Hybrid Role-Based Access Control for Hierarchical Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems, including role-based and discretionary systems, fail to effectively enforce responsibility and ensure security procedures are followed, as they allow administrators to grant inappropriate access to resources without proper hierarchical verification.
Innovation Solution
A hybrid access control system that combines discretionary access control with role-based rights, implementing dual tests to verify the administrator's authority and role permissions, ensuring that only the owner of a user group can modify user roles and access resources based on their assigned roles, preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If role-based access control is used to simplify access management, then ease of operation is improved, but security control is worsened because any administrator can assign any user role to any user without hierarchical verification
Solution Approach 1:
The system segments administrator authority by user group ownership, dividing the monolithic admin role into specialized roles with specific scopes. Each administrator is assigned authority over specific user groups they own, preventing unauthorized role assignments while maintaining efficient role-based access control within those boundaries.
Solution Approach 2:
The system introduces an intermediary verification mechanism that checks whether an administrator owns the user group before allowing role modification. This intermediary layer prevents direct unauthorized assignments while preserving the efficiency of role-based control for authorized administrators.
2Reliability
If discretionary access control is used to enable exclusive resource control, then security control is improved, but ease of operation is worsened because administrators cannot efficiently manage multiple users and roles
Solution Approach 1:
The system merges discretionary access control's security verification with role-based access control's efficiency. By combining these approaches, administrators retain exclusive control over their user groups while efficiently managing multiple users through predefined roles, avoiding the need to evaluate each user's access to every resource individually.
Solution Approach 2:
The system creates multi-functional user roles that can grant access to multiple resources simultaneously. A single role assignment provides universal access control for authorized users across various resources, eliminating the need for administrators to individually configure access permissions for each resource while maintaining security through role-based constraints.
3Adaptability or versatility
If administrators can assign any user role to any user, then adaptability is improved, but harmful factors increase because inappropriate access may be granted to users outside the administrator's hierarchical scope
Solution Approach 1:
The system applies local quality by making administrator authority specific to particular user groups they own. Each administrator has customized control capabilities within their designated scope, allowing flexible role assignments for their own users while automatically preventing inappropriate assignments to users outside their hierarchical scope through ownership verification.
Data Source
AI summary
A method for access control is provided. A request is received from an administrator to modify a user role for a user. Whether the user is in a user group that belongs exclusively to the administrator is determined. Whether the administrator role permits the request is determined in response to a determination that the user is in the user group. The user role is modified based on the request in response to a determination that the administrator role permits the request, wherein the user accesses a resource based on the user role.