My team is developing a new software system that is replacing several
existing applications.  The applications being replaced focus on billing and
customer relationship management.

Our company is an international corporation that serves a large number of
customers (hundreds of thousands) spread throughout the US and Canada.  For
administrative and accounting reasons, we have divided the customers into
groups based on geographic region (Eastern, Central, and Western US, Canada).
Customers are also grouped within their Region into Service Areas.

Our new system requires that authorization be performed based on both the
roles of the user (basic RBAC) and on the set of data that the user is
authorized to view and manipulate.

For example, a customer service rep for the West region of the country
should only be able to see and work with customers that are located in the
West region – to this user, the rest of our customers are irrelevant.  The
system should behave as though the only customers that exist are those
located in the region with which they work.

In addition, we need to set up non-geographic data filters, such as the
customer classification (similar to SIC code) and value fields such as
Salesperson.

The filtering of data must allow for both unions (“Or”) and intersections
(“And”) between different security settings; for instance, we must be able to
support the following overlapping sets of data filters:
1) All customers in the “East” region and all customers with the
classification “Hospital”
2) All “East Hospital” customers (but no Hospitals outside of the East
region or East customers that are not Hospitals)
3) All customers in either the “East” or “West” regions, regardless of
classification

We also need to support the concept of “Data Restrictions”, where the
default access to customers with a specific attribute is False unless a grant
is assigned.

We need a solution, whether it is a proven architectural approach or a
third-party technology, which will allow us to apply the defined data filters
at the lowest level of our application as possible with as little performance
impact as possible.  We would prefer to implement something in the database,
but if necessary we could implement it in the data access layer of our
software.

The solution should allow flexible definition of ‘securable attributes’ of a
customer, so that if an additional attributes are defined in the future we
don’t need to modify the database structure or recompile any code.

Questions:
1) Is there a standard or best-practice architectural approach to applying
the sort of security/filtering described above?
2) Are there any third-party tools or technologies that we could purchase
that would provide some or all of this functionality?
3) What sorts of approaches have been used before to address this type of
security requirement?

Thanks in advance,

Guy

<snip>
I've never seen a published solution pattern for this problem that has
attained anything near "standard" status.  Of course, one person's ignorance
of a such a beastie is no real evidence that it doesn't exist... <g>


Any third-party solution is likely to require considerably more effort to
integrate with your application than developing a solution from scratch,
particularly if you want to enforce the rules at the database level.  Unless
you have compelling reasons for wanting a "decoupled" solution (which would
likely have some hefty performance consequences), there's probably not much
point in considering this approach.


The set of potential approaches that would address your requirements
properly without imposing an undue performance burden is actually quite
small, but a full discussion would fall outside the scope of a newsgroup
post (at least for me, but nobody else seems to be leaping into the thread
either <g>).  Also, given the scope of project you describe, there really
ought to be someone on your team with relevant experience who would be as
capable of selecting an appropriate solution amongst this small candidate
set as anyone who might help you on this newsgroup.


Show quoteHide quote

RSA Encrypt/Decrypt Problems
User id of a running Windows form app
Appliyng Security in assembly.
Private member access.
does .NET connect to Internet to verify digitally signed assembly certificate?
ASP.NET roles, authentication
full trus and 1.1 SP1
Allow inheritable permissions form the parent to propagate...
Problems calling a Dll...
Mixed Security