Tiered Authorization Server Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional data access systems rely solely on credential verification, which can lead to exposure of unintended data and lack dynamic control over access based on data type, service type, or user attributes, failing to respond quickly to changing access requests.
Innovation Solution
A tiered authorization arrangement involving an authorization server, enterprise servers, and endpoint devices that generates and distributes rule sets based on policies, allowing for dynamic control of access decisions based on attributes, activities, and time, enabling efficient and timely access management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional credential verification is used for data access, then the system is simple to operate, but the system cannot dynamically control access based on data type, service type, or user attributes
Solution Approach 1:
The authorization system is segmented into multiple independent components: an authorization server that generates rule sets, enterprise servers that enforce rules, and attribute stores that provide contextual information. This segmentation allows each component to specialize in specific functions, enabling dynamic access control without requiring the entire system to be complex.
Solution Approach 2:
The patent introduces an authorization server as an intermediary between the enterprise server and endpoint devices. This intermediary generates and distributes rule sets based on policies, acting as a mediator that enables dynamic access control decisions without requiring the enterprise server itself to be complex.
2Speed
If centralized credential verification is used, then the system is easy to manage, but the system cannot respond quickly to changing access requests
Solution Approach 1:
The authorization server generates rule sets in advance based on policies and distributes them to enterprise servers before access requests occur. This preliminary action allows enterprise servers to make immediate access decisions using pre-computed rules, significantly reducing response time for changing access requests.
Solution Approach 2:
The patent combines centralized policy management with distributed rule enforcement. The authorization server centrally manages policy updates, while enterprise servers locally enforce rules, merging the benefits of centralized control with the speed of distributed decision-making.
3Adaptability or versatility
If the central server has limited information, then the system is simple to implement, but the system cannot make comprehensive access decisions
Solution Approach 1:
The authorization server is designed as a universal component that can evaluate multiple types of attributes (user attributes, device attributes, data attributes, service attributes) and generate comprehensive rule sets. This multi-functional capability allows the system to make informed access decisions without requiring each server to be specialized.
Solution Approach 2:
The system implements feedback loops where the authorization server receives policy updates and attribute information, generates appropriate rule sets, distributes them to enterprise servers, and can update rules based on observed events and activities. This feedback mechanism enables comprehensive access decisions through continuous information gathering and adaptation.
Data Source
AI summary
Systems and techniques are provided for authorizing restricted action (e.g., data access) requests using a tiered arrangement. A rule set is generated based on a policy received by an authorization server and is transmitted to a broker associated with an enterprise server. A restricted action request is received by an agent associated with the enterprise server and is provided to the broker associated with the enterprise server. The broker analyzes the request in view of the rule set and determines if the restricted action request should be granted or denied. The policy and/or rule set are updated based on activities and/or events within the system and a new rule set is generated based on the updated policy.