Application Access Control Using Compliance Status for Sensitive Data

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing technologies struggle to efficiently control access to sensitive data in large cloud environments, relying solely on sensitivity labels or roles, which are not always checked or adhered to by applications, and lack scalability and responsiveness to application changes.

Innovation Solution

An access control approach that considers both resource and application characteristics, using an identity service to determine compliance and authorization status, and responds dynamically to changes in application behavior, leveraging existing tools for efficient scaling and real-time compliance management.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If traditional sensitivity labels or roles are used for access control, then implementation is simple, but they are not always checked or adhered to by applications and lack scalability

Engineering Contradiction:

Improveease of implementationVSAvoidcompliance adherence

Core Design Contradiction:

Ease of manufactureVSReliability

Solution Approach 1:

The patent introduces an identity service as an intermediary between applications and resources. This service mediates access requests by evaluating both authorization credentials (traditional roles/labels) and application compliance status, ensuring that applications must adhere to compliance requirements while maintaining the simplicity of traditional access control mechanisms.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of manufacture

If traditional sensitivity labels or roles are used for access control, then implementation is simple, but they lack scalability in large cloud environments

Engineering Contradiction:

Improveease of implementationVSAvoidscalability

Core Design Contradiction:

Ease of manufactureVSAdaptability or versatility

Solution Approach 1:

The identity service provides multiple functions within a single system: it manages traditional authorization credentials (roles, sensitivity labels), evaluates application compliance status, and makes access decisions. This multi-functional approach maintains the simplicity of traditional methods while adding scalability and adaptability for large cloud environments with numerous applications.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Speed

If access control only checks authorization credentials, then the process is fast, but it cannot detect unauthorized access by malicious applications

Engineering Contradiction:

Improveaccess control speedVSAvoidsecurity detection capability

Core Design Contradiction:

SpeedVSReliability

Solution Approach 1:

The system performs preliminary evaluation of application compliance status before granting access. The identity service assesses whether applications meet required compliance criteria (such as security configurations, authentication methods) in advance, so that when access requests are made, both authorization credentials and compliance status are already verified, maintaining speed while enhancing security detection.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback mechanisms where the identity service continuously monitors application compliance status and adjusts access decisions accordingly. When compliance status changes (e.g., an application becomes non-compliant), the system receives feedback and responds by modifying access permissions, ensuring that security detection remains effective without significantly impacting access control speed.

Inventive Principle:

Principle #23Feedback

4Reliability

If comprehensive access control checking is implemented, then security is improved, but system complexity increases

Engineering Contradiction:

ImprovesecurityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent merges traditional authorization credential verification with application compliance status evaluation into a single unified process within the identity service. Instead of implementing separate complex systems for each function, the identity service combines multiple access control checks into one integrated mechanism, improving security while managing system complexity through consolidation.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS12536319B2Controlling application access to sensitive data

Publication Date: 2026.01.27 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Some embodiments control access by applications to resources in a computing environment. An embodiment notes a request from an application to access a resource, determines a compliance status of the application based on access control policy compliance criteria, ascertains an authorization status of the request based on an authorization credential of the request and an authorization requirement of the resource, and responds to the request based on the compliance status and also based on the authorization status, thereby providing fine-grained access control. Access may also be controlled based on a request's beneficiary. An access request response may allow access, deny access, or ask for additional authorization. A compliance classifier reduces risk by dynamically updating compliance status after compliance criteria changes or attribute changes. An identity service access control architecture uses a compliance attribute to improve efficiency. Applications may be access control grouped according to resource sensitivity labels.