Hierarchy-Aware RBAC Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Role-Based Access Control (RBAC) systems face inefficiencies and security challenges due to the need for manual administration of user access rights, high storage and computing requirements, and limited granularity, especially in large organizations with complex structures and frequent role changes.
Innovation Solution
Implementing a hierarchy-aware resource-level RBAC system that uses a three-column table to assign operations and resources to roles, allowing administrators to grant access based on a hierarchy of resources and users, reducing the number of entries needed and enhancing security by tightly controlling access rights.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional RBAC systems manually assign access rights to each user, then security control is achieved, but administrative burden increases significantly
Solution Approach 1:
The patent segments the access control system into three distinct layers: roles (user categories), resources (data objects), and operations (actions). This segmentation allows administrators to manage access rights at the role level rather than individually for each user, significantly reducing administrative burden while maintaining security control.
Solution Approach 2:
The patent implements universal role definitions that can be assigned to multiple users simultaneously. A single role definition serves as a template that automatically applies to all users assigned to that role, enabling one administrator action to configure access rights for numerous users at once, thereby reducing time loss.
2Manufacturing precision
If RBAC systems store detailed access rights for each user-role-resource combination, then fine-grained control is achieved, but storage requirements increase
Solution Approach 1:
The patent merges the definition of access rights from individual user entries into centralized role definitions. Instead of storing separate access right records for each user, the system stores one access right definition per role, which is then reused across multiple users. This merging dramatically reduces storage requirements while preserving fine-grained control capabilities.
Solution Approach 2:
The patent uses role definitions as templates that are copied and applied to multiple users. When a user is assigned to a role, the system copies the role's access right definitions to that user rather than storing unique definitions for each user. This copying mechanism maintains granularity while minimizing storage requirements.
3Measurement precision
If RBAC systems maintain comprehensive user-role-resource mappings, then access control precision is improved, but computing requirements increase
Solution Approach 1:
The patent segments the access control decision process into two simple steps: first, determine the user's role(s); second, retrieve the pre-defined access rights for that role. This segmentation avoids the need for complex real-time computations to evaluate user-role-resource mappings, reducing computing requirements while maintaining access control precision.
Solution Approach 2:
The patent performs preliminary action by pre-defining and storing access rights at the role level before they are needed for access decisions. This preliminary configuration eliminates the need for complex runtime computations to determine access rights, as the system simply retrieves pre-computed role definitions during access control operations.
4Reliability
If administrators configure access rights for each individual user, then security is maintained, but ease of operation deteriorates
Solution Approach 1:
The patent implements universal role definitions that serve multiple users simultaneously. Administrators configure access rights once at the role level, and this configuration automatically applies to all users assigned to that role. This universal approach maintains security while dramatically improving ease of operation by eliminating repetitive configuration tasks.
Solution Approach 2:
The patent enables self-service through automatic role-based permission assignment. When users are assigned to roles, the system automatically applies the appropriate access rights without requiring manual configuration for each user. This automation improves ease of administration while maintaining security through consistent role-based enforcement.
Data Source
AI summary
A method, apparatus, and system are described herein, in which system resources and operations are assigned to roles in a role-based access control system, and the roles are assigned to a plurality of users. An RBAC system is used to resolve the client request to perform an operation on a resource, the RBAC system using a hierarchy of the plurality of resources to determine if a user is permitted to perform the operation on a parent of the resource in the hierarchy of resources. The RBAC system also determines if a user is permitted to perform the operation on the resource if a user group to which the user belongs to has the required access.