Partial Evaluation for Access Control Policy Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches to policy distribution in large enterprises are inefficient, prone to error, and insecure, as they either distribute all policies, which is wasteful and exposes sensitive information, or require manual decision-making, which is administrative and error-prone, and do not allow for efficient management of XACML policies across multiple Policy Decision Points (PDPs).
Innovation Solution
A system that stores all access control policy functions centrally and uses partial evaluation to construct and send simplified access control policy functions to PDPs based on static attributes, allowing automatic distribution of policies to specific resources without administrator intervention, enabling efficient and secure policy management across multiple PDPs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If all policies are distributed to all PDPs, then administrators see a consolidated view and policy management is simple, but network overhead increases and runtime performance degrades
Solution Approach 1:
The patent segments the policy set distributed to each PDP by performing partial evaluation to generate specialized policy subsets tailored to each PDP's specific resources and attributes. This segmentation reduces the policy set size at each PDP while maintaining centralized management capabilities through the policy distribution server that coordinates the segmentation process.
Solution Approach 2:
The patent applies local quality by customizing the policy distribution to each PDP's local context. The partial evaluation process analyzes each PDP's specific attributes and resources to generate locally-optimized policy subsets, ensuring each PDP receives only the policies relevant to its local environment rather than a universal policy set.
2Reliability
If all policies are distributed to all PDPs, then policy coverage is complete, but sensitive policies are exposed to unauthorized PDPs
Solution Approach 1:
The patent extracts only the necessary subset of policies from the complete policy set and distributes them to each PDP. The partial evaluation process identifies and extracts only those policies that are relevant to each PDP's specific resources and attributes, leaving sensitive policies that are not needed at each PDP to remain centralized and protected.
3Reliability
If manual decision-making is used to distribute policies, then policy distribution is controlled, but administrative overhead increases and errors occur
Solution Approach 1:
The patent implements self-service by enabling the policy distribution system to automatically perform partial evaluation and generate optimized policy subsets without manual administrator intervention. The system autonomously analyzes each PDP's attributes, performs the necessary evaluation, and distributes the appropriate policies, eliminating manual administrative overhead while maintaining controlled and accurate distribution.
Solution Approach 2:
The patent applies preliminary action by pre-computing the partial evaluation results and generating optimized policy subsets in advance before they are needed at each PDP. This preliminary processing automates what would otherwise require manual administrative work, reducing both time and potential for human error while maintaining distribution control.
4Ease of operation
If a subset of XACML with profiles is used for distribution, then distribution control is enabled, but policies must be in special form and errors occur
Solution Approach 1:
The patent changes the parameter of policy representation by using partial evaluation to transform policies into simplified forms tailored to each PDP's specific context. Rather than requiring all policies to be written in a special profile format, the system takes standard XACML policies and dynamically transforms them through partial evaluation, providing both distribution control and format flexibility.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
The present invention relates to a system (IO) operable to control policy distribution with partial evaluation in order to permit/deny access to a protected means (12). The system (IO) comprises a storing means (14) operable to store all access control policy functions for all protected means (12), a guard means (16) operable to guard access to a protected means (12) and to construct an access control request comprising attributes regarding the protected means (12), a policy decision means (18) connected to the guard means (16) and operable to receive the access control request from the guard means (18). The system (IO) also comprises a policy distribution means (20) connected to the storing means (14) and to the policy decision means (18). The policy decision means (18) is operable to collect the static attributes of the protected means (12), and to send the static attributes to the policy distribution means (20), which in turn is operable to construct a partial access control request from the static attributes of the protected means (12), and to perform partial evaluation against the access control policy function stored in the storing means (14), resulting in a simplified access control policy function. The policy distribution means (20) is operable to send the simplified access control policy function to the policy decision means (18), which in turn is operable to use the simplified access control policy function to evaluate access control requests regarding the protected means (12), and to return a permit/deny response to the guard means (18).