Remote ABAC Policy Evaluation via Hierarchical Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing attribute-based access control (ABAC) systems face performance issues and inefficient network capacity usage due to the need to transfer large sets of attribute values from remote attribute sources to policy decision points (PDPs) for access request evaluations, particularly when dealing with multi-valued attributes.
Innovation Solution
Transforming ABAC policies to enable remote evaluation of hierarchically ordered functional expressions, allowing for direct execution of remote queries at remote attribute sources, thereby reducing the data transferred to PDPs and minimizing computational load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If large sets of attribute values are transferred from remote attribute sources to policy decision points for evaluation, then complete access control decisions can be made, but network bandwidth usage increases and evaluation performance deteriorates
Solution Approach 1:
The patent extracts and evaluates specific functional expressions remotely at the attribute source rather than transferring all attribute values to the PDP. Only the results of evaluated expressions are transferred back, separating the evaluation function from the central PDP and reducing network traffic while maintaining decision completeness.
Solution Approach 2:
The patent segments the policy evaluation process by identifying hierarchically ordered functional expressions that can be independently evaluated. The policy is divided into sub-hierarchies that can be processed remotely, allowing selective evaluation and transfer of only necessary results rather than complete attribute sets.
2Reliability
If large sets of attribute values are transferred from remote attribute sources to policy decision points, then complete access control decisions can be made, but evaluation performance deteriorates
Solution Approach 1:
The patent extracts computation-intensive functional expression evaluation from the PDP and performs it remotely at the attribute source. This extraction improves PDP performance by eliminating heavy computational tasks while ensuring complete evaluation through systematic processing of all necessary functional expressions.
Solution Approach 2:
The patent segments evaluation into hierarchical functional expressions that can be processed in parallel or distributed manner. By organizing evaluations into sub-hierarchies with clear dependencies, the system maintains complete evaluation while improving throughput and performance through distributed processing.
3Loss of energy
If remote queries are executed at remote attribute sources, then network bandwidth usage is reduced, but system complexity increases
Solution Approach 1:
The patent performs preliminary transformation of the ABAC policy into a hierarchical functional expression structure before remote evaluation. This preliminary action organizes the policy in a way that enables systematic remote execution, reducing the complexity of ad-hoc query formulation and making the remote evaluation process more manageable.
Solution Approach 2:
The patent introduces an intermediary transformation layer that converts traditional ABAC policies into hierarchical functional expressions suitable for remote evaluation. This intermediary structure acts as a bridge between the policy definition and remote execution, simplifying the interface between PDP and remote attribute sources while reducing network traffic.
4Productivity
If hierarchical functional expressions are transformed for remote evaluation, then computational load at PDP is reduced, but policy transformation complexity increases
Solution Approach 1:
The patent performs the policy transformation into hierarchical functional expressions as a preliminary step before deployment or initial policy setup. This one-time transformation effort enables ongoing remote evaluation without requiring complex real-time transformation logic at the PDP, improving operational efficiency while containing transformation complexity in a manageable preprocessing phase.
Data Source
Figure 1a~1b
Figure 2a~2c
Figure 3a~3e
AI summary
In a policy decision point (500) coupled to at least one remote attribute source (107a-c), a method of transforming an attribute-based access control (ABAC) policy (106) to facilitate evaluation includes: identifying a functional expression (F1) of the ABAC policy; forming, based on the sub-hierarchy of the policy that has F1 as its hierarch, a remote query intended for a RAS such that the output data from execution of the remote query correspond to the outcome of an evaluation of F1; and transforming the ABAC policy by replacing the sub-hierarchy by a second functional expression that represents the remote query. A method of evaluating an access request against an ABAC policy includes using such a transformed ABAC policy. Furthermore, a method of evaluating an access request against an ABAC policy includes identifying remotely executable sub-hierarchies and delegating these to remote attribute sources.