Automated Resource Access Policy Translation Module

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional access control mechanisms, such as Access Control Lists (ACLs) and Web Service Security Policies, are labor-intensive and lack automation in translating between different resource access policy types, limiting efficient policy management and updates.

Innovation Solution

Implementing a transformation module that automatically populates fields of one resource access policy into corresponding fields of another, enabling at least partial automated conversion between ACLs and WS-SecurityPolicy, reducing labor intensity by using a message processor to extract and transform policy data from one type to another.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If manual translation between different resource access policy types is performed, then accuracy and control over policy conversion is maintained, but labor intensity and time consumption increase significantly

Engineering Contradiction:

Improvepolicy translation efficiencyVSAvoidtime consumption for policy translation

Core Design Contradiction:

ProductivityVSLoss of time

Solution Approach 1:

The patent replaces manual mechanical translation processes with an automated computer-based system. The message processor automatically reads source policy documents, identifies field mappings between different policy types, and generates translated policies without human intervention, thereby eliminating labor intensity and time consumption associated with manual translation

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system enables self-service policy translation where the translation module automatically handles the conversion process. The system identifies corresponding fields between different policy types and performs translation autonomously, allowing policy documents to be converted without requiring skilled manual translation work

Inventive Principle:

Principle #25Self-service

2Extent of automation

If automated translation between resource access policy types is implemented, then translation efficiency and labor reduction are achieved, but system complexity and translation accuracy risks increase

Engineering Contradiction:

Improveautomation level in policy translationVSAvoidcomplexity of translation system

Core Design Contradiction:

Extent of automationVSDevice complexity

Solution Approach 1:

The patent segments the translation system into distinct functional modules: a reader module for parsing source policies, a field identifier module for mapping between policy types, and a writer module for generating translated policies. This segmentation reduces overall system complexity by making each component's function clear and independent, while maintaining high automation capability

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system introduces a field mapping configuration as an intermediary between different policy types. This configuration file defines the correspondence relationships between fields in different policy formats, serving as a mediator that enables automated translation without requiring complex real-time analysis, thereby reducing system complexity while maintaining accuracy

Inventive Principle:

Principle #24Intermediary (Mediator)

3Manufacturing precision

If field mapping between different policy types is manually configured, then translation accuracy can be controlled, but setup time and maintenance complexity increase

Engineering Contradiction:

Improveaccuracy of policy field translationVSAvoidease of policy translation system setup

Core Design Contradiction:

Manufacturing precisionVSEase of manufacture

Solution Approach 1:

The patent implements preliminary configuration of field mapping relationships before actual translation occurs. The field mapping configuration is pre-established and stored, allowing the automated system to directly use these pre-defined mappings during translation without requiring manual field-by-field configuration during execution, thereby simplifying setup while maintaining accuracy

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system allows flexible configuration of field mapping parameters to adapt to different policy types. By changing the mapping parameter definitions in the configuration rather than rewriting translation logic, the system can accurately translate between different policy formats without increasing operational complexity, maintaining both accuracy and ease of setup

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS8266118B2Automated access policy translation

Publication Date: 2012.09.11 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

The use of one resource access policy to populate a second resource access policy. One of more fields of the first resource access policy are each to be used to populate corresponding one or more fields of the second resource access policy. After identifying the field(s) of the first resource access policy, and identifying their corresponding field of the second resource access policy, the information from the source fields of the first resource access policy are then used to populate the destination fields of the second resource access policy. This may be done in an automated fashion thereby allowing for at least the possibility of the transition from one type of resource access security to another.