Target-Based Access Check for Policy Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems face challenges in verifying that authorization policies effectively allow authorized users to access resources while preventing unauthorized access, especially in distributed network environments.
Innovation Solution
A target-based access check mechanism is implemented, where a context of a principal is built at the target system, including authenticated identifiers and attributes, and an authorization policy is applied to determine access permissions, allowing administrators to modify contexts and policies for testing purposes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control testing is performed by simulating access requests, then policy verification can be conducted, but the testing process becomes complex and dependent on actual access request flows
Solution Approach 1:
The patent introduces an intermediary testing mechanism that builds principal contexts directly at the target system without requiring actual access requests. This intermediary approach allows policy verification to be performed independently by constructing test contexts and applying authorization policies directly, eliminating the complexity of simulating complete access request flows while maintaining verification accuracy
Solution Approach 2:
The testing process is segmented into independent components: context building, policy application, and result verification. By separating the policy verification process from the access request flow, each component can be tested and validated independently, reducing overall testing complexity while improving reliability
2Reliability
If access control policies are tested through actual access requests, then real-world scenarios can be verified, but unauthorized access attempts may occur during testing
Solution Approach 1:
The system performs preliminary policy verification by building principal contexts and applying authorization policies in advance, before any actual access requests are processed. This preliminary testing allows administrators to verify policy effectiveness and identify potential security gaps without exposing the system to real unauthorized access attempts
Solution Approach 2:
Instead of testing with real access requests that could trigger actual access decisions, the system creates copies or simulations of principal contexts for testing purposes. These test contexts are applied to the authorization policy in a controlled manner, allowing verification of policy effectiveness without the harmful effects of actual unauthorized access attempts
3Speed
If authorization policies are applied at the requesting system, then access decisions can be made quickly, but policy enforcement may be inconsistent across distributed systems
Solution Approach 1:
The patent implements a universal authorization policy application mechanism at the target system that can handle all access decisions centrally. The same authorization policy is applied consistently across all access requests to the resource, regardless of which requesting system initiates the access. This universal approach ensures policy enforcement consistency while maintaining efficient access decision speed through centralized policy evaluation
Data Source
AI summary
A context of a principal is built, at a target system controlling access to a resource, independently of the principal requesting access to the resource. An authorization policy is applied, at the target system, to the context to determine whether the principal is permitted to access the resource, and an indication of whether the principal is permitted to access the resource is provided (e.g., to an administrator). Modifications can be made to the context and the authorization re-applied to determine whether a principal having the modified context is permitted to access the resource.