Policy-Based Resource Access Using Service Contract Mediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques for controlling access to confidential information in electronic transactions are inadequate as they assume authorized applications are not maliciously tampered with, and do not restrict operations performed against protected data stores, leading to potential unauthorized transactions.
Innovation Solution
Implementing a policy and attribute-based access system that authenticates principals and generates service contracts with selective resource access policies, allowing indirect access to resources through a service that enforces these policies, using identity configurations and alias identity information to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional access control techniques are used where authorized applications have direct access to protected data stores, then ease of operation is improved, but security is worsened because the applications cannot be trusted to not perform unauthorized transactions
Solution Approach 1:
The patent introduces a resource session administrator as an intermediary component between the service and the protected data store. This administrator establishes and controls resource sessions, enforcing access policies that prevent unauthorized transactions even when the service is compromised. The intermediary monitors and restricts operations performed against the data store, resolving the contradiction by maintaining both ease of operation and security.
2Productivity
If authorized applications are given unfettered access rights to protected data stores, then productivity is improved, but security is worsened because malicious users can perform unauthorized transactions
Solution Approach 1:
The patent implements dynamic access control through resource sessions that are established and controlled by the resource session administrator. Instead of static unfettered access rights, the system creates time-bound, policy-enforced sessions that adapt to security requirements. The administrator can dynamically adjust and terminate sessions, allowing efficient access when needed while preventing unauthorized transactions through active session management.
3Device complexity
If direct access from service to protected data store is implemented, then device complexity is reduced, but security is worsened because there is no restriction on operations performed
Solution Approach 1:
The resource session administrator serves as a lightweight intermediary that adds minimal architectural complexity while providing substantial security benefits. Rather than requiring complex authentication and authorization mechanisms embedded in every access point, the single administrator component centralizes access control, simplifying the overall architecture while enhancing security through policy enforcement.
Data Source
AI summary
Techniques are provided for controlling access to a resource based on access policies and attributes. A principal issues a request to a service for purposes of accessing a resource. The principal is authenticated and a service contract for the principal, the service, and the resource is generated. The service contract defines resource access policies and attributes which can be permissibly performed by the service on behalf of the principal during a session. Moreover, the session between the service and the resource is controlled by the service contract.