LLM-Tailored RBAC Roles for Fine-Grained Access Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current RBAC systems face challenges in achieving the right balance between security and access, leading to poorly defined roles with excessive or overlapping privileges, which can increase security risks and make it difficult to detect fraudulent activity.
Innovation Solution
An access profile maintenance system (APMS) uses a large language model (LLM) to create tailored access profiles with fine-grained access rights by extracting access requirements from role descriptions, searching for similar profiles, and allowing user feedback to refine the proposals.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If roles are created with broad access rights to ensure users can perform their tasks, then ease of operation is improved, but security is worsened due to excessive privileges
Solution Approach 1:
The patent segments access rights into fine-grained permissions at the resource level rather than using broad role-based access. Each resource (document, folder, application) has individual access control lists that can be independently configured, allowing precise control over what specific users can access and do, thereby reducing excessive privileges while maintaining operational capability.
Solution Approach 2:
The patent implements local quality by allowing different access control policies to be applied to different resources based on their specific characteristics and security requirements. Instead of applying uniform access rules to all resources, the system tailors access control to each resource's needs, enabling fine-grained security without compromising user productivity.
2Productivity
If administrators approve access requests quickly to improve productivity, then productivity is improved, but measurement precision of access needs deteriorates
Solution Approach 1:
The patent performs preliminary action by automatically analyzing job descriptions, organizational charts, and existing access patterns before access requests are submitted. The system pre-determines appropriate access levels based on pre-configured policies and historical data, so that when access requests are approved, the decisions are based on comprehensive analysis rather than rushed approvals, maintaining both speed and accuracy.
Solution Approach 2:
The patent implements self-service by enabling the access control system to automatically make informed decisions about access rights based on pre-established policies and analytical algorithms. The system autonomously evaluates access requests against organizational needs and security requirements, reducing the need for administrator intervention while maintaining high measurement precision through automated analysis.
3Ease of manufacture
If predetermined role templates are used to simplify role creation, then ease of manufacture is improved, but manufacturing precision of access definitions deteriorates
Solution Approach 1:
The patent implements universality by creating a flexible access control framework that can accommodate both standardized role templates and customized access requirements. The system provides universal access control lists that can be applied across different resources while allowing specific customization for each resource's unique needs, enabling administrators to balance standardization with precision through a unified approach.
Data Source
AI summary
Disclosed herein are system, method, and computer program product embodiments for creating a tailored access profile for improving the security of an access control system. An embodiment operates by extracting application access requirements for a role from a role description using a first large language model. The embodiment then generates an embedding corresponding to the application access requirements using a second large language model. The embodiment then searches for a first access profile in a data store based on the embedding. The embodiment then generates a second access profile based on the application access requirements using the first large language model. The embodiment then selects the first access profile or the second access profile based on the application access requirements. The embodiment finally tailors the selected access profile based on feedback, thereby creating the tailored access profile.