Object-Based Authorization Management for Multi-User Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authorization management systems struggle with abstracting user objects, achieving fine control over authorization resources, and managing decentralized and domain-split authorization, leading to complexity and inefficiency, especially when dealing with multiple user types and application systems.
Innovation Solution
A system and method for managing authorization based on objects, which performs coarse-grained abstraction on users, enables fine-grained modeling of authorization resources, and supports decentralized and domain-split management, allowing for flexible identity and attribute assignment and universal authorization control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the user object is embodied concretely rather than abstracted, then the system can manage specific user types (CPSP administrator, operator administrator, etc.), but the system becomes difficult to manage when multiple user types need to be handled simultaneously
Solution Approach 1:
The patent extracts the common characteristics of all user types into a generic User object, separating the essential user attributes from the specific user type characteristics. This allows the system to manage multiple user types through a unified abstraction level, reducing management complexity while maintaining versatility.
Solution Approach 2:
The patent creates a universal User object that can represent any type of user in the system. This single object structure serves multiple functions by accommodating different user types (CPSP administrator, operator administrator, ordinary user, etc.) through configurable attributes rather than requiring separate object structures for each user type.
2Manufacturing precision
If authorization resources are organized in a unitary mode with two-dimensional modeling (function authorization and data authorization), then the system structure is simple, but the system cannot achieve fine control or decentralized and domain split management
Solution Approach 1:
The patent extends the traditional two-dimensional authorization modeling (function × data) by adding a third dimension for user types. This creates a multi-dimensional authorization space that enables fine-grained control while maintaining a structured approach to authorization management.
Solution Approach 2:
The patent segments the authorization system into distinct modular components: User object, Resource object, and Authorization object. Each component handles specific aspects of authorization, allowing for decentralized management and domain split control while keeping the overall system structure organized and manageable.
3Adaptability or versatility
If different application systems are independent in authorization management, then each system can be developed separately, but the systems are closely coupled in data storage and authorization access, leading to weak generality and repeated development
Solution Approach 1:
The patent develops a universal authorization management system with standardized objects and interfaces that can be applied across different application systems. The generic User object, Resource object, and Authorization object provide a common foundation that reduces repeated development while maintaining the independence of individual application systems.
Solution Approach 2:
The patent introduces a standardized authorization management layer that acts as an intermediary between different application systems and the underlying authorization infrastructure. This mediator layer handles data storage and authorization access uniformly, allowing application systems to remain independent while sharing common authorization mechanisms.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
The present invention provides a system and a method for managing authorization based on objects, wherein the system comprises an object management module, an authorization and authentication management module and an authorization resource management module, wherein the object management module is configured to extract an object from a user entity and subsequently associate the extracted object with an entity object in an application system; the authorization resource management module is adapted to model an authorization, perform domain split and decentralized management on authorization resources; wherein the domain split management is performed on users at different levels, and the decentralized management is performed on users at the same level; the authorization and authentication management module is configured to authorize the authorization resources to an entity object with identity characteristics and perform authentication when the object is accessing the authorization resources so as to obtain access authentication, wherein after the authentication succeeds, the object obtains an authorization permission and is accessing the authorization resources, otherwise, the object is refused access to the authorization resources. The present invention settles the problem that the management is difficult when multiple types of users exist in different application systems, which enables fine control on the authorization resources.