RBAC Synthesis via Domain and Access Control Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in efficiently synthesizing role-based access control (RBAC) assignments due to complex interactions of deny and allow permissions, nested groups, inheritance, or blocked inheritance in Windows discretionary access control.
Innovation Solution
A system and method that determine a Windows domain model, create a domain graph and an access control graph, and calculate optimal policy-conformant configurations to facilitate the synthesis of RBAC assignments based on user-specified desired effective permissions and policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the system computes effective permissions by evaluating user, group membership, and inherited permissions for each resource and permission, then the accuracy of permission determination is improved, but the computational complexity and time required increases significantly
Solution Approach 1:
The system pre-computes and stores the effective permissions for each principal on each resource in a cache structure before they are needed for access decisions. This preliminary calculation eliminates the need to re-evaluate complex group memberships and inheritance chains during actual access control operations, significantly reducing computation time while maintaining accurate permission determination.
Solution Approach 2:
The permission evaluation process is divided into distinct phases: (1) pre-computation of effective permissions using the Windows algorithm, (2) caching of results in a structured format, and (3) rapid lookup during access decisions. This segmentation allows the computationally intensive parts to be performed once rather than repeatedly, reducing overall computation time while preserving accuracy.
2Reliability
If the system evaluates nested groups, inheritance, and blocked inheritance to determine effective rights, then the completeness of access control policy enforcement is improved, but the difficulty of understanding and managing effective rights increases
Solution Approach 1:
The system introduces an intermediary caching layer that stores pre-computed effective permission results. This cache acts as a mediator between the complex Windows permission evaluation algorithm and the simplified access control decisions, shielding administrators from the complexity of nested groups and inheritance while ensuring complete and accurate policy enforcement through the stored results.
Solution Approach 2:
The system creates a simplified copy of the effective permission state that can be easily queried and managed. Instead of requiring administrators to trace through complex group membership hierarchies and inheritance chains, the system maintains a copied representation of effective permissions that is much easier to understand and modify, while still reflecting the complete and accurate results of the full Windows permission evaluation.
Data Source
AI summary
A system and method are provided to facilitate securing windows discretionary access control. During operation, the system determines a Windows domain model including: user-specified desired effective permissions as capability assignments of principals on resources, wherein a respective capability assignment comprises a permission of a respective principal to a respective resource and wherein a respective principal comprises a user or a group of users; and user-specified policies and rules for relationships between principals, groups, and resources. The system creates a domain graph and an access control graph based on the Windows domain model. The domain graph maps paths between nodes representing users, groups, and resources based on the policies and rules. The access control graph allows for calculation of actual permissions of principals on resources based on the desired effective permissions. The system determines a set of optimal policy-conformant configurations based on the domain graph and the access control graph.