Service Context Access Control for Flexible User Permissions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user-based access control methods lack flexibility in restricting access to computing resources, as they do not adequately consider the service through which access is requested, leading to inconsistent and inflexible access permissions.
Innovation Solution
An access control system that determines and enforces access permissions based on both the user and the service through which the request is made, using a service and user token to generate access control entries that specify permitted types of access, allowing for flexible access control policies across different services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If user-based access control is implemented, then access permissions can be granted to particular users, but flexibility in restricting access based on service context is lost
Solution Approach 1:
The access control system segments permissions by creating distinct access control entries for each combination of user, service, and resource. Instead of a single user-based permission set, the system divides access control into granular entries that evaluate both user identity and service context independently, allowing flexible permission management without overwhelming complexity.
Solution Approach 2:
The patent adds a new dimension to access control by introducing service context as an additional evaluation criterion alongside user identity. This transforms the access control model from two-dimensional (user-resource) to three-dimensional (user-service-resource), enabling flexible service-based restrictions while maintaining user-based foundations.
2Adaptability or versatility
If service-based access control is added to user-based control, then access flexibility is improved, but system complexity increases
Solution Approach 1:
The system segments the access control evaluation into distinct components: user identification, service identification, resource identification, and permission evaluation. Each access control entry contains segregated fields for user, service, and resource, allowing the system to evaluate permissions by combining these segmented elements without creating excessive overall complexity.
Solution Approach 2:
The access control system is designed with universal structures that handle both user-based and service-based control through the same mechanism. The access control entry format and evaluation process serve multiple functions: they support simple user-based control, service-based control, and combinations thereof, reducing the need for separate complex systems.
Data Source
AI summary
For a particular request to access a resource, both a user associated with the request and a service through which the request is made are identified. Whether requested access to a resource is permitted is determined based on a user associated with the requested access and a service through which the access is requested. This determination can be made based on an access control entry of an access control list corresponding to the resource, the access control entry identifying access to the resource that is permitted to the user when accessing the resource through the service.