Session Access Rights Intersection for Secure File Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access management systems do not consider user location when granting access to files, leading to potential security breaches as passwords are distributed and may be compromised, and users with varying access levels accessing files from computers with different clearance levels.
Innovation Solution
A method that determines the intersection of user and computer access rights, known as session access rights, to authorize access to files based on file permissions stored in metadata, ensuring proper access regardless of the user's location, by identifying the user and computer, and performing a lookup operation in a database to determine their respective rights.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If passwords are distributed to users for file access, then users can access files from any location, but passwords may be compromised and utilized by unauthorized users
Solution Approach 1:
The patent introduces a server as an intermediary between users and files. Instead of distributing passwords directly to users, the server mediates the authentication process by verifying user credentials and computer authorization rights before granting file access. This intermediary approach eliminates the need for password distribution while maintaining access flexibility.
Solution Approach 2:
The patent replaces the mechanical password-based authentication system with a rights-based access control system. Instead of relying on passwords that can be compromised, the system uses a database to store and verify user authorization rights and computer access rights, substituting the vulnerable mechanical password system with a more secure digital rights management approach.
2Adaptability or versatility
If users with different access levels access files from computers with different clearance levels, then location independence is achieved, but security breaches may occur due to mismatched access rights
Solution Approach 1:
The patent applies local quality by assigning different access rights to different computers based on their security clearance levels and locations. Each computer is evaluated individually for its authorization rights, and users must have matching or higher clearance levels to access files from specific computers. This ensures that access rights are tailored to the specific local context of each computer-user combination.
Solution Approach 2:
The patent changes the parameter of access control from static user-based permissions to dynamic session-based permissions that consider both user rights and computer rights. The system evaluates the intersection of user authorization rights and computer authorization rights for each access attempt, dynamically adjusting access decisions based on the specific user-computer combination and their respective clearance levels.
3Device complexity
If access rights are managed at the user level only, then implementation is simple, but it cannot prevent unauthorized access from unapproved computers
Solution Approach 1:
The patent segments access control into two independent components: user authorization rights and computer authorization rights. Instead of managing a single complex set of permissions, the system divides access control into user-level policies and computer-level policies, each managed separately in the database. This segmentation simplifies implementation while enhancing security by allowing independent management and verification of both user and computer rights.
Data Source
AI summary
Access to files is properly granted regardless of whether an accessing user is located at their primary location or at any “roaming” location. In particular, the techniques herein consider the user rights, rights of any computer from which the user is accessing files, and the rights associated with the files themselves, such as by determining the User ∩ Computer intersection of access rights (an overlap between rights of the user and rights of the computer), and applying these access rights to file rights (e.g., file metadata) to determine what access the user has to the files (e.g., viewing, modifying, etc.).