Implicit Access Policy Linking via Group Name Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network administrators face challenges in linking user access policies across different directory services and network resources, as existing methods require manual selection and mapping of user groups to policy groups, which is cumbersome and prone to errors due to variations in naming conventions and policies across different vendors.
Innovation Solution
The system automatically links policy groups to user groups based on matching names and unique identifiers, allowing for implicit linking and ensuring correct access permissions across multiple directory services, even when groups have the same name but belong to different domains, and prioritizes access permissions based on category priority.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual selection and mapping of user groups to policy groups is used, then access permissions can be controlled, but the process becomes cumbersome and prone to errors
Solution Approach 1:
The system performs automatic linking of policy groups to user groups by matching names and unique identifiers without requiring administrator intervention. The access control server autonomously queries directory services, compares group attributes, and establishes linkages based on naming conventions and uniqueness criteria, eliminating manual mapping operations
Solution Approach 2:
The access control server acts as an intermediary between directory services and network resources. It queries directory services for user group information, matches groups with policy groups based on names and unique identifiers, and applies the appropriate access permissions, thereby mediating the complex linking process
2Ease of operation
If automatic linking based on matching names is implemented, then administrative burden is reduced, but errors may occur when groups have the same name in different domains
Solution Approach 1:
The system segments the group identification process into multiple attributes: display name, unique identifier, and domain. Instead of relying solely on name matching, the access control server queries directory services using both the display name and unique identifier, and verifies domain context, thereby segmenting the identification criteria to avoid false matches
Solution Approach 2:
The system applies different matching criteria based on the context. When multiple groups share the same display name, the system uses the unique identifier and domain-specific attributes to differentiate them. Each group is evaluated with locally-appropriate attributes (domain context, unique ID) rather than a single global criterion
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for implicitly linking access policies using group names. One of the methods includes receiving first information corresponding to a directory service of network users, the directory service configured to organize the network users into a plurality of user roles, receiving second information corresponding to a resource available to the network users, the resource having a plurality of policy groups, identifying at least one first user role name that matches at least one first policy group name, and linking the user role corresponding to the matched first user role name with the policy group corresponding to the matched first policy group name such that the one or more network users in the linked user role are subject to the usage policies associated with the linked policy group.