Role-Based Access Management Framework for Nested Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer security systems face challenges in linking authorization enforcement points with business resources, leading to inadequate protection and difficulty in determining minimal user authorizations for specific business functions, especially in nested applications, and traditional security audits fail to mitigate these gaps.
Innovation Solution
A system and method utilizing role-based access management (RBAM) with a metadata repository to model business resources and enforce access controls, ensuring that only authorized users access protected resources through a framework that translates business data into assignable authorizations, and provides a pre-emptive security audit mechanism.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If authorization enforcement is implemented only at the entry level of nested applications, then ease of operation is improved, but security protection deteriorates because knowledge about resources accessed in deeper levels is lost
Solution Approach 1:
The system segments authorization enforcement into multiple levels: entry-level enforcement for initial access control and deep-level enforcement for resource-specific control. This segmentation allows the system to maintain both operational simplicity and security reliability by applying appropriate enforcement strategies at different application depths.
Solution Approach 2:
The patent implements nested authorization enforcement where entry-level checks are embedded within deeper resource-level checks. This nested structure allows the system to maintain simple entry-point authorization while simultaneously enforcing detailed resource-specific authorizations at deeper levels, effectively combining both benefits.
2Reliability
If authorization enforcement is implemented at all levels of nested applications, then security protection is improved, but device complexity worsens and system security endangers due to extensive user authorizations required
Solution Approach 1:
The system applies local quality by making authorization enforcement selective rather than universal. Entry-level enforcement is applied at the application entry point, while resource-level enforcement is applied only at specific resource access points. This selective application reduces overall complexity while maintaining security where most critical.
Solution Approach 2:
The patent implements partial action by enforcing authorizations only at critical points (entry level and resource level) rather than at every possible interaction point. This partial enforcement approach maintains adequate security protection while avoiding the excessive complexity that would result from universal multi-level enforcement.
3Ease of operation
If traditional security audit methods are used, then ease of operation is maintained, but the ability to link authorization enforcement with business resources deteriorates
Solution Approach 1:
The patent introduces an intermediary layer (authorization framework) that connects traditional security audit mechanisms with business resource information. This intermediary captures and translates authorization decisions into business context, allowing auditors to review authorization enforcement while understanding the underlying business resources and purposes without complicating the audit process.
Data Source
AI summary
Embodiments of the present invention may provide a system and method for business data provisioning for a pre-emptive security audit. In one aspect, a method embodiment may comprise the steps of identifying the business resources as expressed in business terms, ensuring that applications dealing with (parts of) the business resources are aware of the link to the resource, transmitting the information about the used business resources throughout the call stack up to the UI, making use of the highest access enforcement point possible where it can be ensured that access to the protected resource is only done through either authorized users or trusted code, and having this access enforcement point taken over by a framework to ensure adequate protection even in extensibility scenarios.