Hierarchical Access Control With Precomputed Inherited Rights

Solution Overview

Problem

Existing access control mechanisms in IT systems are inefficient and resource-intensive due to the time-consuming computation required to determine access rights from complex hierarchical frameworks, particularly when propagating rights across multiple levels.

Innovation Solution

Implement a normalized access control database and a denormalized access control database to store and manage access rights, using a computation module to pre-compute and store inherited rights at lower levels, allowing efficient access checks by querying a flattened representation at access request time.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If access rights are propagated from higher hierarchy levels to lower levels during each access request, then access control accuracy is maintained, but computation time and resource usage increase significantly

Engineering Contradiction:

Improveaccess control accuracyVSAvoidcomputation time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system pre-computes and stores the flattened access rights representation in the denormalized database during updates, so that when access requests are processed, the pre-computed data can be queried directly without performing time-consuming propagation computations at access time

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system separates the access control data into normalized database (storing hierarchical structure) and denormalized database (storing flattened representation), allowing each to serve different purposes: the normalized database maintains structural integrity while the denormalized database enables fast access checks

Inventive Principle:

Principle #1Segmentation

2Reliability

If access rights are propagated from higher hierarchy levels to lower levels during each access request, then access control accuracy is maintained, but computing resources are consumed excessively

Engineering Contradiction:

Improveaccess control accuracyVSAvoidcomputing resources

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system pre-computes and stores the flattened access rights representation in the denormalized database during updates, so that when access requests are processed, the pre-computed data can be queried directly without performing time-consuming propagation computations at access time

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system separates the access control data into normalized database (storing hierarchical structure) and denormalized database (storing flattened representation), allowing each to serve different purposes: the normalized database maintains structural integrity while the denormalized database enables fast access checks

Inventive Principle:

Principle #1Segmentation

3Stability of the object's composition

If a normalized access control database is used to store hierarchical access rights, then data structure integrity is maintained, but access check speed decreases due to complex propagation requirements

Engineering Contradiction:

Improvedata structure integrityVSAvoidaccess check speed

Core Design Contradiction:

Stability of the object's compositionVSSpeed

Solution Approach 1:

The system separates the access control data into normalized database (storing hierarchical structure) and denormalized database (storing flattened representation), allowing each to serve different purposes: the normalized database maintains structural integrity while the denormalized database enables fast access checks

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system pre-computes and stores the flattened access rights representation in the denormalized database during updates, so that when access requests are processed, the pre-computed data can be queried directly without performing time-consuming propagation computations at access time

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12463977B2Access control management

Publication Date: 2025.11.04 AMADEUS SAS

AI summary

Access control is performed in an information technology system comprising a normalized access control database and a denormalized access control database. In response to an update request from a client to change the access rights of a higher hierarchy level entity, the access rights of the higher hierarchy level entity are updated in the normalized database. Furthermore, updated access control rights for one or more corresponding lower hierarchy level entities related to the higher hierarchy level entity are computed and stored in a denormalized database. An access request from one of the one or more lower hierarchy level entities is served on the basis of the updated access rights at the lower hierarchy level stored in the denormalized database.