Proxy User Permissions System for Dynamic Role-Based Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security role management applications lack flexibility in distributing permissions for administrative tasks across a large-scale communication network infrastructure, requiring specific rights configuration on each device and not allowing for independent business rules or on-the-fly access changes.
Innovation Solution
A method and apparatus that utilize a proxy user permissions system, leveraging an XML file to store and apply rules based on active directory group memberships, allowing for conditional access and role evaluations, enabling users to perform administrative tasks without needing to log out and log back in for rule changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional authorization approaches are used with role-based permissions, then access control is enforced, but flexibility in distributing permissions across the network infrastructure is limited and device-specific configuration is required
Solution Approach 1:
The patent implements a universal authorization service that centralizes permission distribution across the entire network infrastructure. Instead of configuring permissions on each individual device, a single centralized service manages authorization for multiple devices and applications, allowing flexible permission distribution network-wide through a common interface and rule set.
Solution Approach 2:
The patent introduces an intermediary authorization service that sits between users/applications and network resources. This service evaluates authorization rules and makes access decisions, mediating between the user's credentials and the resource access requests. The intermediary handles the complexity of permission management centrally, eliminating the need for device-specific configuration while maintaining flexible control.
2Adaptability or versatility
If business rules are stored within roles in conventional APIs, then role-based access control is implemented, but business rules cannot be independent of particular roles
Solution Approach 1:
The patent segments the authorization system into distinct components: user credentials, roles, business rules, and resources. Business rules are extracted from roles and stored as independent, configurable entities. This segmentation allows business rules to be defined, modified, and evaluated separately from role assignments, enabling flexible rule management without being constrained by role structures.
Solution Approach 2:
The patent implements dynamic rule evaluation where business rules can be modified and updated independently of user sessions. The authorization service dynamically evaluates rules against current user credentials and context, allowing rules to change without requiring user re-login. This dynamic approach enables independent business rule management that responds to changing organizational requirements.
3Productivity
If conventional security applications are used, then access control is enforced, but users must log out and log back in to experience rule changes
Solution Approach 1:
The patent implements continuous authorization evaluation that operates throughout the user's session without interruption. The authorization service continuously monitors and evaluates business rules against user credentials and contextual information, allowing rule changes to take effect immediately during the user's logged-in state. This continuous operation eliminates the need for logout/login cycles to apply rule changes, maintaining uninterrupted user productivity.
Solution Approach 2:
The patent implements a feedback mechanism where the authorization service continuously evaluates business rules and provides real-time authorization decisions. When business rules change, the system immediately re-evaluates active user sessions and updates permissions without requiring user intervention. This feedback loop ensures users experience rule changes instantly while maintaining their logged-in state, improving efficiency by eliminating repeated authentication cycles.
Data Source
AI summary
Accessing a security enabled application may require certain access privileges that are not readily available or associated with the application at the time a user is seeking access via a login operation. In operation, an access attempt to a security enabled application may include identifying user credentials associated with the access attempt, generating a query based on the user credentials to identify whether the user credentials are associated with a predetermined group membership. A response to the query may be received that includes group information corresponding to the user and the group information may be compared to a set of predetermined rules to determine whether the group information includes privilege rules used to grant access to the access attempt.