Network Permission Verification via Assertion Tree Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional file systems face inefficiencies and security vulnerabilities due to redundant and inconsistent handling of user access permissions, particularly when dealing with resources that have dependencies, leading to computational resource waste and difficulty in identifying unintended permission changes.
Innovation Solution
A method and system for verifying network-based permissioning rights using assertion statements applied to a network database, which determines the validity of user operations on data resources by comparing an assertion tree representing expected permissions with a hierarchical resource graph from the access control list, generating error messages and remedial actions as needed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If permission information is maintained along with each resource in conventional file systems, then each application can independently evaluate user access permissions, but this leads to painstaking redundancies in development and inconsistent handling of user access permissions across applications
Solution Approach 1:
The patent merges permission evaluation functionality into a centralized network-based permissioning system that all applications share. Instead of each application independently maintaining and evaluating permission information, the system consolidates these functions into a single network service that provides unified permission evaluation across all applications, eliminating redundancies while maintaining independent evaluation capability.
2Measurement precision
If the evaluator traverses the entire tree of dependencies to determine user access permission for resources with dependencies, then the correct determination can be reached, but computational resources are inefficiently used and system performance degrades
Solution Approach 1:
The patent implements preliminary action by pre-computing and caching permission evaluation results in a network database. When a user's permission for a resource is requested, the system checks the cached results first, avoiding the need to traverse the entire dependency tree unless the cached information is stale or invalid. This significantly reduces computational overhead while maintaining accurate permission determination.
Solution Approach 2:
The system changes the parameter of permission evaluation from a static, on-demand traversal approach to a dynamic, cached approach where results are pre-computed and stored. The system monitors changes in the dependency tree and invalidates caches selectively, changing the evaluation parameter from 'traverse entire tree' to 'check cache first, traverse only when necessary'.
3Reliability
If permission information is distributed across multiple resources and dependencies, then comprehensive access control can be implemented, but it becomes difficult to identify unintended permission changes without significant expertise and processing resources
Solution Approach 1:
The patent implements feedback mechanisms that automatically monitor and report permission changes in the network-based permissioning system. When permission information is modified, the system provides feedback by updating the network database and notifying relevant applications. This automated feedback loop makes it easy to detect unintended permission changes without requiring manual traversal or expert analysis of the distributed permission information.
Solution Approach 2:
The network-based permissioning system acts as an intermediary between the distributed resources and the applications that need to access them. This intermediary centralizes the permission information and provides a unified interface for detecting and managing permission changes, eliminating the need for applications to directly navigate the complex distributed permission structure.
Data Source
AI summary
Methods, systems and computer programs for verifying permissioning rights to one or more data resources associated with a data processing platform (DPP) are disclosed. An exemplary method comprises receiving an assertion statement identifying a user, a data resource and an operation performable with respect to the data resource; in response to receiving the assertion statement, generating a hierarchical representation of an access control list for the data resource identified in the statement and evaluating the hierarchical representation against a current state of permissions to determine if the received assertion statement is true or false in relation to said data resource identified in the assertion statement; in response to determining that the assertion is false, generating an error message for output.