User Entitlement Management System for Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current user permission systems are overly granular, difficult to navigate, and lack a method to quickly search sensitive information for assessing and changing user permissions, leading to potential security breaches.
Innovation Solution
A user entitlement management system with a user interface that improves user entitlement management by allowing explicit user or user group access control, providing an audit trail for permission changes, and enabling quick reversal of permission changes based on a single point-in-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard file system permission controls are used, then user access control is provided, but the system becomes overly granular and difficult to navigate
Solution Approach 1:
The patent segments permission management into two distinct layers: (1) File system level permissions that control basic access, and (2) Application level entitlements that provide high-level policy control. This segmentation allows the system to maintain both granular control where needed and simplified management through user groups and policies, resolving the contradiction between reliable access control and ease of operation.
Solution Approach 2:
The patent introduces an intermediary entitlement management layer between the user and the file system. This intermediary component translates high-level entitlement policies into specific file system permissions, shielding users from the complexity of granular permission settings while maintaining security. The intermediary handles the complexity of permission mapping and provides a simplified interface for permission management.
2Reliability
If detailed permission tracking is implemented, then security monitoring is improved, but the system lacks quick search and assessment capabilities
Solution Approach 1:
The patent implements preliminary action by maintaining pre-computed indexes of entitlement assignments and permission states. Before any security assessment is needed, the system has already organized and indexed all permission data in a query-optimized structure. This allows rapid search and assessment of user permissions without requiring time-consuming traversal of the entire permission hierarchy, thus resolving the contradiction between detailed tracking and quick assessment.
3Reliability
If comprehensive user permission control is implemented, then security against data exposure is improved, but the system lacks audit trail and reversal capabilities
Solution Approach 1:
The patent implements feedback mechanisms that continuously record and report permission changes. Every entitlement modification is logged with details including who made the change, what was changed, and when. This feedback loop provides both security monitoring and audit trail capabilities, allowing the system to maintain comprehensive control while providing complete visibility into permission history for security assessment and reversal operations.
Data Source
AI summary
Provided herein are methods for remotely managing user permissions through computing device comprising an index server in communication with a user interface executing on a second computing device and file server(s) comprising data objects wherein the file server is a third computing device different from the first and second computing devices. The index server comprises data structures containing information on user permission access to data objects that are stored on the index server. The index server communicates with the user interface to receive instructions for changes to user permission access levels and accesses its data structures and/or change logs to respond to such communications. The index server also communicates with the file server to execute the changes to the user permission access level for a user associated with a data object at the local level.