Compact Static Permission Encoding for Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large physical access control systems (PACS) face memory and processing power challenges due to extensive static permission databases, which become unwieldy as enterprises grow, requiring costly upgrades or additional hardware to manage and update permissions efficiently.
Innovation Solution
The system transforms static permissions into attribute-based rules, compiled for efficient execution on local controllers, using context-based information and derived attributes to make access decisions, reducing memory and processing requirements while enabling dynamic authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a large static permission database is maintained at controllers to support large-scale enterprises, then access control coverage and scalability are improved, but memory consumption and processing time increase significantly
Solution Approach 1:
The permission database is segmented into two parts: a compact attribute schema stored at the controller and a larger reference database stored at the credential. This segmentation allows the controller to maintain minimal memory while still supporting large-scale access control operations by querying credential attributes on-demand.
Solution Approach 2:
The system transitions from a traditional flat permission database stored entirely at the controller to a multi-dimensional architecture where permission data is distributed between the controller (attribute schema) and credentials (reference data). This dimensional shift enables scalable access control without proportional increases in controller memory.
2Reliability
If the permission database is updated frequently to reflect changing permissions, credentials, or users, then access control accuracy is improved, but update time and system downtime increase
Solution Approach 1:
The attribute schema is pre-configured at the controller with all possible permission attributes and their validation rules. This preliminary setup allows the system to immediately validate new permissions against the schema without requiring full database re-downloads, enabling rapid updates while maintaining accuracy.
Solution Approach 2:
The system implements dynamic permission validation where the controller uses the static attribute schema to evaluate permission requests in real-time against credential attributes. This dynamic approach allows frequent updates without system downtime, as the controller can validate new permissions immediately upon receipt without requiring full database synchronization.
3Power
If more powerful controllers or additional controllers are installed to handle large databases, then processing capability is improved, but system cost increases
Solution Approach 1:
The system extracts the bulk of permission reference data from the controller and relocates it to the credential. This extraction allows standard, low-cost controllers to maintain adequate processing capability for access decisions while avoiding the need for expensive high-power controllers or additional hardware infrastructure.
Data Source
AI summary
A physical access control system (PACS) for protecting a resource. The PACS includes a credential including information regarding a user stored thereon, the credential presented to request access to a resource protected by an access point. A reader is in operative communication with the credential and configured to read the user information from the credential. The user information includes at least one attribute. A controller executes a set of access control rules, the rules based on policies extracted from a database of static permissions for the user, the policies defining requirements for permitting access of the user to the resource based on the at least one attribute, the controller configured to permit access to the resource.