Weighted Index Tree for Context-Based Security Policy Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing context-based security policies, such as XACML, are limited in evaluating entitlements as they require explicit indexing of attributes, which restricts the ability to return meaningful results and are computationally inefficient.
Innovation Solution
A weighted index tree is used to evaluate context-based security policies, where attribute values are normalized, sorted, and assigned unique identifiers to generate a search tree that allows entitlements to be evaluated without explicit indexing, ensuring computationally-efficient policy evaluation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If explicit attribute indexing is used in context-based security policies, then policy evaluation can be performed, but the ability to return meaningful entitlement results is restricted and computational efficiency deteriorates
Solution Approach 1:
The patent segments the policy evaluation process into two distinct phases: an offline phase that builds a weighted index tree from the policy, and an online phase that uses the tree for efficient evaluation. This segmentation allows the complex policy to be pre-processed into a structured format that enables both efficiency and flexibility during actual evaluation.
Solution Approach 2:
The patent applies preliminary action by pre-processing the security policy to construct a weighted index tree before actual evaluation occurs. During this preliminary phase, attribute values are normalized, sorted by frequency, and organized into the tree structure. This advance preparation enables fast online evaluation without requiring explicit indexing during the evaluation process itself.
2Ease of operation
If only indexed attributes are used for entitlement evaluation, then computation is simplified, but meaningful entitlement results cannot be returned for unindexed attributes
Solution Approach 1:
The patent implements self-service by enabling the system to automatically handle attribute indexing through the weighted index tree structure. The tree is built once during policy normalization, and then it automatically handles queries for any attribute without requiring manual indexing configuration. The system serves itself by using the pre-built tree to answer entitlement queries for unindexed attributes as well.
Solution Approach 2:
The weighted index tree serves multiple functions: it enables efficient policy evaluation, supports queries for any attribute (not just explicitly indexed ones), and provides the basis for both authorization decisions and entitlement listings. This multi-functionality eliminates the need for separate indexing mechanisms for different evaluation purposes.
3Productivity
If traditional indexing methods are used, then attribute selection is straightforward, but computational complexity increases during policy evaluation
Solution Approach 1:
The patent applies parameter changes by transforming the policy representation from a flat list of rules to a weighted index tree structure. The tree organizes policy rules based on attribute value frequencies and hierarchical relationships, changing the structural parameters of the data to enable more efficient traversal during evaluation. This structural transformation reduces the computational complexity of evaluating policies.
Data Source
AI summary
A method, apparatus and computer program product for evaluating a context-based (e.g., XACML) policy having a set of attributes using a weighted index tree having one or more leaves extending from a root node. Each leaf of the tree represents a policy rule. A depth-first path down the leaf represents one or more attributes of the set of attributes that must be present in a request for the rule to be applicable. An input is evaluated against the weighted index tree to generate a response. One type of input is an authorization request, in which case the response is an authorization decision (e.g., permit or deny). Another type of input is a query for a set of entitlements, in which case the response is a set of entitlements.