Composable NGAC Policy Classes to Prevent Graph Node Expansion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control models like ABAC and RBAC face challenges in scalability and complexity, with NGAC lacking implementation details for modeling multiple policy classes, leading to exponential node expansion and computational inefficiencies.
Innovation Solution
A repeatable NGAC policy class structure with a composable policy class structure that allows instantiation of multiple policy classes in a bifurcated NGAC graph, including exclusion default nodes and separable policy bindings, enabling efficient computation of access control decisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If NGAC models multiple policy classes with detailed implementation, then access control flexibility is improved, but graph node expansion becomes exponential and computational complexity increases
Solution Approach 1:
The patent segments the NGAC graph into distinct policy class instances, each representing a specific policy type (e.g., mandatory access control, discretionary access control). By dividing the overall access control system into modular policy class segments, the system can manage complexity through structured instantiation rather than creating exponential node variations. Each policy class instance operates as an independent unit with defined attributes and enforcement rules.
Solution Approach 2:
The patent creates universal policy class templates that can be instantiated multiple times to serve different policy requirements. Each policy class instance acts as a multi-functional unit that can enforce different access control models (MAC, DAC, RBAC) through standardized interfaces. This universality allows the same policy class structure to handle diverse access control scenarios without requiring separate graph nodes for each variation, thus preventing exponential expansion.
2Manufacturing precision
If NGAC provides comprehensive implementation details for policy classes, then policy enforcement accuracy is improved, but computational overhead and memory requirements increase
Solution Approach 1:
The patent performs preliminary actions by pre-defining policy class templates with all necessary enforcement rules, attributes, and validation logic during system initialization. Each policy class instance is pre-configured with its specific parameters (e.g., security levels, roles, permissions) before runtime access control decisions are made. This preliminary configuration eliminates the need for complex computations during access requests, as the enforcement logic is already prepared and cached in the graph structure.
Solution Approach 2:
The patent uses copying by creating instances of policy classes from standardized templates rather than computing enforcement logic from scratch for each access request. Each policy class instance is a copy of the template structure with specific attribute values instantiated. This copying approach maintains high enforcement accuracy by preserving the complete policy definition while reducing computational overhead, as the copied instances can be efficiently evaluated without re-computing the underlying enforcement rules.
3Adaptability or versatility
If NGAC allows adding new policy classes dynamically, then system adaptability is improved, but integration complexity and configuration disruption increase
Solution Approach 1:
The patent implements dynamics by enabling policy classes to be dynamically instantiated, modified, and removed from the NGAC graph at runtime. The graph structure supports dynamic addition of new policy class instances with different access control models (e.g., adding a new MAC policy or RBAC policy) without requiring system shutdown or reconfiguration of existing policies. Each policy class instance can be independently activated or deactivated, allowing flexible adaptation to changing security requirements while maintaining system stability.
Data Source
AI summary
In implementations of a repeatable NGAC policy class structure, a computing device implements a next generation access control (NGAC) graph that includes user elements representing users, object elements representing resources, and multiple policy classes modeled with a composable policy class structure that is repeatable to instantiate each of the multiple policy classes in the graph. The composable policy class structure includes a policy class as enforceable access criteria by which the user elements are allowed or denied access to the object elements that represent the resources, an exclusion default object node and an exclusion default user node of the policy class, and an association that indicates object elements contained as members of the exclusion default object node granting all policy permissions to user elements contained as members of the exclusion default user node. The NGAC graph can be utilized to compute an access control decision across the multiple policy classes.