Role-Based Configuration Authentication for Shared Admin Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed systems, administrators with different roles can inadvertently modify configuration data outside their jurisdiction, posing security and system integrity risks.
Innovation Solution
A method involving encryption and digest verification is employed to associate configuration data with administrative domains, ensuring that only authorized administrators can modify data by using encryption key pairs and digest values to authenticate and validate changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If configuration data is stored in shared storage accessible by multiple administrators, then administrators can view and copy configurations from other domains, but unauthorized administrators can modify configurations outside their jurisdiction
Solution Approach 1:
The patent segments configuration data by associating each configuration object with a specific administrative domain and implementing domain-based access control. Configuration data is divided into domain-specific segments, where each administrator can only access and modify configurations within their authorized domain, preventing cross-domain modifications while allowing controlled viewing and copying.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism that verifies administrator credentials and domain permissions before allowing configuration access. This intermediary layer checks whether an administrator is authorized to view, copy, or modify specific configuration objects, enabling cross-domain visibility while blocking unauthorized modifications through automated permission verification.
2Ease of operation
If administrators can modify any configuration data in the system, then system flexibility and ease of management are improved, but security risks and system integrity are compromised
Solution Approach 1:
The patent implements local quality by applying different access permissions to different configuration objects based on their administrative domain. Each configuration object has localized security attributes that determine which administrators can modify it, allowing flexible management within domains while maintaining security boundaries. Administrators experience ease of operation for their authorized configurations but encounter access restrictions for unauthorized ones.
Solution Approach 2:
The patent incorporates feedback mechanisms that automatically verify administrator permissions before allowing configuration modifications. The system provides real-time feedback to administrators about their access rights, preventing unauthorized modifications by blocking operations on configurations outside their jurisdiction and alerting administrators to permission violations, thus maintaining security while preserving operational flexibility for authorized users.
Data Source
AI summary
Methods, non-transitory computer readable media, network traffic management apparatuses, central management devices, and network traffic management systems that control access to configuration data in a distributed system are illustrated. With this technology, a set of configuration data is stored in a first data structure and a corresponding set of configuration data is stored in a second data structure along with an encrypted digest value that was encrypted using a private key associated with a particular administrator role. The stored configuration data and/or newly received modifications to stored configuration data can be authenticated via a comparison of a digest value calculated using the configuration data compared to the stored encrypted digest value, which is decrypted with a stored public key corresponding to the administrator role. Accordingly, configuration data can be securely controlled by authenticating it as valid in accordance with authorized administrator roles prior to being updated or loaded.