Permission Data Object Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing access control in large computer systems with numerous users and data volumes is burdensome, as existing methods require frequent updates of access control lists to ensure accurate user permissions, especially when users access data over networks.
Innovation Solution
Implementing permission data objects that associate user affiliations with business data objects, allowing access based on group affiliations and attribute matching, eliminating the need for a predetermined access control list by using permission objects created at design time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control lists are used to manage user permissions, then user access control is achieved, but the process of creating and updating the access control list becomes burdensome and time-consuming
Solution Approach 1:
The patent applies preliminary action by pre-defining permission data objects with permission attributes and permission values during system design or setup. These permission data objects are created in advance with predefined rules that automatically determine user access rights, eliminating the need for manual creation and updating of access control lists at runtime. The permission data objects are established before the actual access control operations occur.
Solution Approach 2:
The patent implements self-service through automatic access control decisions. When a user seeks access to a business data object, the system automatically evaluates the user's attributes against the predefined permission data objects and makes access decisions without requiring manual intervention. The system self-determines whether to grant or deny access based on the matching between user attributes and permission attributes, eliminating the need for continuous manual updates of access control lists.
2Reliability
If access control lists are frequently updated to reflect changing user permissions, then access accuracy is maintained, but administrative effort and time consumption increase
Solution Approach 1:
The patent applies preliminary action by pre-defining permission data objects with permission attributes and permission values during system design or setup. These permission data objects are created in advance with predefined rules that automatically determine user access rights, eliminating the need for manual creation and updating of access control lists at runtime. The permission data objects are established before the actual access control operations occur.
Solution Approach 2:
The patent implements feedback mechanisms where the system automatically evaluates user attributes against permission data objects during access requests. This feedback loop continuously monitors and adjusts access decisions based on current user attributes and permission rules, ensuring access accuracy without requiring manual updates. The system receives feedback from access requests and automatically determines whether to grant or deny access based on predefined criteria.
3Reliability
If unique user identifiers are used for access control, then precise user-specific permissions are achieved, but the complexity of managing individual user permissions increases
Solution Approach 1:
The patent applies segmentation by dividing access control into multiple independent permission data objects, each defined by specific permission attributes and permission values. Instead of managing a single comprehensive access control list, the system segments permissions into discrete, manageable units that can be independently configured and evaluated. Each permission data object handles a specific aspect of access control, making the overall system more manageable despite the increased number of components.
Solution Approach 2:
The patent implements parameter changes by using attribute-based permission data objects that can be dynamically configured. The permission attributes and permission values serve as parameters that can be changed to adapt access control to different user needs and business requirements. This parameter-based approach allows flexible customization of access rights without requiring complex manual management of individual user permissions, as the parameters can be modified through automated evaluation processes.
Data Source
AI summary
Techniques are described for using permission data objects to control user access to business data objects. A permission data object identifies a group affiliation associated with a user and a business object type (or family of business data objects) to which the permission object controls access. A permission object includes a permission attribute and a permission value. A user who has the group affiliation that is identified in the permission object is permitted to access a particular business data object of the business object type when the value of the permission attribute in the permission data object is consistent with the value of a corresponding attribute in the particular business data object to which the user seeks access.