ReBAC Authorization Indexing for Faster Permission Queries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Determining permissions for users in a relationship-based access control (ReBAC) system with a large quantity of users and objects is time-consuming and complex due to numerous relationships between users and objects within a data management system.
Innovation Solution
Generate a set of indices from an authorization model indicating user-object relationships to efficiently authorize access, using a message generation system to create data messages that reduce the complexity and time required for determining access rights.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a relationship-based access control model is used to manage permissions for a large quantity of users and objects, then the system can provide fine-grained authorization and flexible access control, but determining permissions becomes time-consuming and complex due to the large quantity of relationships between users and objects
Solution Approach 1:
The system pre-generates a set of indices from the authorization model before actual access requests are processed. These indices capture the relationships between users and objects in advance, organized in a structure that enables rapid lookup. When a permission check is needed, the system queries the pre-computed indices rather than traversing all relationships, significantly reducing permission determination time while maintaining fine-grained authorization capabilities.
2Adaptability or versatility
If a relationship-based access control model is used to manage permissions for a large quantity of users and objects, then the system can provide flexible access control based on relationships, but the complexity of determining access rights increases due to numerous relationships
Solution Approach 1:
The system segments the complex authorization model into multiple independent indices, where each index represents a specific relationship type or aspect of user-object relationships. Instead of processing the entire authorization model as a single complex structure, the system divides it into manageable segments that can be queried and processed independently, reducing the overall complexity of permission determination while preserving the flexibility of relationship-based access control.
Data Source
AI summary
An identity and access management system may utilize a relationship-based authorization system for indexing permission relationships. To index the permission relationships, the relationship-based authorization system may receive, from a developer, an authorization model for a data management system where the authorization model indicates a set of users and a set of objects. An identification system associated with the relationship-based authorization system may identify a set of relations associated with a set of relationship tuples indicated within the authorization model. Moreover, a respective relationship tuple may indicate an authorization level of a respective user for a respective object. Further, a message generation system associated with the relationship-based authorization system may generate a set of data messages associated with the set of relationship tuples. The results of the set of data messages may be used to obtain a set of indices used for authorizing access to data within the data management system.