Role-Based Access Control Decoupling Ownership from Usage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack the flexibility to effectively model complex relationships between Roles, Login-IDs, and Groups, limiting the ability to decouple Role ownership from usage and failing to capture nuanced permissions and attributes, which is essential for accurately representing real-world organizational structures.
Innovation Solution
A system and method that allows for the definition and manipulation of Roles independently of Groups, enabling Role ownership transfer, attribute management, and sophisticated permission evaluation, using a Role definition and maintenance utility, attribute configuration, and organizational modeling tool to create a class structure representing these relationships.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If Groups are used to express both true membership and aggregate permissions, then the system structure is simplified, but the flexibility to model complex organizational relationships is reduced
Solution Approach 1:
The patent segments the Group construct into two distinct entities: Group (for membership) and Role (for permissions). This separation allows independent management of membership relationships and permission assignments, enabling complex organizational modeling where users can belong to multiple groups with different roles in each context.
Solution Approach 2:
The patent extracts the permission aggregation function from the Group construct and places it in a separate Role entity. Roles can be owned by Groups, Users, or other Roles, and can be combined hierarchically to form composite roles, providing flexible permission management independent of group membership structure.
2Ease of operation
If Roles are treated only as attributes shared among Groups, then the system is easier to manage, but the ability to characterize properties for single individuals is lost
Solution Approach 1:
The patent makes Roles universal by allowing them to be owned by multiple types of entities (Groups, Users, or other Roles) and used by multiple users simultaneously. A Role can function both as a group-level permission container and as an individual user attribute, enabling flexible assignment where the same Role can be instantiated with different active states for different users.
3Adaptability or versatility
If multiple Roles are combined to form higher level Roles, then the modeling sophistication increases, but the system complexity increases
Solution Approach 1:
The patent implements nested Roles where Roles can own other Roles, creating hierarchical composite Roles. This nesting structure allows complex permission sets to be built from simpler component Roles, managing complexity through hierarchical organization rather than flat enumeration of all permissions.
Solution Approach 2:
The patent combines multiple Roles into composite Roles through ownership relationships. When a user has access to multiple Roles, the system merges their permission sets, automatically aggregating capabilities from parent Roles and child Roles, thereby simplifying the user's effective permission set while maintaining sophisticated underlying structure.
4Adaptability or versatility
If Role ownership is decoupled from Role usage, then the flexibility increases, but the system complexity increases
Solution Approach 1:
The patent extracts the ownership relationship from the usage relationship by introducing a distinct Role owner entity separate from the users who activate Roles. This allows the same Role to be owned by one entity while being used by multiple different users, enabling scenarios like transferable permissions, inheritable roles, and dynamic role activation without reassignment of ownership.
Data Source
AI summary
The capability to design and implement roles in a role-based system is disclosed. The system and data architecture enable organizations to model and assign relationships between Roles and other entities in a computing environment. The complex interrelation of Groups and Roles is established in an environment where: users need not be a member of a Group to use the capabilities of a Role; Role ownership is distinct from Role usage; and Roles themselves have attributes. A collection of methods enable creation, configuration, maintenance, ownership and usage of roles and for implementing relationships between the Role and other system entities, attributes and permissions.