Unified Authorization Policy Aggregation for Multi-Tier Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multi-tier applications face challenges in coordinating access control across different layers due to differences in technologies, languages, and storage locations, leading to inconsistencies and security holes as they often simplify access control specification and enforcement at only one layer.
Innovation Solution
A method and system for aggregating role-based authorization rules into a unified policy across both the persistence and logic layers, transforming these rules into permissions for the persistence and logic layers, and applying them through policy decision points, ensuring consistent access control across all layers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If different languages and tools are used for specifying access control policies at different layers, then each layer can be independently managed, but inconsistencies and security holes arise in authorization rules
Solution Approach 1:
The patent implements a universal authorization framework where a single authorization rule specification serves multiple layers (logic layer and persistence layer) simultaneously. The system uses a common authorization rule language that can be interpreted across different technological stacks, allowing one rule set to enforce security policies throughout the entire multi-tier application architecture, thereby eliminating inconsistencies while maintaining layer independence.
2Ease of operation
If access control policies are simplified and enforced at only one layer, then management becomes easier, but other layers remain unprotected creating security vulnerabilities
Solution Approach 1:
The patent segments the enforcement of authorization rules across multiple layers while maintaining centralized rule management. Each layer (logic layer, persistence layer) has its own policy enforcement point that independently evaluates authorization decisions based on the same unified rule set. This segmentation allows simple centralized rule definition while providing distributed security protection at every layer, preventing security vulnerabilities from single-point enforcement.
3Adaptability or versatility
If authorization rules are stored in different locations with different languages, then each layer can use its native tools, but coordination and consistency become challenging
Solution Approach 1:
The patent introduces an intermediary authorization rule translation and coordination mechanism that sits between different layer implementations. This intermediary component translates the unified authorization rules into layer-specific formats and coordinates policy enforcement across layers. It acts as a mediator that enables each layer to use its native tools and languages while maintaining consistent authorization behavior through centralized rule management and automatic translation.
Data Source
AI summary
Embodiments of the present invention provide a method, system and computer program product for aggregating database and component logic authorization rules in a multi-tier application. In an embodiment of the invention, a method for aggregating database and component logic authorization rules in a multi-tier application system can include aggregating role-based authorization rules for both a persistence layer and a logic layer of a multi-tier application in a unified policy, distributing the unified policy to both the persistence layer and the logic layer of the multi-tier application, transforming the unified policy into respectively a set of role based permissions for the persistence layer and a set of role based permissions for the logic layer, and applying the set of role based permissions for the persistence layer in the persistence layer, and the set of role based permissions for the logic layer in the logic layer of the multi-tier application.