Web Services Access Control System Granularity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for managing access control in web services lack sophistication, particularly in distinguishing access privileges at finer granularities, such as the level of individual web services resources, leading to performance issues in large-scale implementations due to the complexity of access control data management.
Innovation Solution
A system and method for controlling access to web services resources, which includes a storage medium and processors to implement a web services access control system that determines whether access control entries exist for specific resources and principals, denying requests if sufficient access privileges are not found, and uses a distributed storage system to replicate and distribute access control information across multiple sites for improved performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If access control is implemented at domain level with simple authentication, then implementation is easy, but access control granularity is insufficient
Solution Approach 1:
The patent segments access control from domain-level authentication to resource-level authorization by introducing access control lists (ACLs) that operate at the individual resource or object level within a domain. This allows fine-grained control over which principals can access specific resources, while maintaining the simplicity of domain-level authentication as the entry point.
Solution Approach 2:
The patent adds a new dimension to access control by introducing an authorization layer above the existing authentication layer. Instead of only controlling access at the domain level (one dimension), the system now controls access at multiple levels: domain authentication plus resource-level authorization through ACLs, enabling both simplicity and granularity simultaneously.
2Manufacturing precision
If access control data is stored centrally for fine-grained control, then access control granularity is improved, but system performance deteriorates due to data management complexity
Solution Approach 1:
The patent implements local quality by distributing access control data storage across multiple locations or systems rather than requiring a single centralized repository. Each resource or domain can maintain its own access control information locally, reducing the performance burden on any single system while still enabling fine-grained access control decisions at each location.
Solution Approach 2:
The patent applies preliminary action by pre-computing and caching access control decisions or maintaining access control information in readily accessible formats before access requests occur. This allows the system to quickly evaluate access control rules without performing complex data management operations in real-time, thus maintaining both granularity and performance.
3Reliability
If access control checks are performed for every request, then security is improved, but processing time increases
Solution Approach 1:
The patent implements preliminary action by performing access control evaluations in advance or maintaining pre-computed access control information that can be quickly referenced during request processing. This reduces the time penalty of security checks while maintaining rigorous access control validation for every request.
Solution Approach 2:
The patent applies partial action by implementing access control checks selectively based on the nature of the request, the resource being accessed, or the principal's trust level. Not all requests require full access control validation, allowing the system to maintain security for critical resources while reducing processing overhead for less sensitive operations.
Data Source
AI summary
A system and method for controlling access to web services resources. A system may include a storage medium configured to store instructions and one or more processors configured to access the storage medium. The instructions may be executable by at least one of the processors to implement a web services access control system (ACS) configured to receive requests. Each request specifies an access operation to be performed with respect to a corresponding resource. Each of the requests is associated with a corresponding principal. For each received request, the ACS may be further configured to determine whether an access control entry exists that is associated with both the resource and principal associated with the request and that specifies an access type sufficient to perform the access operation. If no such entry exists, the ACS may deny the request.