
If comprehensive access control is applied to all data elements, then security is improved, but system complexity and operational difficulty increase
Solution Approach 1:
The patent segments the access control mechanism into distinct components: authorization objects that contain access control information, authorization lists that are automatically generated, and data elements that are protected. This segmentation allows each component to be managed independently, simplifying operations. The authorization object is a self-contained unit that encapsulates all necessary access control logic, making the system easier to operate while maintaining comprehensive security.
Solution Approach 2:
The authorization object serves as an intermediary that simplifies the interaction between users and data elements. Instead of directly managing complex access control rules for each data element, users work with authorization objects that automatically generate the necessary authorization lists. This intermediary layer abstracts the complexity of comprehensive access control, making the system easier to operate while maintaining security.
Data Source
AI summary
A computer-implemented method of improving data access in an organization by a computer. The computer receives a command from an individual to perform an action on a data element to the organization. Responsive to receiving the command, the computer reads an authorization object assigned to the data element. Responsive to reading the authorization object, the computer creates list of individuals authorized to perform the action on the data element in accordance with the authorization object. Responsive to creating the list, the computer permits the action on the data element only if the individual is on the list.