Shared Resource Access Control With Hierarchical Authorization Trees
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control schemes for shared resources, particularly in large-scale computing environments, are cumbersome and inefficient, often requiring a 1:1 mapping of access rules to requests, leading to scalability issues and difficulty in managing granular permissions.
Innovation Solution
An access control framework that analyzes both the header and payload of requests to determine access, using a hierarchical authorization tree based on user roles and classes, allowing for granular permissions and reducing time complexity from O(N)^2 to O(N), enabling efficient and scalable access management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a 1:1 mapping of access rules to requests is used, then access control precision is improved, but device complexity and management difficulty increase
Solution Approach 1:
The patent segments the access control system into hierarchical levels (organization, department, resource) where rules are defined at each level independently. This segmentation allows precise control at each hierarchy while avoiding the complexity of managing individual 1:1 mappings for every request, as the hierarchical structure automatically composes permissions across levels.
Solution Approach 2:
The patent introduces a hierarchical dimension to the access control model, transitioning from flat 1:1 rule-request mapping to a multi-level hierarchical structure. This dimensional change enables rules to be defined once at higher levels and automatically apply to multiple requests and resources, reducing management complexity while maintaining precision through the hierarchical composition of permissions.
2Measurement precision
If hierarchical authorization trees with granular permissions are implemented, then access control granularity is improved, but time complexity increases
Solution Approach 1:
The patent performs preliminary action by pre-computing and caching authorization trees during off-peak periods or when policies change. These pre-computed trees store the hierarchical permission structures in an optimized format, enabling fast O(N) evaluation during request processing without repeatedly traversing the entire hierarchical rule set, thus reducing access decision time while maintaining granular permissions.
Solution Approach 2:
The patent merges the hierarchical authorization evaluation with the request processing flow by integrating the authorization tree traversal into the API gateway's request handling pipeline. This merging eliminates separate evaluation steps and allows the system to evaluate permissions in a single pass through the request data, reducing overall time complexity from O(N)^2 to O(N).
3Measurement precision
If comprehensive request analysis is performed for access control, then access decision accuracy is improved, but processing speed decreases
Solution Approach 1:
The patent extracts only the relevant portions of request data (header and payload fields specified in the authorization tree) needed for access control decisions, rather than analyzing the entire request. This selective extraction maintains decision accuracy by focusing on critical fields while reducing processing overhead and improving speed by avoiding unnecessary data analysis.
Data Source
AI summary
Approaches presented herein provide for access control management for shared resources. A request to perform an operation using one or more resources can be analyzed to extract a set of request data, where at least a portion of the request data can be extracted from the request payload. The request data can be compared against an authorization tree for a user, which can include various classes of rules associated with the user role. The actual endpoint for the request can be determined, which may be different from the endpoint otherwise specified for the request, and the appropriate permissions and action determined from the authorization tree. The data to be included in a response can be analyzed using the response tree as well to ensure that no data is included that is otherwise restricted according to the relevant permissions.