Time-Invariant Access Control Lists for Distributed Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed computing environments, maintaining consistent and synchronized access control lists (ACLs) across multiple servers and clients is challenging, leading to potential unauthorized access to protected objects.
Innovation Solution
Implementing a time-invariant ACL written in terms of mutable groups with a monotonic property, which simplifies synchronization and allows for efficient propagation and enforcement of access control policies, enabling the use of various access control models concurrently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional ACL synchronization methods are used in distributed systems, then access control can be enforced, but complex synchronization logic is required to maintain consistency across multiple servers and clients
Solution Approach 1:
The patent changes the temporal parameter of ACLs from dynamic/time-variant to static/time-invariant. By making ACLs time-invariant and associating them with monotonically increasing group memberships, the system eliminates the need for complex synchronization logic while maintaining access control consistency across distributed systems.
Solution Approach 2:
The patent establishes ACLs and group memberships in advance with predetermined monotonic properties. By pre-defining that group memberships only increase monotonically, the system eliminates the need for complex real-time synchronization during operation, as the monotonic property inherently prevents conflicts.
2Reliability
If ACLs are synchronized across distributed systems, then unauthorized access can be prevented, but the synchronization process becomes difficult and error-prone
Solution Approach 1:
The patent transforms the synchronization problem by changing the temporal parameter of ACLs to time-invariant and associating them with monotonically increasing group memberships. This parameter change makes synchronization trivial, as the monotonic property ensures that once an ACL is propagated, it remains valid without requiring further synchronization.
Solution Approach 2:
The patent extracts the synchronization problem from the ACL enforcement mechanism. By separating the ACL definition (time-invariant) from the group membership changes (monotonic), the system eliminates complex synchronization logic while maintaining security.
3Adaptability or versatility
If group membership changes frequently, then access control can be flexible, but synchronization issues and consensus problems arise in distributed systems
Solution Approach 1:
The patent introduces controlled dynamics through monotonically increasing group memberships. While ACLs themselves remain static (time-invariant), group memberships can change in a controlled monotonic manner, providing flexibility without triggering complex synchronization issues.
Solution Approach 2:
The patent changes the behavioral parameter of group memberships from arbitrary changes to monotonic increases. This parameter change allows flexibility in access control while eliminating synchronization complexity, as monotonic changes inherently avoid conflicts in distributed systems.
Data Source
AI summary
Methods and systems for controlling access to objects of a distributed computing environment are described. In one configuration, a computing device receives a request from a principal to access a protected object and evaluating the transitive closure of the list of group identifiers. The protected object is associated with an access control list and has a time-invariant list of group identifiers. The list of group identifiers includes the access list is associated with the protected object to identify at least one principal authorized to access the protected object.