Network Access Control via Centralized User Data Store
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing access control for large numbers of users in computer networks is complex and poses security risks due to the storage of potentially unused user accounts and increased IT resources required for password resets, especially in large organizations where users access resources infrequently.
Innovation Solution
A system where user data is stored in a consolidated master user database, with local user databases only containing details of actively accessing users, using a provisioning module to generate and communicate temporary passwords and update provisioning status, reducing the need for direct provisioning of end-points and minimizing storage of inactive accounts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user details are distributed to all end-points in the network, then access control can be enforced at each endpoint, but the system becomes complex and unwieldy to manage when the number of users is large
Solution Approach 1:
The patent introduces a master user data store as an intermediary between the distributed end-points and the user authorization data. Instead of each end-point maintaining full user details, the master user data store centralizes user authorization information and provides it to end-points on demand. This resolves the contradiction by maintaining access control enforcement while reducing system management complexity through centralized data management.
Solution Approach 2:
The patent merges the distributed user data storage across multiple end-points into a single centralized master user data store. This consolidation eliminates the complexity of managing and synchronizing user data across numerous distributed locations, while still enabling access control at each end-point through queries to the centralized store.
2Speed
If all user accounts are stored in local databases at each end-point, then access decisions can be made locally, but hardware and maintenance costs increase due to storing potentially unused user accounts
Solution Approach 1:
The patent extracts the bulk user data storage function from local end-point databases and relocates it to a centralized master user data store. Local databases retain only essential access control logic and temporarily cached user data for actively accessing users, dramatically reducing storage requirements while maintaining local access decision capability through efficient data retrieval from the master store.
Solution Approach 2:
The patent segments the user data storage function into two parts: a centralized master user data store that holds all user authorization information, and local end-point databases that hold only minimal operational data for actively accessing users. This segmentation reduces local storage requirements while preserving access control functionality.
3Reliability
If complete user data is provisioned to all end-points, then access control is robust, but IT resources are consumed for password resets and maintenance of inactive accounts
Solution Approach 1:
The patent implements preliminary provisioning where user data is not pre-loaded into all local databases, but is instead made available in the master user data store before needed. When a user needs to access a resource, their data is retrieved from the master store and provisioned to the relevant end-point temporarily. This eliminates the need to maintain inactive user accounts locally, reducing IT resource consumption for password resets and maintenance while preserving access control robustness.
Data Source
AI summary
According to one aspect, there is provided a method of controlling access to a network resource. The method comprises receiving a request to grant a user access to the network resource, the request including a user identifier, determining whether the received user identifier is stored in a local user data store associated with the resource, and where it is not so determined determining, from user details stored in a master user data store, whether the user is authorized to access the resource, and where it is so determined obtaining a password, and storing the obtained password and user details in the local data store associated with the network resource.