Span of Responsibility Access Control for Plant Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Administering user permissions in large-scale plant process management systems is challenging due to the complexity of managing permissions across multiple machines and devices, often resulting in unnecessary access rights being granted to users, which can compromise system integrity and increase administrative burdens.
Innovation Solution
A span of responsibility access control system that uses user accounts and resource properties to control access to assets, independent of permissions, by defining what assets and resources a user can interact with or see, rather than what actions they can perform, through an asset manager, authentication module, and access control module.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If permission-based security is implemented to control user access to system components, then system integrity is improved, but administrative complexity increases significantly
Solution Approach 1:
The patent segments the access control system into two distinct layers: span of responsibility (determining which assets a user can access) and permissions (determining what actions a user can perform). This segmentation allows independent management of each layer, reducing administrative complexity while maintaining system integrity. The span of responsibility acts as a filtering layer that precedes permission checks, organizing the complex permission management into manageable segments.
Solution Approach 2:
The patent introduces span of responsibility as an intermediary layer between user authentication and permission-based access control. This intermediary filters and organizes access requests before they reach the permission layer, simplifying the overall access control management. The span of responsibility serves as a mediator that reduces the complexity burden on the permission system by pre-establishing which assets users can potentially access.
2Ease of operation
If read permissions are granted to many users across multiple machines to ease administrative burden, then ease of operation improves, but system security deteriorates due to unnecessary access rights
Solution Approach 1:
The patent segments access control into span of responsibility (organizational level) and permissions (operational level). By implementing span of responsibility first, the system automatically limits which assets users can access based on their organizational role, thereby reducing the number of permission assignments needed while maintaining security. This segmentation prevents the security risk of unnecessary read permissions by establishing organizational boundaries before operational access is granted.
Solution Approach 2:
The patent applies local quality by allowing different span of responsibility configurations for different organizational units and user roles. Each user receives access rights appropriate to their specific organizational context rather than blanket access across the entire system. This localized approach to access control reduces security risks while maintaining ease of operation through role-based organizational structures.
Data Source
AI summary
A span of responsibility access control system for use in plant process management and similar applications. The system leverages span-of-responsibility enabled user accounts and corresponding resource properties to assign, verify, and control access to assets and other resources in the plant process management system on a per user basis. Aspects of the system include configuration of properties for each monitored or controlled asset and association of a span of responsibility based on asset properties, such as asset type and location, with a user account. An access control module compares asset properties to the span of responsibility associated with the user account to determine whether the user is entitled to access any given asset, independent of determining permissions to act on such asset.