A Decoupled Access Control Framework for Secure and Scalable PLM Systems in Industry 4.0

In the current Industrial Internet of Things (IIoT) environment, data security for product lifecycle management is greatly challenged, particularly in scenarios involving vertical multi-level Bill of Materials (BOM) deep nesting and lifecycle dynamic evolution. The traditional case-bounding model, in large-scale deployment, easily leads to rule expansion and an increase in database I/O overhead, thus causing authorization lag, authority boundary ambiguity and other problems. To address these limitations, this paper proposes a Decoupled Hybrid Access Resolution (DHAR) framework. The framework separates static organizational roles from dynamic lifecycle constraints, and the complexity of authorization configuration is reconstructed from case-dependent growth into an object-instance-independent bounded structure; combined with the state-based pre-filtering mechanism and memory cache strategy, redundant recursive query is reduced. Experiments on increasing BOM depths show that, under a 20-layer topology, DHAR reduces average access latency from 285.8 ms to 1.3 ms. Under a 20-layer BOM with 1000 concurrent requests, DHAR maintains an average latency of 5.2 ms, while compressing the authorization rule set from millions to hundreds. These results indicate that, within the studied vertical multi-level BOM setting, DHAR improves response performance while preserving data consistency and strengthening protection against unauthorized modification.