Tag-Based Resource Access Control for Cross-Group Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing resource access control methods are limited to a single group of resources, making it impossible to implement unified access control across multiple groups, requiring users to obtain separate authorization for each group and lacking batch authorization capabilities.
Innovation Solution
A method and apparatus that pre-store association relationships between tag information and group resources, and access permissions, allowing users to access resources across multiple groups by matching tag information with access permissions, enabling cross-group resource access control and batch authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate authorization is implemented for each resource group, then access control security is maintained, but authorization efficiency deteriorates and CPU processing resources increase
Solution Approach 1:
The patent merges multiple resource group authorizations into a single unified authorization mechanism. By introducing a parent-child relationship between resource groups and implementing inheritance of access permissions, the system combines multiple authorization checks into one unified process. When a user is authorized to access a parent resource group, the authorization automatically extends to all child resource groups, eliminating the need for separate authorization requests for each group and significantly improving authorization efficiency while maintaining security.
Solution Approach 2:
The patent implements a universal authorization token that can access multiple resource groups simultaneously. The access token includes inherited permissions from parent resource groups, making it universally valid across hierarchical resource structures. This multi-functional token replaces the need for multiple separate authorization tokens, reducing CPU processing overhead while ensuring that access control security is maintained across all resource groups through the inherited permission structure.
2Reliability
If individual authorization is required for each resource group, then precise access control is achieved, but system complexity increases
Solution Approach 1:
The patent segments the resource authorization system into hierarchical levels (parent resource groups and child resource groups). This segmentation allows the system to manage complex access control requirements by breaking them down into manageable hierarchical units. Each parent resource group can be independently configured with specific permissions, and these permissions are automatically propagated to child groups, reducing the overall system complexity while maintaining precise access control at each level.
Solution Approach 2:
The patent implements preliminary action by pre-configuring the hierarchical relationship between parent and child resource groups before actual access operations. The inheritance rules and permission structures are established in advance, so that when authorization is needed, the system can quickly resolve permissions through the pre-established hierarchy rather than calculating them in real-time. This preliminary setup reduces system complexity during runtime while maintaining precise access control.
3Productivity
If batch authorization across groups is implemented, then authorization efficiency improves, but access control precision deteriorates
Solution Approach 1:
The patent adds a hierarchical dimension to the authorization system by introducing parent-child relationships between resource groups. This dimensional change allows batch authorization to occur naturally through the hierarchy - authorizing a parent group automatically authorizes all child groups in one operation. The hierarchical structure provides an additional layer of organization that enables efficient batch processing while maintaining precise control over which specific resource groups are included in each batch through the tree structure.
Solution Approach 2:
The patent introduces the parent resource group as an intermediary that mediates between the user and multiple child resource groups. When batch authorization is needed, the user is authorized through the parent intermediary, which then automatically distributes the authorization to all child groups. This intermediary mechanism enables efficient batch processing while maintaining precise access control, as the intermediary can selectively control which child groups receive authorization based on the predefined hierarchical relationships.
Data Source
AI summary
Embodiments of the present disclosure provide a resource access control method performed by a computing device. The computing device pre-stores an association relationship between tag information and a group resource and an association relationship between the tag information and access permission, respectively. After receiving a group resource access instruction, the group resource access instruction indicating a group resource to which a user requests access, the computing device obtains tag information granted to the user from the tag information associated with the group resource and then obtains access permission associated with the tag information based on the tag information granted to the user. Finally, the computing device compares the access permission with resource permission of the group resource, and permitting or rejecting, based on a comparison result, a group resource access requested by the user.