Negative Groups for Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems face challenges in efficiently managing access to resources across large networks and multi-domain environments, particularly in securely denying access to entities not part of specific groups without exhaustive listing, which can be cumbersome and insecure.
Innovation Solution
The implementation of negative groups and subtraction groups, where negative groups consist of entities not in a base group, and subtraction groups consist of members in one group but not another, with membership statements or certificates used to prove exclusion or inclusion, enhancing security and reducing the need for exhaustive listings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If exhaustive listing of all entities is used to define access control, then access decisions can be made with complete information, but the system becomes cumbersome and insecure especially in large networks
Solution Approach 1:
The patent segments the access control problem by introducing group-based access control entries that divide the exhaustive entity listing into manageable groups. Instead of listing every individual entity, the system creates group representations that can be referenced in access control lists, reducing complexity while maintaining security through hierarchical organization of entities.
Solution Approach 2:
The patent applies inversion by introducing negative groups that represent entities NOT in a base group. This allows the access control system to define access by exclusion rather than inclusion, reversing the traditional approach of listing all authorized entities. This inversion reduces the size of access control lists by representing large sets of denied entities as the complement of a smaller authorized group.
2Adaptability or versatility
If traditional groups are defined as lists of entities, then group membership can be explicitly tracked, but modifying ACLs is required when group membership changes
Solution Approach 1:
The patent implements preliminary action by pre-defining negative groups based on base groups before access control decisions are made. When a base group is defined, the corresponding negative group is automatically established, so that when entities are added or removed from the base group, the negative group automatically reflects these changes without requiring manual ACL modifications. This preliminary setup enables dynamic adaptability.
Solution Approach 2:
The patent introduces dynamics by making group memberships mutable and automatically propagating changes. Group memberships can be added or removed dynamically, and these changes automatically update the negative group definitions and associated access control entries. This dynamic approach eliminates the need for manual ACL reconfiguration when group compositions change.
3Reliability
If all members of a negative group are listed, then complete access denial can be enforced, but the listing becomes unreasonable and inefficient for large numbers of entities
Solution Approach 1:
The patent applies universality by creating negative groups that serve multiple functions simultaneously. A single negative group definition based on a base group can represent and enforce access denial for any number of entities without requiring proportional increases in storage or processing. The negative group acts as a universal construct that adapts to any size of excluded entity set while maintaining constant complexity.
4Productivity
If membership statements are provided only when needed, then efficiency is improved, but the system must query external services or verify certificates
Solution Approach 1:
The patent implements preliminary action by pre-computing and caching negative group memberships and certificate validations. Instead of querying external services or verifying certificates in real-time for every access decision, the system performs these operations in advance and stores the results for rapid retrieval during access control evaluations, improving productivity while managing verification complexity through caching.
Data Source
AI summary
The subject disclosure pertains to systems and methods that facilitate managing groups entities for access control. A negative group is defined using a base group, where the negative group associated with a base group includes any entities not included in the base group. Negative groups can be implemented using certificates rather than explicit lists of negative group members. A certificate can provide evidence of membership in the negative group and can be presented for evaluation to obtain access to resources. Subtraction groups can also be used to manage access to resources. A subtraction group can be defined as the members of a first group, excluding any members of a second group.