Web Application Event Filter for Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional web applications lack explicit user authentication and security policies, often implementing access control redundantly by checking user permissions within the business logic, which can lead to inefficiencies and inadequate protection against unauthorized access.
Innovation Solution
A web server with a state machine controller that uses an event filter to consult a permission record to determine whether to permit or deny events, creating a security model that separates security logic from business logic and focuses on workflow, thereby preventing redundant checks and enhancing access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control is implemented within business logic with redundant checks, then user authentication and security policies can be enforced, but system complexity increases and processing efficiency decreases
Solution Approach 1:
The patent segments security functionality into a separate event filter component that operates independently from business logic. The filter intercepts events before they reach business logic layers, performing authentication and authorization checks in isolation. This segmentation prevents security code from being scattered throughout business logic, reducing overall system complexity while maintaining reliable access control enforcement.
Solution Approach 2:
The event filter acts as an intermediary component between external events and the business logic system. It mediates event processing by evaluating security policies and permitting or blocking events before they reach business logic handlers. This intermediary approach centralizes security enforcement, eliminating redundant checks across multiple business logic layers while ensuring comprehensive access control.
2Reliability
If multiple redundant permission checks are performed in business logic, then security coverage is improved, but processing time and computational resources are wasted
Solution Approach 1:
The event filter performs security evaluation as a preliminary action before events are processed by business logic. By conducting authentication and authorization checks upfront, the system prevents unauthorized events from entering the business logic processing pipeline. This preliminary security enforcement ensures comprehensive coverage while eliminating redundant checks that would otherwise occur repeatedly across multiple business logic layers.
Solution Approach 2:
The patent extracts security checking functionality from the business logic processing flow and places it in a dedicated event filter. This extraction removes redundant permission checks from the main event processing path, as the filter handles security evaluation once before events reach business logic. The result is maintained security coverage with improved processing efficiency, as events pass through the filter only once.
3Reliability
If security logic is integrated within business logic layers, then access control can be enforced at each processing stage, but the business logic becomes less focused and more difficult to maintain
Solution Approach 1:
The patent segments security logic into a separate event filter component, distinct from business logic layers. This segmentation allows business logic to remain focused on core processing functions without being burdened by security enforcement code. The filter independently handles authentication and authorization, ensuring reliable access control while improving business logic maintainability through clear separation of concerns.
Solution Approach 2:
The event filter serves as an intermediary that handles security enforcement separately from business logic processing. It mediates between external events and business logic handlers, performing all necessary authentication and authorization checks before events reach business logic. This intermediary approach ensures comprehensive access control enforcement while keeping business logic clean, focused, and easier to maintain.
Data Source
AI summary
A web application is described that is capable of assuming a plurality of states and being arranged to process a received event from among a predeterminable set of events to change from one state to another. A permission record defines a set of permitted or forbidden events and the web application comprises an event filter arranged to consult the permission record on receipt of an event in order to determine whether to permit or not permit the event to be processed. Related methods of access control and computer program products are also described.