Scoped Attributes for Web Service Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Administrators of web services face difficulties in efficiently changing access control policies without altering application runtime or configuration, due to complex and unintuitive formats, leading to inefficient and insecure access control configurations.
Innovation Solution
A system and method for scoped attributes that store user and resource attributes along with scope conditions to generate decisions on access control policies, allowing administrators to modify policies without complex authorization logic in their code, using a computer-implemented method that interprets scripts for web service requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If administrators directly alter application runtime or configuration to change access control policies, then access control policies can be changed, but the system complexity increases and security may be compromised
Solution Approach 1:
The patent introduces an intermediary access control system that sits between the application and the user, handling all access control decisions. This mediator translates high-level policy definitions into runtime enforcement decisions, allowing administrators to change policies without modifying application code or runtime configuration directly.
Solution Approach 2:
The patent segments the access control functionality into a separate, independent module that can be configured and modified independently from the application itself. This segmentation allows policy changes to be made in isolation without affecting the application runtime or configuration.
2Reliability
If complex authorization logic is added to application code to enforce access control policies, then access control can be enforced, but the code complexity increases and maintenance becomes difficult
Solution Approach 1:
The patent extracts all authorization logic from the application code and places it in a separate access control system. The application code only needs to make simple requests to the access control system, which handles the complex policy evaluation and decision-making independently.
Solution Approach 2:
The access control system acts as an intermediary that handles complex authorization logic centrally, allowing applications to enforce policies without embedding complex authorization code within their own logic.
3Ease of operation
If intuitive and simple formats are used for writing access control policies, then ease of configuration improves, but the granularity and precision of access control may be reduced
Solution Approach 1:
The patent uses attribute-based access control where policies are defined by comparing attributes of subjects, objects, and actions. This parameter-based approach allows intuitive policy definition while maintaining fine-grained control through attribute matching and scope conditions.
Solution Approach 2:
The patent applies local quality by allowing different attributes and scope conditions to be applied to specific resources and contexts. Each resource can have its own set of attributes and access requirements, enabling precise control tailored to local needs while using a uniform intuitive policy language.
Data Source
AI summary
In some example embodiments, a method includes storing a user attribute, a resource attribute of a resource of a web service, one or more scope conditions for applying one of attributes in generating a decision of whether to permit an action, and a script comprising an access control policy comprising one or more policy conditions to be satisfied in order to permit an action. A web service request may be received for accessing the resource. The scope condition(s) may be determined to be satisfied, and a decision to permit or deny the web service request may be generated based on the access control policy, with use of the stored attribute in generating the decision being based on the determination that the scope condition(s) are satisfied. Generating the decision may comprise interpreting the script. The decision may be transmitted to the web service.