Network Permission Evaluation Delegation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access control systems are inefficient and difficult to manage, particularly in large-scale environments, as they lead to performance slowdowns and complex rule evaluations on client machines, making them unsuitable for complex security requirements and leading to unused or disabled security features.
Innovation Solution
Delegating permission evaluation to a network service that compiles and enforces access control rules centrally, allowing client machines to offload security decisions and optimizations, thereby improving performance and manageability by using dedicated resources and caching repetitive evaluations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If complex access control rules are evaluated locally on each client machine, then security policy enforcement is achieved, but client machine performance slows down significantly
Solution Approach 1:
The patent extracts the complex permission evaluation logic from the client machine and relocates it to a dedicated network service. The client machine's security manager sends permission requests to this network service, which performs the actual evaluation of complex security rules and returns the decision. This extraction eliminates the performance burden from client machines while maintaining security enforcement.
Solution Approach 2:
The patent introduces an intermediary network service that acts as a mediator between the client machine and the security policy database. This intermediary handles the complex permission evaluation requests, caches results to avoid repetitive evaluations, and manages the security rules centrally. The intermediary resolves the contradiction by providing a specialized component that handles security evaluation without burdening the general-purpose client machine.
2Reliability
If extensive security processes are performed on the client system, then security evaluation is thorough, but overall system performance decreases
Solution Approach 1:
The patent implements preliminary action by having the network service pre-compile security rules and cache permission evaluation results. When the same permission requests are made, the cached results are returned without re-evaluating the complex security rules. This preliminary preparation work reduces the energy and computational resources required during actual permission checks while maintaining thorough security evaluation.
3Ease of operation
If access control rules are maintained on each client machine, then local security decisions can be made, but rule management becomes difficult as more users and rules are added
Solution Approach 1:
The patent merges the security rule management functionality into a centralized network service that all client machines access. Instead of each client machine maintaining its own copy and version of security rules, there is a single centralized repository. This consolidation simplifies rule management as administrators can update rules in one place, and all clients automatically receive the updated policies, eliminating the complexity of distributed rule synchronization.
4Reliability
If the same permission files and expressions are evaluated repeatedly on the client machine, then accurate security decisions are made, but evaluation efficiency decreases
Solution Approach 1:
The patent implements caching of permission evaluation results at the network service level. When a permission request is evaluated, the result is stored in a cache. Subsequent identical or similar permission requests are served from the cache without re-evaluating the security rules, significantly reducing evaluation time while maintaining accurate security decisions. The cache invalidation mechanism ensures that updated policies are reflected when necessary.
Data Source
AI summary
The invention is a system and method for delegating security permission evaluation from a client computer to remote network service (e.g., a security server). The centralization of permission evaluation allows performance enhancements using rules compilation and better manageability. An application on a client machine may request a permission to access a resource at runtime and provide evidence data to a security server. The permission evaluation (the decision) is executed by the network service and enforced locally on the client machine. When the application runs on top of a virtual machine, its security manager may be used to hide all of the client-side processes, and thus providing the extra information to the network service in order to locally enforce the results.