Reverse Query Evaluation in Attribute-Based Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Evaluating reverse queries in attribute-based access control (ABAC) policies is computationally demanding, especially when dealing with large sets of requests, making real-time evaluation impractical in interactive systems.
Innovation Solution
A method and system that reduce the computational load by extracting common attributes, simplifying the policy, caching intermediate results, translating decisions into Boolean logic, and using SAT solvers or binary decision diagrams to derive valid requests efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If reverse queries are evaluated by checking all access requests against the policy, then complete and accurate results are obtained, but processing time and computational resources increase significantly
Solution Approach 1:
The system performs preliminary actions by extracting common attributes from the set of access requests and simplifying the policy before actual evaluation. This pre-processing step reduces the complexity of subsequent evaluations, enabling faster query results without sacrificing accuracy.
Solution Approach 2:
The invention extracts common attributes from multiple access requests and separates them from the evaluation process. By taking out these common attributes, the system reduces the number of requests that need to be fully evaluated against the policy, thereby reducing processing time while maintaining result accuracy.
2Reliability
If the policy is evaluated for each access request individually, then detailed and comprehensive access control decisions are made, but the system complexity and processing overhead increase
Solution Approach 1:
The system merges multiple access requests by identifying and grouping common attributes. Instead of evaluating each request independently through the full policy, common attributes are combined and evaluated once, reducing system processing complexity while maintaining reliable access control decisions.
Solution Approach 2:
The policy simplification is performed as a preliminary action before individual request evaluation. This pre-simplification reduces the policy complexity that each request must be evaluated against, lowering processing overhead while preserving the reliability of access control decisions.
3Adaptability or versatility
If all functional expressions in the policy are evaluated for each request, then complete policy coverage is achieved, but processing efficiency decreases
Solution Approach 1:
The system applies partial action by evaluating only the necessary portion of the policy after simplification. Common attributes are extracted and used to reduce the set of functional expressions that need to be evaluated, achieving sufficient policy coverage for the given requests while significantly improving processing efficiency.
Solution Approach 2:
The invention extracts common attributes from the requests and uses them to filter and reduce the set of policy functional expressions that need evaluation. This extraction approach maintains adequate policy coverage for the specific requests while dramatically improving processing efficiency by avoiding unnecessary evaluations.
Data Source
AI summary
Real-time techniques for determining all access requests to an attribute-based access control policy which evaluate to a given decision, “permit” or “deny”. The policy is enforced to control access to one or more resources in a computer network. In one embodiment, a method includes: (i) receiving a reverse query and a set of admissible access requests, each of which includes one or more attributes in the policy and values of these; (ii) extracting attributes to which all access requests in the set assign identical values; (iii) reducing the ABAC policy by substituting values for the extracted attributes; (iv) caching the policy as a simplified policy; (v) translating the simplified policy and the given decision into a satisfiable logic proposition; (vi) deriving all solutions satisfying the proposition; and (vi) extracting, based on the solutions, all access requests from the set for which the policy yields the given decision.