Reverse Query Evaluation in Attribute-Based Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Evaluating reverse queries in attribute-based access control (ABAC) policies is computationally demanding, especially when dealing with large sets of requests, making real-time evaluation impractical in interactive systems.
Innovation Solution
A method and system that reduce the ABAC policy by extracting common attributes, caching, and translating the policy into propositional logic to efficiently derive valid requests matching a given decision, using techniques like SAT solvers or binary decision diagrams for real-time reverse query evaluation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If reverse query evaluation is performed on large sets of requests, then comprehensive query results are obtained, but computational time and resources increase significantly
Solution Approach 1:
The patent segments the policy evaluation process by separating common attributes (those with identical values across all requests) from variable attributes. The policy is divided into parts that can be evaluated independently, allowing the system to process large request sets more efficiently by focusing computational resources only on variable attributes rather than re-evaluating the entire policy for each request.
Solution Approach 2:
The patent performs preliminary evaluation by identifying and extracting common attributes before the main policy evaluation. By pre-determining which attributes have identical values across all requests and removing them from further consideration, the system prepares a reduced policy set that can be evaluated faster without losing query result completeness.
2Reliability
If the ABAC policy is evaluated for each request individually, then accurate access control decisions are made, but system responsiveness decreases
Solution Approach 1:
The patent merges the evaluation of multiple requests by identifying common attributes that appear with identical values across all requests in the set. Instead of evaluating the policy separately for each request, the system combines them into a single reduced policy evaluation that applies to all requests simultaneously, maintaining access control accuracy while significantly improving responsiveness.
Solution Approach 2:
The patent extracts and removes common attributes from the policy evaluation process. By identifying attributes that have identical values across all requests and extracting them separately, the system reduces the complexity of the policy evaluation while maintaining the accuracy needed for access control decisions, thereby improving system responsiveness.
3Adaptability or versatility
If all functional expressions in the policy are evaluated, then complete policy coverage is achieved, but processing complexity increases
Solution Approach 1:
The patent applies partial action by evaluating only the necessary portions of the policy. Instead of evaluating all functional expressions, the system identifies and evaluates only those expressions that involve variable attributes (attributes with different values across requests). This partial evaluation approach maintains sufficient policy coverage for access control decisions while significantly reducing processing complexity.
4Measurement precision
If attribute values are fetched dynamically from remote sources, then accurate attribute information is obtained, but evaluation time increases
Solution Approach 1:
The patent performs preliminary action by evaluating which attributes require dynamic data fetching before the main policy evaluation process. By pre-identifying attributes that need to be fetched from remote sources and preparing the policy structure in advance, the system can minimize the time spent during actual evaluation while still obtaining accurate attribute information where needed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are real-time techniques for determining all access requests to an attribute-based access control policy which evaluate to a given decision, "permit" or "deny". The policy is enforced to control access to one or more resources in a computer network. In one embodiment, a method comprises: (i) receiving a reverse query and a subset of admissible access requests defined by constraints; (ii) constructing a partial request based on the subset; (iii) reducing the ABAC policy in accordance with the partial request; (iv) caching the policy as a simplified policy; (v) translating the simplified policy and the given decision into a satisfiable logic proposition in Boolean variables; (vi) deriving all variable assignments satisfying the proposition; and (vii) processing the variable assignments, based on relationships between the variables and elements of the policy, in order to obtain a set of valid requests, which are contained in the subset and evaluate to the given decision.