Use Case-Based Access Control System for Resource Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems are insufficient for effectively managing and auditing access to computer resources, as they rely on authentication credentials and authorization restrictions that are inefficient to administer and may not adequately protect private or confidential resources.
Innovation Solution
A computer system that uses qualifications and use cases to manage and audit access to computer resources, where users are authenticated and authorized based on their qualifications and the purpose of their access, with logging and reporting capabilities to track access and ensure compliance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication credentials and authorization restrictions are used to control access, then access protection is provided, but administrative efficiency deteriorates and large amounts of time and resources are required for management
Solution Approach 1:
The patent introduces an intermediary layer between authentication credentials and resource access. This intermediary evaluates use cases and qualifications to determine whether access should be granted, even when credentials are valid. The intermediary acts as a mediator that adds security without requiring complete reauthorization, thus maintaining access protection while reducing administrative burden for routine access scenarios.
Solution Approach 2:
The access control system is segmented into distinct components: authentication credentials, use case definitions, qualification requirements, and access decisions. This segmentation allows each component to be managed independently, improving administrative efficiency. Use cases can be defined once and reused across multiple resources, reducing the complexity of managing access controls individually for each resource.
2Ease of operation
If authentication credentials and authorization restrictions are used, then basic access control is achieved, but auditing and compliance tracking are insufficient
Solution Approach 1:
The system implements feedback mechanisms that automatically log and track access decisions based on use case evaluations. When a user presents credentials and a use case, the system records the evaluation results, qualification checks, and final access decisions. This feedback loop provides comprehensive audit information without adding manual tracking burden, as the system automatically captures and stores access audit data for compliance purposes.
3Reliability
If traditional authorization restrictions are implemented, then resource protection is provided, but dynamic and purpose-based access control is not achieved
Solution Approach 1:
The system transitions from static authorization restrictions to dynamic use case-based access control. Instead of fixed permission assignments, the system dynamically evaluates whether the user's credentials and the requested use case satisfy the resource's requirements. This dynamic approach maintains resource protection by enforcing qualification checks while providing flexibility for different access purposes and scenarios.
Solution Approach 2:
The system changes the parameters of access control from fixed user-resource permissions to variable use case qualifications. Access decisions are based on changing parameters including the user's credentials, the specific use case being requested, and the resource's qualification requirements. This parameter-based approach enables purpose-based access control while maintaining security through systematic evaluation of all relevant factors.
Data Source
AI summary
A system is described for controlling access to resources using an object model. Users can specify use cases for accessing resources. The user may be granted access if the user satisfies qualifications required for accessing the resource, selected a use case permissible for accessing the resource, and satisfies qualifications required for the use case. Use cases, qualifications, resources, and/or links between them can be implemented using an object model. The system can be used in addition to authentication and authorization.