Hierarchical Attribute-Based Access Control for Scalable Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security models are inefficient and lack scalability, making it burdensome for system administrators to implement resource-level security on networked computers with a large number of resources and users, particularly in data warehouses.
Innovation Solution
A method and apparatus for controlling access to resources using a hierarchical access control model that allows resources to inherit access abilities from containing collections, with iterative attribute comparison and caching to reduce processing intensity and database queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security models are used to control access to resources on networked computers, then resource-level security can be implemented, but the system becomes burdensome for system administrators and inefficient in terms of processing and hardware resources
Solution Approach 1:
The patent segments the security management system into hierarchical levels (resource level, collection level, and system level). Each level has its own access control list, allowing security policies to be divided and managed at appropriate granularities. This segmentation reduces the complexity burden on system administrators by distributing security configuration across multiple manageable levels rather than requiring centralized control of every individual resource.
Solution Approach 2:
The patent introduces a hierarchical dimension to access control by organizing resources into collections and defining access control lists at multiple levels of the hierarchy. This dimensional approach allows security policies to be inherited and composed across levels, transforming the flat, resource-by-resource security model into a multi-layered structure that reduces administrative overhead while maintaining comprehensive security control.
2Reliability
If existing security models are used to control access to resources on networked computers, then resource-level security can be implemented, but processing and hardware resources are consumed inefficiently
Solution Approach 1:
The patent performs preliminary action by pre-computing and caching access decisions in the hierarchical access control structure. Access control lists are defined and organized in advance at collection levels, allowing the system to quickly resolve access requests by traversing the pre-established hierarchy rather than evaluating all security rules at runtime. This preliminary structuring of security policies significantly reduces processing resource consumption during actual access operations.
Solution Approach 2:
The patent implements nesting by organizing access control lists within a hierarchical structure where collection-level ACLs contain and supplement resource-level ACLs. This nested arrangement allows the system to evaluate access requests by traversing from the resource level upward through containing collections, enabling efficient processing by stopping at the first level where matching access rules are found, rather than checking every possible security rule.
3Adaptability or versatility
If resources are organized within a hierarchy of collections with inheritance of access abilities, then scalability is enhanced and administrative burden is reduced, but the access control system becomes more complex
Solution Approach 1:
The patent applies universality by designing the hierarchical access control structure to serve multiple functions simultaneously. The same hierarchical framework enables both security policy inheritance and efficient access decision-making. Collection-level access control lists serve as templates that automatically apply to contained resources, while also providing a structured method for resolving access requests. This multi-functional design enhances scalability without proportionally increasing complexity.
4Reliability
If iterative attribute comparison is performed across hierarchy of access control lists, then access decisions can be made based on multiple request attributes, but processing time increases
Solution Approach 1:
The patent performs preliminary action by pre-organizing access control attributes in the hierarchical structure and caching relevant access control list data. Before processing access requests, the system prepares the hierarchical ACL structure with all necessary attributes and relationships established. During runtime, this pre-prepared structure enables rapid attribute comparison by traversing only the necessary portions of the hierarchy rather than performing exhaustive searches, thus maintaining high access control accuracy while reducing processing time.
Solution Approach 2:
The patent segments the attribute comparison process by dividing it into hierarchical levels. Instead of comparing all attributes against all resources simultaneously, the system compares request attributes against access control lists at each level of the hierarchy in sequence. This segmentation allows the comparison process to be interrupted at any level where a matching rule is found, reducing the total time required while maintaining accurate multi-attribute evaluation.
Data Source
AI summary
Methods, apparatuses, and computer program products are provided for controlling access to a resource. A method may include determining one or more request attributes associated with a request for access to the resource. The method may further include accessing an access control list associated with the resource. The access control list may include one or more access control attributes associated with the resource. The method may additionally include determining a permission defining one or more access abilities for the resource at least in part by comparing the request attributes to the access control attributes and, for any access control attribute corresponding to a request attribute, including an ability associated with the corresponding access control attribute in the permission. The method may also include determining whether to grant the request based at least in part on the determined permission. Corresponding apparatuses and computer program products are also provided.