Policy Machine Template Generator for Consistent Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing role-based access control systems in distributed networks lack a standardized method for generating policy machines, leading to inconsistent access control and potential oversight in protecting communication routes, as individual services implement access control independently.
Innovation Solution
A system that generates a policy machine using a template generator, which takes roles and permissions as inputs to produce a policy machine template, and then incorporates users and objects to create a policy machine, allowing for consistent authorization and easy code reuse and interoperability, while representing policies using formalism introduced by the NIST specification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If individual services implement access control independently, then each service can make its own authentication and authorization determinations, but access control becomes inconsistent across the distributed platform and communication routes may be insufficiently protected
Solution Approach 1:
The patent introduces a centralized access control service that acts as an intermediary between users and distributed services. This service receives authentication requests, validates them against centralized policies, and returns authorization decisions. The intermediary ensures consistent access control across all services while allowing individual services to maintain their operational independence.
Solution Approach 2:
The patent merges access control functionality into a centralized service that handles authentication and authorization for multiple distributed services. By combining what was previously scattered across individual services into a single coordinated system, the patent achieves consistent access control policies platform-wide while maintaining the distributed nature of the services themselves.
2Reliability
If a centralized mechanism is used to protect access to each type of protected resource, then access control consistency is improved, but system complexity increases due to the need for centralized coordination
Solution Approach 1:
The patent creates a universal access control service that handles multiple types of resources and services through a single standardized interface. This service can authenticate users for different services, validate different types of access requests, and enforce various authorization policies all through one multi-functional system, reducing the need for separate access control mechanisms for each resource type.
Solution Approach 2:
The patent uses configurable parameters and policies that can be adjusted to adapt the centralized access control system to different services and resources. By changing policy parameters rather than restructuring the system architecture, the patent maintains consistency while accommodating diverse access control requirements across the distributed platform.
3Adaptability or versatility
If role-based access control is implemented without a standardized policy machine generation method, then flexibility in role assignment is maintained, but policy management becomes difficult and error-prone
Solution Approach 1:
The patent implements preliminary action by pre-defining role templates and permission sets that can be systematically assigned to users. The system prepares standardized role configurations in advance, which can then be applied to multiple users consistently. This preliminary structuring of access control policies makes management easier while preserving the ability to customize roles as needed.
Solution Approach 2:
The patent enables copying of role definitions and permission configurations across multiple users and services. Once a role is defined with specific permissions, it can be replicated and assigned to other users, ensuring consistency in access control policies while allowing rapid deployment of standardized roles across the platform.
Data Source
Figure 1~2
Figure 3A~3B
Figure 4A~4B
AI summary
A system for controlling access to a software application includes a policy machine template generator and a policy machine generator. The policy machine template generator may generate a policy machine template based on roles and permissions. The policy machine generator is coupled to the policy machine template generator and may generate a policy machine based on users and objects. The combination of the policy machine template and the policy machine is also claimed, as is a method for controlling access to a software application.