Segmented Authorization Data Model for RBAC and Manual Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data processing systems face challenges in managing user authorizations, particularly when a combination of Role-Based Access Control (RBAC) and manual assignment is required, leading to difficulties in identifying and managing unauthorized access requests due to the lack of a flexible data model that distinguishes between role-managed and manually assigned authorizations, resulting in a large number of roles and complex administration.
Innovation Solution
A data processing system and method that divides the authorization data into multiple records, including one for role-managed, manually assigned, and unauthorized authorizations, with an interface to manage and compare these records to identify and address unauthorized access requests, allowing for efficient and flexible authorization management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a single field data model is used for authorization data, then the system is simple and easy to implement, but it cannot distinguish between role-managed and manually assigned authorizations, making it impossible to identify unauthorized access requests
Solution Approach 1:
The patent segments the authorization data model by dividing the single authorization field into multiple separate fields: one field stores role-based authorizations and another field stores manually assigned authorizations. This segmentation enables the system to distinguish between different authorization sources, allowing precise identification of unauthorized access requests while maintaining a relatively simple overall data structure that target systems can implement.
2Ease of operation
If individual authorizations are managed manually, then fine-grained control is achieved, but the number of roles increases significantly, making management difficult
Solution Approach 1:
The patent segments the authorization management process by separating role-based authorization management from manual authorization management. This allows the system to maintain a manageable number of roles for structured authorization while enabling fine-grained manual control for specific cases without requiring additional roles, thus reducing overall system complexity.
Solution Approach 2:
The patent introduces an intermediary management layer that sits between the target systems and the authorization data. This intermediary maintains the segmented authorization data and provides a unified interface for managing both role-based and manual authorizations, reducing the complexity of direct role management while preserving fine-grained control capabilities.
3Adaptability or versatility
If RBAC model is implemented fully, then authorization management is systematic, but it cannot accommodate individual authorization requirements, requiring a combination model that increases complexity
Solution Approach 1:
The patent segments the authorization data into distinct fields for role-based and manual authorizations, allowing the system to implement a combination of RBAC and manual management models. This segmentation enables the system to maintain the systematic benefits of RBAC while accommodating individual authorization requirements without requiring complex integrated management structures.
Solution Approach 2:
The patent creates a universal data model structure that can handle both role-based and manual authorizations through its segmented field design. This multi-functional data model can accommodate pure RBAC implementations, pure manual management, or any combination thereof, providing versatility while maintaining relatively simple implementation at the target system level.
Data Source
AI summary
A method of determining unauthorized user access requests in a data processing system, the method comprising the steps of accessing a record of role managed authorizations and a record of manually assigned authorizations, receiving a record of user authorization requests from a plurality of data processing systems, and comparing the record of user authorization requests to the record of role managed authorizations and to the record of manually assigned authorizations to identify any unauthorized authorizations.