Permission Vector Access Control for Linear Scaling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing fine-grained access control methods, such as RBAC and ABAC, face challenges in managing permissions beyond the API level due to 'permission explosion' and require complex policy definitions, which are not applicable to API applications where permissions need to be assigned without predefined policies.
Innovation Solution
A permission vector model is introduced, where each resource is defined as orthogonal, allowing independent modification of permission sets, reducing memory usage and complexity by storing permissions in a linear scale, rather than polynomial, and enabling per-resource basis access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If attribute-based access control (ABAC) is used to provide fine-grained access control beyond API level, then access control precision is improved, but device complexity increases due to requiring policy definitions and complex permission management
Solution Approach 1:
The patent segments the permission management system into independent permission sets, where each permission set corresponds to a specific resource. This segmentation allows fine-grained access control by evaluating permissions on a per-resource basis rather than requiring complex global policies, thereby reducing system complexity while maintaining precision.
Solution Approach 2:
The patent changes the fundamental parameter of permission representation from policy-based rules to permission vectors with discrete permission elements. Each permission element can be independently granted or revoked, transforming the complex policy evaluation problem into simpler permission set intersection operations, thus reducing complexity while preserving fine-grained control precision.
2Measurement precision
If fine-grained access control is implemented beyond API level, then access control precision is improved, but memory usage increases polynomially due to permission explosion
Solution Approach 1:
The patent divides the permission system into orthogonal permission sets, where each set manages permissions for a specific resource independently. This segmentation prevents permission explosion by ensuring that adding a new resource only adds a constant number of permission elements rather than multiplying the total permission count, achieving linear memory scaling while maintaining fine-grained control precision.
Solution Approach 2:
The patent introduces a new dimensional organization of permissions using permission vectors, where permissions are arranged in an n-dimensional space with each dimension representing a resource. This dimensional reorganization transforms the exponential growth problem into linear growth by allowing independent modification along each dimension without affecting others, thus reducing memory usage while preserving access control precision.
Data Source
AI summary
A permission vector comprising a plurality of permission sets is used to manage permissions to resources of a resource provider. Each of the plurality of permission sets may correspond to a different resource of the resource provider, wherein each resource of the resource provider has an orthogonal relationship to the other resources. Each permission set may include one or more permission elements that define permissions granted to a user for accessing a corresponding resource element of a resource. The permission vector may be used to determine whether to fulfill user requests submitted to the resource provider to perform an operation that includes accessing a set of requested resources.