Identity Governance Delegation for Fine-Grained Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Complex computer networks face challenges in managing identities and access, particularly in enforcing access policies and monitoring compliance, especially when organization structures change, leading to increased security risks due to manual processes and limitations in existing identity and access management systems.
Innovation Solution
An identity governance and administration system that uses a business relationship model to assign identities and access entitlements, allowing for decentralized management and secure delegation of authority, supporting multiple identity providers and legacy repositories, and enabling fine-grained entitlements without multiple identities or shared credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual processes are used for identity and access management, then ease of operation is maintained, but security and compliance are compromised
Solution Approach 1:
The system enables self-service provisioning where users can request and receive access entitlements automatically without manual IT intervention. The identity governance system automates the entire provisioning process, including policy evaluation, entitlement assignment, and resource configuration, thereby maintaining security while improving operational ease.
Solution Approach 2:
Manual mechanical processes for identity management are replaced with automated electronic systems. The identity governance system uses software-based policies, automated workflows, and integration with resource systems to eliminate manual provisioning tasks, ensuring consistent security enforcement while reducing operational complexity.
2Reliability
If centralized identity management is implemented, then security and compliance are improved, but device complexity increases
Solution Approach 1:
The centralized identity management function is segmented into modular components: identity governance system, policy evaluation engine, provisioning workflow manager, and resource integrations layer. This segmentation allows compliance to be maintained at the centralized level while reducing complexity at individual implementation points through standardized interfaces and abstracted policies.
Solution Approach 2:
The identity governance system acts as an intermediary layer between centralized policy decisions and distributed resource systems. It mediates between security requirements and operational complexity by providing standardized provisioning workflows, automated policy enforcement, and simplified resource integration points that reduce overall system complexity.
3Reliability
If access policies are strictly enforced, then security is improved, but adaptability to organizational changes deteriorates
Solution Approach 1:
The access control system implements dynamic policies that automatically adapt to organizational changes. When users join, leave, or change roles, the system dynamically evaluates current policies and provisions appropriate entitlements in real-time. This dynamic approach maintains security through continuous policy enforcement while adapting quickly to changing organizational needs without manual reconfiguration.
Solution Approach 2:
The system performs preliminary actions by pre-defining access policies, entitlements, and provisioning workflows before organizational changes occur. When changes happen, pre-configured policies are automatically applied, enabling rapid adaptation while maintaining security. Templates and predefined access models allow quick deployment of new access configurations without creating security vulnerabilities.
4Adaptability or versatility
If multiple identities are used for different access levels, then adaptability is improved, but device complexity increases
Solution Approach 1:
Multiple access levels and entitlements are merged into a unified identity framework. The system uses a single user identity that can be assigned multiple entitlements and access levels dynamically, eliminating the need for separate identities for different access levels. This merging reduces complexity while maintaining adaptability through flexible entitlement management.
Solution Approach 2:
Instead of creating multiple identities (horizontal dimension), the system adds multiple access levels as a separate dimension through entitlements. A single identity can have multiple entitlements assigned, creating a two-dimensional access control model (user × entitlement) that reduces complexity while maintaining fine-grained adaptability for different access levels.
Data Source
AI summary
In an identity governance system, processes enable secure delegation of authority to create and manage identities for users of a computer network and to provision access entitlements to users to network resources in a manner that ensures compliance with security and access policies. The provisioning of access entitlements to users is controlled based on a model of relationships between business entities that the computer network serves. Identities of users are assigned to a node of the model. Provisioning of entitlements for coarse and fine-grain access is restricted based on this assignment. The node of the business relationship model limits the scope of what user access entitlements can be assigned, to whom they may be assigned, and who may assign them.