Scope-centric Access Control Model for Scalable Policy Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The combinatorial explosion of access control policies in scoped computing environments leads to non-linear growth, making it impractical to implement scope-centric access control models in reasonably sized systems, as the number of policy statements to evaluate increases exponentially with the number of objects, subjects, and roles.
Innovation Solution
A scope-centric access control model that maintains an association graph with association tuples, allowing for efficient determination of an actor's rights by computing privileges based on the scope of the client entity, rather than evaluating multiple inheritance paths, thereby avoiding the non-linear growth problem.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a scope-centric access control model is implemented by enumerating all client-supplier chains, then complete access control policy evaluation is achieved, but the number of policy statements grows non-linearly due to combinatorial explosion
Solution Approach 1:
The patent extracts and maintains an association graph that directly links scopes to supplier entities, separating the access control evaluation from the combinatorial enumeration of all client-supplier chains. This extraction allows the system to evaluate access control policies by querying the pre-computed association graph rather than enumerating all possible chains, thereby reducing the number of policy statements that must be evaluated while maintaining complete and accurate access control enforcement.
2Reliability
If multiple inheritance paths are evaluated to determine actor rights, then comprehensive rights determination is achieved, but the evaluation time increases non-linearly
Solution Approach 1:
The patent performs preliminary computation by maintaining an association graph that pre-establishes the relationships between scopes and supplier entities. When determining actor rights, the system queries this pre-computed graph rather than performing time-consuming evaluations of multiple inheritance paths at runtime. This preliminary action significantly reduces rights evaluation time while maintaining comprehensive and accurate rights determination.
3Adaptability or versatility
If the number of objects, subjects, and roles increases, then system functionality is improved, but the number of policy statements to evaluate increases exponentially
Solution Approach 1:
The patent introduces an association graph as an intermediary data structure that mediates between the increasing number of objects, subjects, and roles and the access control policy evaluation. The association graph efficiently stores and manages the relationships in a scalable manner, allowing the system to handle increased functionality without experiencing exponential growth in the number of policy statements that must be evaluated. The graph structure enables polynomial-time complexity rather than exponential complexity.
Data Source
AI summary
Apparatus, methods, and computer program products are disclosed that maintain an association graph made up of association tuples. Each of the association tuples belongs to an access-control-policy scope that imposes an access control policy. On receipt of a client reference and a supplier reference a scope-defining entity is identified from the client reference. The scope-defining entity has an explicit access control policy. An effective supplier reference is retrieved from a set of the association tuples matching the scope-defining entity and is presented.