IoT Access Control Policy Inheritance via Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control policies in IoT systems often lead to independent configurations for superior and subordinate resources, making it difficult to manage and enforce access control policies across hierarchical structures, especially in large-scale IoT device management platforms, where inheritance relationships are not effectively handled, resulting in security loopholes and inefficiencies.
Innovation Solution
A method and apparatus for configuring access control policies that determine and set inheritance relationships between target and parent resources based on an access control policy inheritance attribute, allowing for flexible configuration and updating of access control policies according to user-defined or default rules, ensuring that target resources inherit or do not inherit access control policies from their parent resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If access control policies are configured independently for each resource, then each resource can have customized security settings, but the management complexity increases and inheritance relationships are lost
Solution Approach 1:
The access control policy is segmented into two parts: a template part (stored in template access control policy identification attribute) and an instance part (stored in access control policy identification attribute). The template part is inherited from parent resources, while the instance part allows customization for each specific resource. This segmentation enables both inheritance and customization without increasing management complexity.
Solution Approach 2:
The access control policy identification attribute contains nested structures where template access control policy identification attributes are embedded within instance access control policy identification attributes. This nesting allows child resources to inherit from parent templates while maintaining their own customized policies, resolving the contradiction between customization and management complexity.
2Ease of manufacture
If access control policy identification attribute is sent to recipient during resource creation, then the resource can be created with security settings, but the parent resource's policy permission is given up
Solution Approach 1:
The access control policy is segmented into template and instance parts. The template part maintains the parent resource's policy permission and is inherited by child resources, while the instance part allows customization during resource creation. This segmentation ensures that sending access control policy identification attribute during resource creation does not give up the parent resource's policy permission.
Solution Approach 2:
The template access control policy identification attribute acts as an intermediary between the parent resource's policy and the child resource's customized policy. It allows the child resource to be created with security settings while preserving the parent's policy permission through inheritance.
3Adaptability or versatility
If access control policy identification attribute is individually added for a resource, then the resource can have its own policy settings, but the parent resource's policy permission is given up
Solution Approach 1:
The access control policy identification attribute is segmented into template andinstance parts. The template part preserves the parent resource's policy permission, while the instance part provides resource-specific settings. This segmentation allows individual policy settings without giving up parent resource's policy permission.
Solution Approach 2:
The template access control policy identification attribute and instance access control policy identification attribute are merged into a unified access control policy identification attribute. This merging allows the resource to have both inherited parent policy permission and its own customized settings simultaneously.
4Ease of operation
If access control policies are made independent between superior and subordinate resources, then each resource can be managed separately, but security loopholes arise in hierarchical structures
Solution Approach 1:
The access control policy is segmented into template andinstance parts, allowing separate management of each part while maintaining the inheritance relationship. The template part ensures security through inheritance, while theinstance part enables separate management for customization.
Solution Approach 2:
The system automatically updates the access control policy identification attribute of child resources when the template is updated, creating a feedback loop that maintains security consistency across the hierarchical structure while allowing separate management operations.
Data Source
AI summary
The present disclosure relates to a method, apparatus, system and storage medium for access control policy configuration. The method includes receiving a request for creating a target resource; determining, based on the request, whether an access control policy inheritance attribute is set for the target resource, the access control policy inheritance attribute indicating an inheritance relationship between access control policies of the target resource and its parent resource; and configuring the access control policy of the target resource according to a result of the determination. Thus, the efficiency of configuring an access control policy for a resource is improved.