User Resource Grouping for Access Permission Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large organizations face difficulties in efficiently managing user access permissions across numerous resources and users, leading to unacceptably long query response times, redundant permissions, and inappropriate access, which impairs data security and productivity.
Innovation Solution
A method and system that group users and resources into clusters based on identical access permissions, allowing for quick ascription of permissions, utilizing user security groups and resource hierarchies to streamline access control and reduce redundant access permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If user access permissions are managed individually for each user-resource pair in large organizations, then access control precision is maintained, but query response time becomes unacceptably long and system complexity increases
Solution Approach 1:
The patent merges users with identical access permissions into user groups and resources with identical access patterns into resource groups. This consolidation reduces the number of individual permission checks from potentially millions of user-resource pairs to a manageable number of group-based permissions, dramatically improving query response time while maintaining access control precision.
Solution Approach 2:
The patent creates universal user groups that can be assigned to multiple resources and universal resource groups that can be accessed by multiple users. This multi-functional grouping approach allows a single group assignment to represent numerous individual permissions, reducing system complexity and improving query efficiency without sacrificing access control granularity.
2Productivity
If access permissions are assigned to each user individually for every resource, then precise access control is achieved, but redundant permissions accumulate and productivity decreases
Solution Approach 1:
The patent combines multiple individual user permissions into unified user group permissions and multiple resource access patterns into resource group permissions. This merging eliminates redundant permission assignments while preserving the exact same access control outcomes, thereby reducing the total quantity of permissions and improving management efficiency.
Solution Approach 2:
The patent identifies and discards redundant individual permission assignments by replacing them with group-based permissions. The redundancy is removed (discarded) while the essential access control functionality is recovered and maintained through the group membership mechanism, resulting in fewer total permissions and improved productivity.
3Reliability
If comprehensive access permission tracking is implemented across all users and resources, then data security is improved, but system complexity and query processing time increase
Solution Approach 1:
The patent merges individual user permissions into user group permissions and individual resource permissions into resource group permissions. This consolidation maintains comprehensive security tracking by preserving all access relationships within groups while reducing the computational overhead of permission queries, thereby improving response time without compromising data security.
Solution Approach 2:
The patent performs preliminary grouping of users and resources based on their access permission patterns before query processing. This pre-computation of group memberships and permission assignments allows the system to quickly resolve access queries by checking group memberships rather than evaluating individual permissions, reducing query response time while maintaining security integrity.
Data Source
AI summary
A method for ascertaining access permissions of users to computer resources on a storage unit, the method including grouping users into a plurality of user groups wherein all members of at least one of the user groups have at least nearly identical user/resource access permissions to the computer resources, grouping resources into a plurality of resource groups wherein all members of at least one of the resource groups have at least nearly identical resource/user access permissions, ascertaining whether a given user is a member of a user group, if the given user is a member of a user group, ascribing to the given user the user/resource access permissions of the user group, ascertaining whether a given resource is a member of a resource group, and if the given resource is a member of a resource group, ascribing to the given resource the resource/user access permissions of the resource group.