Task-Based Access Control via Proxy Objects
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualization environments, administrators face challenges in accurately granting access permissions due to the object-centric permissions model, where users are assigned roles that group many privileges, making it difficult to predict and manage the exact privileges needed for specific tasks, especially in complex inheritance structures.
Innovation Solution
A task-based access control system that uses proxy task objects, encapsulating privileges and objects to perform tasks, allowing administrators to assign necessary privileges for specific activities, enabling precise permission management without altering the existing role-based system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If users are assigned roles that group many privileges, then users can perform multiple activities, but it becomes difficult to predict and manage the exact privileges needed for specific tasks
Solution Approach 1:
The patent segments the monolithic role-based permission system into task-specific permission sets. Each task is defined with its own required privileges, creating granular, task-oriented permission units that can be independently assigned to users, thereby reducing the complexity of predicting and managing privileges for specific tasks.
Solution Approach 2:
The patent introduces task definitions as intermediary objects between users and privileges. These task definitions serve as mediators that explicitly declare which privileges are needed for which tasks, making the permission requirements transparent and manageable without altering the underlying role-based system.
2Measurement precision
If administrators define detailed task-specific permissions, then precise access control is achieved, but the permission management system becomes more complex
Solution Approach 1:
The patent creates simplified copies or representations of task permissions through task definitions. These task definitions capture the essential privilege requirements without replicating the full complexity of the underlying privilege hierarchy, making permission management more accessible while maintaining precision.
Solution Approach 2:
The patent creates universal task definition templates that can be reused across multiple users and contexts. A single task definition can be instantiated multiple times with different users, reducing the overall system complexity while maintaining precise permission control for each instantiation.
3Adaptability or versatility
If roles group large sets of privileges, then users can perform various activities, but it is difficult to understand exactly what permissions a user has at any time
Solution Approach 1:
The patent segments the aggregated role permissions into discrete task-level permission declarations. Each task definition explicitly lists the privileges required, making it clear and traceable what permissions a user has by examining which tasks they are assigned to, rather than analyzing complex role hierarchies.
Solution Approach 2:
The patent implements a feedback mechanism where task definitions provide explicit information about privilege requirements. This feedback loop allows administrators to clearly see what permissions users have access to through their task assignments, improving permission transparency without limiting user activity ranges.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
Methods, systems, and techniques for task-based access control are provided. Example embodiments provide a task-based access control system "TBACS," which provides task-based permissions management using proxy task objects. In one example embodiment, the proxy task objects encapsulate activities, comprising one or more privileges, each associated with an object upon which the privilege can act. In some examples, proxy task objects may be used with a virtualization infrastructure to delegate permissions to delegate users, real or automated. Proxy task objects may also be associated with their own user interfaces for performance of the corresponding activities.