Least Common Ancestor Authorization in Directed Acyclic Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Manual maintenance of user authorizations in data processing systems is tedious and error-prone, especially when organizational changes occur, requiring updates to multiple user profiles.
Innovation Solution
Implementing a data processing system that uses a directed acyclic graph to store user assignments and perform authorization checks based on the least common ancestor of user and data object nodes, with pre-computed LCA indices for efficient access control, allowing for parallel processing and reduced latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If manual maintenance of user profiles is used to manage authorizations, then flexibility in individual user authorization is improved, but the time and effort required for updating user profiles increases significantly
Solution Approach 1:
The system segments authorization management into two levels: organizational structure (groups, departments, companies) and individual user profiles. By assigning users to organizational nodes in a directed acyclic graph, the system separates the management of collective authorization patterns from individual user configurations, enabling efficient bulk updates when organizational structure changes while preserving individual authorization flexibility.
Solution Approach 2:
The system pre-computes least common ancestor (LCA) indices for all pairs of nodes in the organizational graph before authorization checks are needed. This preliminary computation stores the results in a cache, so when authorization decisions must be made, the system can quickly retrieve pre-calculated LCA information rather than performing complex graph traversals in real-time, significantly reducing processing time.
2Loss of time
If structural user authorization is implemented to reduce manual updates, then the time for updating user profiles is reduced, but the complexity of the authorization system increases
Solution Approach 1:
The system introduces an intermediary computational layer that translates complex organizational structure relationships into simple authorization decisions. The least common ancestor algorithm acts as this intermediary, converting the complex problem of determining whether a user has access to a resource (which may involve multiple organizational levels) into a straightforward comparison: does the user's organizational node contain the resource's organizational node as a descendant? This intermediary layer handles the complexity internally while presenting a simple interface for authorization checks.
Solution Approach 2:
The system creates a computational copy of the organizational structure in the form of a directed acyclic graph with pre-computed LCA indices. Instead of manually managing individual user authorizations or traversing the actual organizational hierarchy during authorization checks, the system uses this graph copy with pre-calculated relationships to make rapid authorization decisions. The graph copy preserves the organizational structure's authorization logic while enabling efficient querying.
3Reliability
If authorization checks are performed frequently to ensure up-to-date access control, then security is improved, but the processing load on the system increases
Solution Approach 1:
The system performs the computationally intensive least common ancestor calculations in advance and stores the results in a cache. When authorization checks are performed frequently, the system simply retrieves pre-computed LCA information from the cache rather than performing complex graph traversals, dramatically reducing the processing load per authorization check while maintaining accurate, up-to-date authorization decisions.
Data Source
AI summary
Systems, methods, and computer program products are provided for performing an authorization check for a user. In one implementation, a data processing system is provided that includes means for storing first data descriptive of at least one directed acyclic graph and for storing second data descriptive of an assignment of a user to a first node of the graph. The data processing system also includes means for receiving an access request of the user, the access request specifying a second node of the graph. Furthermore, the data processing system includes means for determining a least common ancestor of the first and second nodes of the graph and means for performing an authorization check adapted to grant authorization for the access request if the least common ancestor of the first and second nodes is the first node.