Role Passing Persistence Mechanism for Container RBAC
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current role-based access control (RBAC) implementations in containers face challenges such as the need for customized programming logic for each connection protocol, redundant code maintenance, and inability to update user roles without closing and reopening the connection.
Innovation Solution
A role passing and persistence mechanism is introduced, allowing role validation and management to be handled independently of connection protocols, enabling uniform role passing and persistence across different protocols, and allowing role changes without session closure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If customized programming logic is added to handle each connection protocol adaptor, then the container can support multiple client types, but the device complexity and code maintenance cost increase significantly
Solution Approach 1:
The patent introduces a session manager as an intermediary component that centralizes session and role management functions. Instead of embedding adaptor-specific logic in multiple services, the session manager handles all session creation, role extraction, and role validation requests uniformly. This mediator pattern reduces complexity by consolidating diverse protocol handling into a single standardized interface.
Solution Approach 2:
The session manager is designed as a universal component that handles session management for all connection protocol adaptors through a single standardized interface. It extracts role information from different protocol formats and validates roles against a common set of rules, making the system multi-functional without requiring separate customization for each protocol type.
2Reliability
If role information is validated during session establishment, then access control is enforced, but the user role cannot be changed without closing and reopening the connection
Solution Approach 1:
The patent implements dynamic role validation where the session manager can update user roles during an active session without requiring connection closure. The system transitions from static role assignment at session establishment to dynamic role modification, allowing roles to be changed, added, or removed while the session remains active. This is achieved through the updateUserRole function that modifies session roles in real-time.
Solution Approach 2:
The session manager pre-validates role information during session establishment and stores it for quick access. When role updates are requested, the system performs preliminary validation of the new role before applying it, ensuring access control integrity is maintained while enabling flexible role changes during the session lifecycle.
3Adaptability or versatility
If programming logic is embedded in the container to handle role passing from multiple adaptors, then role information can be extracted from different protocols, but redundant code and maintenance expenses increase
Solution Approach 1:
The patent extracts role management functionality from individual services and adaptors, centralizing it in a dedicated session manager component. This extraction eliminates redundant code by removing duplicate role validation and session management logic from multiple service implementations. The session manager becomes the single source of truth for role handling, significantly reducing maintenance burden.
Solution Approach 2:
The system is segmented into distinct functional components: connection protocol adaptors, session manager, and hosted services. Each component has a specific responsibility, with the session manager handling all role-related operations. This segmentation allows independent development and maintenance of each component without affecting others, improving overall system productivity and reducing code duplication.
Data Source
AI summary
A role passing and persistence mechanism that implements role-based access control at a container level is disclosed. In one implementation, the role passing and persistence mechanism provides one or more RBAC services. Functions provided by the role passing and persistence mechanism include role validating, role persisting and role administration. The role passing and persistence mechanism is used to persist role information for a session between a client and a container for any type of client. No matter which adaptor a client uses to connect to the container, the role passing and persistence mechanism provides a uniform method of passing role information to the container such that persisted role information can be used by any service hosted by the container after the session is established and the role information has been persisted.