Group-Based Access Control for Distributed Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed systems, administrators face challenges in maintaining up-to-date access permissions as user roles change, leading to stale access permissions that allow unauthorized users to access secured resources.
Innovation Solution
Implementing a group-based access control system where users are granted access based on membership in predefined access control groups, with administrators able to easily manage group memberships and permissions, ensuring only authorized users can access secured resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional user-based access control is used in distributed systems, then individual user permissions can be managed, but maintaining up-to-date access permissions becomes increasingly difficult as the number of users and content increases
Solution Approach 1:
The patent segments the access control system into two distinct layers: group-level access control (determining whether a user can access a resource) and user-level fine-grained access control (determining what operations a user can perform). This segmentation resolves the contradiction by making permission management easier through group-based organization while maintaining the capability for detailed individual controls when needed.
Solution Approach 2:
The patent introduces group membership as an intermediary layer between users and resources. Instead of directly managing individual user permissions to resources, the system uses group assignments as a mediator. This intermediary simplifies access control management by allowing administrators to manage permissions at the group level rather than individually for each user, reducing the complexity burden.
2Reliability
If traditional access control is used, then initial permissions can be set, but stale access permissions allow users who should no longer have rights to access secured resources
Solution Approach 1:
The patent implements preliminary action by establishing group membership assignments before users need access to resources. When a user's group membership changes, the system proactively updates their access permissions to secured resources. This prevents stale permissions from forming in the first place, maintaining reliability without requiring continuous manual intervention and reducing the time loss associated with reactive permission updates.
Solution Approach 2:
The patent implements a feedback mechanism where the system continuously monitors changes in user group memberships and automatically updates access permissions accordingly. When a user is added to or removed from a group, the system receives feedback about this change and automatically adjusts the user's access rights to secured resources. This closed-loop feedback ensures permission accuracy is maintained dynamically without manual intervention.
3Productivity
If group-based access control is implemented, then access can be efficiently granted or revoked based on group membership, but the system must manage both group-level and user-level access control information
Solution Approach 1:
The patent segments access control information into two distinct structures: group access control information (linking groups to secured resources) and user access control information (storing fine-grained permissions for individual users). This segmentation improves productivity by allowing efficient bulk permission management through groups while maintaining the capability for individual user controls. The segmented structure manages complexity by organizing information hierarchically rather than requiring a single complex flat structure.
Solution Approach 2:
The patent adds a group membership dimension to the traditional user-resource access control matrix. Instead of only managing user-to-resource permissions directly, the system introduces an intermediate group dimension. Users are assigned to groups, and groups are assigned to resources, creating a user-group-resource hierarchical structure. This dimensional change improves efficiency by enabling bulk operations through groups while managing complexity through hierarchical organization.
Data Source
AI summary
A data processing system for controlling data access to a secured resource of a distributed system implements receiving, from a first user device of a first user, a first request to access a secured resource and a first security token, the first security token including group information for one or more first access control groups associated with the secured resource of which the first user is a member; accessing group access policy information for groups associated with the secured resource; determining, based on the group information included in the first security token and the group access policy information, that the first user is a member of at least one group that is permitted to access the secured resource; and permitting the first user device of the user to access the secured resource responsive to determining that the first user is a member of at least one group that is permitted to access the secured resource.