Role Expertise Qualifier Templates for Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems lack a flexible and granular access control mechanism to manage access to multi-dimensional object models, particularly in complex data storage environments where multiple users need to access and manage different portions of data with varying levels of expertise.
Innovation Solution
A computer-implemented method and medium that utilize templates to specify allowable access to objects based on roles and levels of expertise, allowing access if the user's role and expertise match the defined criteria, and applying these qualifiers to determine access rights for members, methods, and parameters of objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional access control mechanisms are used in data storage systems, then implementation is simple, but access control granularity is insufficient for complex multi-dimensional object models
Solution Approach 1:
The patent segments access control into multiple independent dimensions: roles, levels of expertise, and object types. Each dimension can be configured separately through templates, allowing fine-grained control over user access without requiring a completely complex access control system. This segmentation enables the system to achieve high adaptability while keeping each individual control dimension manageable.
Solution Approach 2:
The patent introduces multiple dimensions for access control (role dimension, expertise level dimension, object type dimension) rather than using a single flat access control mechanism. By adding these dimensional layers, the system achieves fine-grained access control granularity without proportionally increasing overall complexity, as each dimension can be independently configured and managed.
2Reliability
If access control is restricted based on multiple criteria (role and expertise level), then data security is improved, but access determination complexity increases
Solution Approach 1:
The patent performs preliminary action by pre-defining templates that specify allowable access for different roles and expertise levels before actual access requests occur. These templates are configured in advance and stored in the system, so when a user makes an access request, the system only needs to match the user's attributes against the pre-defined templates rather than evaluating complex access rules in real-time, thus maintaining security while reducing access determination complexity.
Solution Approach 2:
The patent introduces templates as an intermediary layer between user attributes and access control decisions. Instead of directly evaluating complex access rules against user requests, the system uses templates as mediators that encapsulate access policies. This intermediary simplifies the access determination process while maintaining strong security controls based on multiple criteria.
3Measurement precision
If templates specify detailed qualifiers for each object and member, then access control precision is improved, but template configuration complexity increases
Solution Approach 1:
The patent segments template configuration into hierarchical levels: object-level qualifiers and member-level qualifiers. This segmentation allows administrators to configure access control precision at the appropriate level without overwhelming complexity. Object-level templates provide broad access control, while member-level templates add precision only where needed, maintaining high access control precision while managing configuration complexity through structured segmentation.
Data Source
AI summary
Described are techniques for providing views of an object model. A template is received that specifies allowable access for a first object using qualifiers for the first object. The qualifiers include a first list of one or more roles and a second list of one or more levels of expertise. For a user identifier having an associated role and an associated level of expertise, it is determined whether to allow access to the first object. The determining includes determining whether the associated role is included in the first list and whether the associated level of expertise is included in the second list. Access to the first object is allowed if the associated role is included in the first list and the associated level of expertise is included in the second list.