Access Control via Organization Chart and User History
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional file access control methods require manual setting of access classes and privileges, are inefficient in handling non-textual content, and lack the ability to track dynamic user behaviors, leading to unnecessary access denials and processing overhead.
Innovation Solution
Implement a system that controls access based on users' previous access patterns and organizational hierarchies, granting or denying access based on the security classification of the requesting user without opening or reading file content, using an access control server that maintains organization charts and access logs to make decisions dynamically.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional DLP software scans the actual content within files to identify sensitive data, then security detection accuracy is improved, but processing time and computational resources increase significantly
Solution Approach 1:
The system performs preliminary classification by examining file metadata, headers, and structural properties before conducting full content scanning. This preliminary action filters out files that clearly don't contain sensitive data, reducing the need for exhaustive content scanning and thereby decreasing processing time while maintaining security detection accuracy for files that do require deep inspection.
Solution Approach 2:
The invention extracts and analyzes only the critical portions of files that are most likely to contain sensitive data indicators, such as file headers, metadata sections, and structured data fields. By taking out and focusing analysis on these specific extracted elements rather than scanning entire file contents, the system achieves accurate security detection with significantly reduced processing time.
2Manufacturing precision
If access control policies are manually set to specific values to ensure security, then security control precision is improved, but adaptability to dynamic user behaviors and situations deteriorates
Solution Approach 1:
The system transforms static, manually-configured access control policies into dynamic policies that automatically adjust based on real-time analysis of user behavior patterns, file access contexts, and organizational hierarchy changes. The access control decisions are no longer fixed but adapt dynamically to current situations, maintaining security precision while gaining flexibility to respond to evolving user behaviors and threats.
Solution Approach 2:
The invention implements feedback mechanisms where access control decisions are continuously refined based on observed user behavior patterns and access outcomes. The system monitors access attempts, analyzes patterns, and uses this feedback to automatically adjust access policies, ensuring that security control precision is maintained or improved while the system becomes increasingly adaptable to dynamic user behaviors and organizational changes.
3Productivity
If access control decisions are made without opening files and reading their content, then processing efficiency is improved, but the ability to detect sensitive data formats deteriorates
Solution Approach 1:
The system extracts and analyzes specific indicators from file metadata, headers, and structural properties without opening or reading the actual file content. By taking out these diagnostic elements that contain sensitive data format information, the system achieves detection capability comparable to full content scanning while maintaining high processing efficiency.
Solution Approach 2:
The invention replaces the mechanical process of opening and reading entire file contents with a more efficient analytical approach that examines file metadata, headers, and structural properties. This substitution maintains the ability to detect sensitive data formats by analyzing these surrogate indicators, achieving both high processing efficiency and accurate detection without the computational overhead of full content scanning.
Data Source
AI summary
Improved techniques involve controlling access to data based on who has previously accessed the data. For example, when a user submits a request to access a resource, a list of those users who have accessed the resource is generated. Identifiers associated with the requesting user and the accessing users from the list of users are located within an organization chart which contains information about the hierarchal level and department to which users within the organization belong. As an example, if the requesting user is an executive-level employee and the accessing users are also executive-level users, then access to the resource is granted. If, on the other hand, the requesting user is on the level of an individual contributor, or a contractor, then access to the resource is denied. Further, access requests can be recorded in the access log for tracking.