Access Privilege Analysis for Securable Assets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computing systems face challenges in protecting sensitive data from unauthorized access, as compromised identities can lead to malicious actions and the increasing interconnectedness of networks complicates tracking and enforcing permissions across different domains.
Innovation Solution
The implementation of access privilege analysis techniques that identify and control indirect access paths to securable assets by generating signatures representing these assets and their access privileges, comparing them to access control entries to determine if a principal can obtain access privileges, and preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control lists are used to limit access to sensitive data files, then access control is implemented, but the system cannot detect indirect access paths through compromised identities
Solution Approach 1:
The system performs preliminary analysis of access paths before unauthorized access occurs. It proactively identifies indirect access routes by analyzing relationships between principals and securable assets, allowing security administrators to prevent malicious actions before they happen by blocking compromised identities upstream.
Solution Approach 2:
The patent introduces an intermediary access analysis system that sits between the principal and the securable asset. This intermediary component analyzes access requests, traces indirect access paths through relationship graphs, and determines whether access should be permitted based on the security posture of intermediate principals, rather than relying solely on direct ACL checks.
2Reliability
If identities are tracked across different networks and domains, then access control is enforced, but tracking and enforcing permissions becomes increasingly difficult
Solution Approach 1:
The system implements a universal access analysis framework that works across multiple networks and domains. It uses a standardized relationship graph model that can represent principals and securable assets from different domains, enabling consistent access path analysis and permission enforcement across heterogeneous environments without domain-specific complications.
Solution Approach 2:
The patent transforms the complex multi-domain tracking problem into a different dimensional space by using graph theory. Instead of tracking identities across domain boundaries directly, it represents principals, assets, and relationships as nodes and edges in a relationship graph, allowing indirect access paths to be detected through graph traversal algorithms regardless of domain boundaries.
3Object-affected harmful factors
If indirect access paths are identified and blocked, then security is enhanced, but the system complexity increases
Solution Approach 1:
The access analysis system is segmented into modular components: relationship graph construction, access path traversal, indirect access determination, and access control decision modules. Each component handles a specific aspect of the analysis, making the overall system more manageable and maintainable while effectively identifying and blocking indirect access paths to securable assets.
Data Source
AI summary
Techniques for access privilege analysis for a securable asset are described. According to various embodiments, a securable asset represents an object that is subject to access control. Generally, embodiments discussed herein can be employed to identify a principal that can be leveraged to obtain an access privilege to a securable asset, whether or not the principal is expressly granted an access privilege to the securable asset.