NGAC Graph Model Segmentation for Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access control models, such as ABAC and RBAC, face challenges in managing complex access policies and identifying user roles, leading to exponential role expansion and a lack of insight into why access is granted or denied, while Next Generation Access Control (NGAC) lacks implementation details and guidance for modeling multiple policy classes.
Innovation Solution
The NGAC graph model is implemented with a bifurcated structure, using user and object elements, policy binding nodes, and a composable policy class structure to evaluate access control decisions efficiently, allowing for the determination of access permissions and the traversal of policy paths, and providing explanations for access decisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If RBAC model is used to manage access control policies, then ease of understanding and policy authoring is improved, but device complexity increases due to exponential role expansion
Solution Approach 1:
The patent segments the access control model into two distinct graphs: a role hierarchy graph that captures role relationships, and an entity-attribute graph that models users, objects, and their attributes. This segmentation prevents exponential role expansion by separating role management from access decision-making, allowing linear scaling instead of exponential growth.
2Adaptability or versatility
If ABAC model is used to develop access control policies, then adaptability and flexibility are improved, but device complexity increases due to complex Boolean rule sets
Solution Approach 1:
The patent introduces an intermediary layer consisting of the entity-attribute graph and graph traversal algorithms that mediate between simple access requests and complex policy evaluation. Instead of directly evaluating complex Boolean rules, the system uses graph traversal to determine access, simplifying the decision process while maintaining ABAC's adaptability.
3Productivity
If traditional access control models are used, then access control decisions can be made, but loss of information occurs regarding why access is granted or denied
Solution Approach 1:
The patent implements feedback by capturing the traversal path during graph evaluation and using it to generate explanatory information about why access decisions are made. The system records which roles and attributes contributed to the decision, providing transparent feedback that explains access outcomes without slowing down the decision process.
4Adaptability or versatility
If NGAC specification is used for access control, then adaptability for different policy types is improved, but device complexity increases due to lack of implementation guidance
Solution Approach 1:
The patent applies parameter changes by representing access control policies as configurable graph parameters such as node types, edge relationships, and traversal rules. This allows the system to adapt to different policy types by modifying graph parameters rather than restructuring the entire system, reducing implementation complexity while maintaining NGAC's adaptability.
Data Source
AI summary
In implementations of NGAC graph evaluations, a computing device implements a next generation access control (NGAC) graph that includes user elements representing users, object elements representing resources, and multiple policy classes. Policy binding nodes can be modeled as user attributes in the NGAC graph for each of the multiple policy classes, and each policy binding node is assigned to a corresponding one of the multiple policy classes. A user element is assigned as a member of a policy binding node, and the policy binding node delineates at least one policy permission on an object element and grants the policy permission on the object element to the user element. The computing device implements a policy decision module to evaluate the NGAC graph with a graph evaluation procedure to determine graph analysis information relative to at least one of the user element, the granted policy permission, or the object element.