Hierarchical Security Domain Model for Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security protocols require users to be re-authenticated and re-authorized every time they access a security level lower than their granted access, leading to inefficiencies in accessing multiple resources within a computer system.
Innovation Solution
Implementing a hierarchy of security domains where users are tagged upon initial authentication and authorization, allowing access to related lower security levels without re-authentication, while requiring re-authentication for higher security levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users are required to be re-authenticated and re-authorized for every access attempt to lower security levels, then security control is maintained, but user access efficiency deteriorates
Solution Approach 1:
The patent segments the security domain into multiple hierarchical levels (first security level, second security level, etc.) with defined relationships between them. This segmentation allows the system to differentiate between upward and downward access transitions, applying different authentication requirements to each direction, thereby resolving the contradiction between maintaining security control and improving access efficiency.
Solution Approach 2:
The patent implements preliminary authentication and authorization at higher security levels, storing the user's security credentials and authorized levels in advance. When a user attempts to access lower security levels, the system retrieves and validates these pre-established credentials, eliminating the need for repeated authentication while maintaining security oversight, thus improving access efficiency without compromising security control.
2Reliability
If re-authentication is required for every access attempt, then security is maintained, but system complexity increases
Solution Approach 1:
The patent divides the authentication process into segments based on security level transitions. Authentication is performed selectively only when transitioning to higher security levels or when explicitly required, rather than uniformly for all access attempts. This segmented approach reduces the overall complexity of the authentication process while maintaining appropriate security controls.
Solution Approach 2:
The patent implements a dynamic authentication requirement system where the need for re-authentication is determined by the direction of security level transition and system-defined policies. The authentication process adapts dynamically based on the user's current security level, the target security level, and pre-configured security policies, reducing unnecessary authentication steps and simplifying the overall process.
3Productivity
If hierarchical security domains are implemented with selective re-authentication, then access efficiency improves, but security protocol complexity increases
Solution Approach 1:
The patent segments the security protocol into distinct rules for upward transitions (requiring re-authentication) and downward transitions (allowing access based on prior authentication). This clear segmentation of security rules, while adding hierarchical structure, organizes the protocol in a manageable way that balances improved access efficiency with controlled protocol complexity.
Solution Approach 2:
The patent creates a universal hierarchical security framework that can be applied across multiple security levels and domains within the system. This multi-functional security protocol structure, once established, serves all access requests uniformly based on the hierarchical relationships, reducing the need for separate authentication mechanisms for each security level and thereby managing protocol complexity while improving overall access efficiency.
Data Source
AI summary
According to one aspect of the invention, a hierarchy of security domains and a method for granting a user access to the security domains are provided. The hierarchy of security domains includes multiple security levels and relationships between particular security domains. When a user is authenticated and/or authorized for access to a first security domain, the user is tagged as having been granted access to that security domain. If the user attempts to access a related security domain with a lower security level, the user is granted access without having to be re-authenticated and/or re-authorized. If the user attempts to access a related security domain with a higher security level, the user must be re-authenticated and/or re-authorized be access is granted to the security domain with the higher security level.