Identity Context Access Control Reduces Role Proliferation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Role-based access control (RBAC) systems become unwieldy and expensive as the number of users and applications grow, leading to role proliferation and increased management difficulties, as not all user groups can be translated into roles and defining roles based on attributes like location is not logical.
Innovation Solution
An identity context-based access control approach is introduced, where identity data is used to generate identity context expressions that are used in conjunction with RBAC to define access control policies, reducing the number of roles by replacing them with unique identity contexts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If role-based access control is used to manage access as users and applications grow, then security control is improved, but system complexity and management overhead increase
Solution Approach 1:
The patent segments the monolithic role concept into two distinct components: roles (representing job functions) and identity contexts (representing attribute-based user groups). This segmentation allows the system to maintain role-based security while adding attribute-based flexibility, thereby improving security control without proportionally increasing system complexity.
Solution Approach 2:
The patent introduces a new dimension to access control by adding identity contexts as a separate layer alongside traditional roles. This dimensional addition enables attribute-based grouping (such as location, department, or device type) without requiring creation of numerous specialized roles, thus enhancing security granularity while controlling complexity growth.
2Manufacturing precision
If more roles are created to cover all use cases, then access control precision is improved, but role proliferation increases management overhead
Solution Approach 1:
The patent makes identity contexts universal containers that can represent any attribute-based grouping (location, department, device type, etc.). Instead of creating separate roles for each attribute combination, a single identity context can universally represent any user group defined by attributes, achieving precise access control without role proliferation.
Solution Approach 2:
The patent changes the parameters used to define user groups from role names to attribute values. By parameterizing user groups based on configurable attributes rather than fixed role definitions, the system achieves precise access control for diverse scenarios without requiring manual creation and management of numerous specific roles.
3Adaptability or versatility
If roles are defined based on attributes like location, then access control flexibility is improved, but role logic becomes unclear and management becomes difficult
Solution Approach 1:
The patent extracts the attribute-based grouping logic from the role concept and places it in identity contexts. This extraction allows roles to maintain their clear job-function meaning while identity contexts handle the flexible attribute-based grouping, separating concerns and improving both flexibility and manageability.
Solution Approach 2:
The patent introduces identity contexts as an intermediary layer between users and roles. This intermediary enables flexible attribute-based access control without directly complicating role definitions, as the identity context acts as a mediator that translates attribute criteria into access decisions while preserving role semantics.
Data Source
AI summary
Identity context-based access control is implemented by generating an identity context expression from user identity data. In particular, users are clustered based on combinations of one or more attributes. These clusters comprise one or more identity context(s). Preferably, an intersection of attribute sets of each user in the cluster is formed. In addition, an intersection of attribute sets of each user not in the cluster also is formed. If the attribute set that is common across the cluster of users is not a subset of the attribute set that is common across the rest of the users, then the attribute set forms a unique identity context expression. To reduce the number of roles used in role-based access control (RBAC), at least one role is replaced with an identity context expression. Run-time access control is then enabled.