Privilege Graph Node Deduplication for Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern enterprises face difficulties in managing and tracking user access privileges across numerous data environments, as the high cardinality of data elements and diverse systems make it challenging for human administrators to determine which data can be accessed by which users, leading to complex and inefficient privilege management.
Innovation Solution
A method and apparatus that reduce nodes and edges within a privilege graph by identifying and combining attribute nodes with shared outbound edges and creating intermediate nodes to simplify the graph, thereby reducing the number of paths that need to be traversed to determine access privileges, using a graphing service that communicates with data environments and identity systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a detailed privilege graph is maintained to track user access across numerous data environments, then access control accuracy is improved, but graph complexity and processing time increase
Solution Approach 1:
The patent combines multiple attribute nodes that share the same outbound edges into a single consolidated node. This merging reduces the overall number of nodes in the privilege graph while preserving the complete access control information, thereby maintaining measurement precision (access control accuracy) while reducing device complexity (graph complexity).
Solution Approach 2:
The consolidated attribute node serves as a universal representation that captures the access privileges of multiple original attribute nodes. This single node performs the function of multiple nodes by maintaining references to all the data environments and user access relationships, reducing complexity without sacrificing access control accuracy.
2Measurement precision
If a detailed privilege graph is maintained to track user access across numerous data environments, then access control accuracy is improved, but processing time increases
Solution Approach 1:
By merging attribute nodes with identical outbound edges into consolidated nodes, the patent reduces the total number of nodes that need to be processed during access control operations. This decreases processing time while maintaining access control accuracy through the preserved relational structure.
Solution Approach 2:
The consolidation of attribute nodes is performed as a preliminary action before access control decisions are made. This pre-processing step simplifies the graph structure in advance, so that subsequent access control operations can be executed faster without compromising accuracy.
3Adaptability or versatility
If human administrators manually track user access privileges across thousands of data elements, then flexibility in management is maintained, but operational efficiency decreases
Solution Approach 1:
The patent introduces an automated graph processing system that acts as an intermediary between human administrators and the complex privilege graph. This system automatically performs node consolidation and access control determination, dramatically improving operational efficiency while allowing administrators to maintain flexibility through the underlying graph structure's adaptability.
Data Source
AI summary
The technology disclosed herein reduces nodes and edges within a privilege graph that indicates access privileges for users to features of data environments. In a particular example, a method provides identifying two attribute nodes of a plurality of nodes in a privilege graph and determining that the two attribute nodes share the same one or more outbound edges. The method further provides combining the two attribute nodes into a combined node. The combined node represents attributes represented by the two attribute nodes. The method also provides tracing the privilege graph from a user through the combined node when determining which of the access privileges correspond to the user.