URI Permission Graphs for Granular Role-Based Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current communication systems provide limited role-based access control, leading to unintended access to restricted resources, necessitating more granular and precise access management.
Innovation Solution
A role-based access control (RBAC) system that analyzes Uniform Resource Identifiers (URIs) to classify permissions, generates a permission graph at runtime, and dynamically updates it to manage access to resources, allowing for customizable roles and permissions based on user identities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If limited types of roles are provided in current communication systems, then the system complexity is reduced, but the precision of access control deteriorates leading to unintended access to restricted resources
Solution Approach 1:
The patent segments the access control system into multiple independent components: URI analyzing component that classifies Uniform Resource Identifiers into permissions, identity identifying component that determines user identities, permission graph generating component that creates runtime permission graphs, and request authorizing component that traverses the graph to authorize requests. This segmentation enables precise access control by analyzing each request's URI, identity, and associated permissions independently, while managing complexity through modular design where each component handles a specific aspect of the authorization process.
2Measurement precision
If granular and precise role-based access control is implemented, then the precision of access control is improved, but the device complexity increases
Solution Approach 1:
The patent implements dynamic permission management through a runtime permission graph that is generated and updated based on current requests and user identities. The system dynamically analyzes URIs to classify permissions, identifies user identities, generates permission graphs at runtime, and traverses these graphs to authorize requests. This dynamic approach enables granular access control where permissions are determined based on the specific request context rather than static role assignments, allowing the system to adapt to different scenarios without requiring complex pre-defined role hierarchies.
3Reliability
If traditional role-based access control is used, then the ease of operation is maintained, but the reliability of access control deteriorates due to unintended access
Solution Approach 1:
The patent implements a feedback mechanism where the system analyzes the URI of each access request, identifies the user identity, generates a permission graph based on the classified permissions, traverses the graph to determine authorization, and then authorizes or denies the request based on this analysis. This closed-loop feedback process ensures that each access request is evaluated against the specific permissions associated with the URI and user identity, providing reliable access control by continuously verifying authorization based on current system state and request context.
Data Source
AI summary
A role-based access control method and system provide for receiving a request to provide access to a resource, identifying an identity associated with the request, classifying the URI into a permission that allows access to the resource, generating a graph representing the one or more granted permissions, and authorizing the request including traversing the graph to determine that the first permission is included in the one or more granted permissions.