Recursive Permission Management for Delegated User Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing permission systems lack flexibility and hierarchy, failing to facilitate user collaboration and delegation of permissions, and are not compatible with other access control models.
Innovation Solution
A recursive permission system with 'permissions to see permissions' and 'permissions to change permissions' is introduced, along with a method for storing and calculating these permissions, and a user interface for setting and getting permissions, which can be centralized or decentralized, using pattern-matching and zero-knowledge proofs for secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional permission systems (UNIX filesystem, Role-based access control) are used, then implementation is simple, but flexibility and hierarchy in permission management are insufficient
Solution Approach 1:
The patent implements nested permissions where permissions can contain sub-permissions that can be granted to other users. This allows hierarchical delegation where a user can grant specific permissions to another user, who can then further delegate subsets of those permissions. This nested structure enables flexible permission hierarchy without requiring complex centralized control, resolving the contradiction between flexibility and simplicity.
Solution Approach 2:
The permission system dynamically adjusts authority based on granted permissions. When permissions are delegated to users, their capabilities change dynamically without requiring system reconfiguration. The system adapts permission structures on-the-fly through programmatic permission grants, enabling flexible hierarchy while maintaining implementation simplicity through automated dynamic permission management.
2Ease of operation
If centralized permission management is used, then control is centralized, but user collaboration and delegation are limited
Solution Approach 1:
Users can autonomously grant and manage permissions without requiring centralized administrator intervention. The system enables self-service permission delegation where users programmatically grant permissions to collaborators, who can further delegate permissions. This self-service capability enhances user collaboration while the automated permission calculation engine maintains structural simplicity, resolving the contradiction between ease of operation and structural complexity.
3Adaptability or versatility
If permissions are made accessible to users for delegation, then collaboration improves, but security risks increase
Solution Approach 1:
The system continuously calculates and verifies user permissions based on the permission structure and granted permissions. This feedback mechanism ensures that delegated permissions are properly tracked and enforced, maintaining security while enabling collaboration. The automated permission calculation provides real-time feedback on effective permissions, preventing security breaches through improper delegation while maintaining flexible permission delegation capability.
Data Source
AI summary
A computer-implemented apparatus and method includes two or more user terminals, one or more services, communication channels among the user terminals and services; one or more lists of permissions stored in computer memory, a recursively-defined computer command vocabulary, wherein the recursively-defined computer command vocabulary comprises a “get” command with which a user can retrieve the value of a permission, depending on the whether the value of the permission allowing the user to use that “get” command on that permission has been set to true, and a “set” command with which a user can set the value of a permission, depending on the whether the value of the permission for that user to use that “set” command on that permission has been set to true.