Network Manager Segmentation for Resource Group Administration

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Resource group administrators with 'resource group level permissions' are unable to add managed objects or edit configuration settings without 'global permissions,' leading to inconvenience and security risks, as they cannot access or modify network resources outside their group without global administrator intervention.

Innovation Solution

A network manager system that allows resource group administrators to add global objects as managed objects and edit configuration settings within their resource group without requiring global permissions, by authenticating and matching resource group level permissions with stored permissions on network resources, enabling direct access and modification.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If resource group administrators are given resource group level permissions only, then security is improved by limiting access scope, but ease of operation deteriorates because they cannot add managed objects or edit configuration settings without global administrator intervention

Engineering Contradiction:

ImprovesecurityVSAvoidease of operation

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent segments the administration authority by introducing resource group level permissions that are distinct from global permissions. Resource group administrators receive permissions scoped to specific resource groups rather than universal access, enabling segmented control that improves security while allowing independent operation within their designated scope.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements local quality by providing resource group administrators with permissions tailored to their specific resource groups. Each resource group administrator receives customized access rights aligned with their organizational role, allowing them to perform operations independently within their local scope without requiring global administrator intervention.

Inventive Principle:

Principle #3Local quality

2Ease of operation

If global administrators provide broad access permissions to all network resources, then ease of operation is improved for resource group administrators, but security deteriorates due to increased attack surface and misuse risk

Engineering Contradiction:

Improveease of operationVSAvoidsecurity

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent segments administration authority by introducing resource group level permissions that are distinct from global permissions. Resource group administrators receive permissions scoped to specific resource groups rather than universal access, enabling segmented control that improves security while allowing independent operation within their designated scope.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Inventive Principle:

Principle #3Local quality

3Productivity

If resource group administrators can add managed objects to their resource group, then productivity is improved by enabling independent management, but device complexity increases due to additional permission verification mechanisms

Engineering Contradiction:

ImproveproductivityVSAvoiddevice complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by pre-configuring resource group administrators with appropriate permissions during system initialization. The network manager automatically establishes the necessary permission frameworks and resource group structures before administrators need to perform operations, enabling independent management without requiring complex real-time permission configuration.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements feedback mechanisms where the network manager continuously monitors and verifies permission validity when resource group administrators attempt to add managed objects. The system provides automatic feedback by validating permissions against stored permission data and network resource information, allowing independent operations while maintaining security through automated verification.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS8346952B2De-centralization of group administration authority within a network storage architecture

Publication Date: 2013.01.01 NETAPP INC

AI summary

An embodiment of a network manager permits a resource group administrator (with resource group level permissions but without global permissions) to add a global object to his/her resource group as a managed object, without requiring the administrator to have a global permission, as discussed further below. An embodiment of the network manager permits a resource group administrator to also edit the configuration settings that are attached to his/her resource group without requiring the administrator to have a global permission.