Application Control via Label-Based Operational Policy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data protection methods, such as firewalls and privileged account management, are inadequate in controlling operations on data elements, particularly in preventing unauthorized access and ensuring secure data handling across various applications and networks.
Innovation Solution
An operational policy is implemented to control application operations on data elements by analyzing application labels and data element labels, applying control actions such as restricting access or isolating hosts, to ensure secure data handling and prevent unauthorized operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewalls and privileged account management systems are used to control data access, then external access control is improved, but they are inadequate in controlling operations on data elements by application instances
Solution Approach 1:
The patent segments the control mechanism into two distinct label types: application labels that characterize the application instance (its uses, characteristics, metadata) and data element labels that characterize the data (its use, characteristics, operations). This segmentation allows independent analysis and control of application behavior and data properties, enabling fine-grained operation control that neither firewalls nor PAM systems provide.
Solution Approach 2:
The patent applies local quality by creating specific operational policies for each combination of application instance and data element based on their respective labels. Instead of uniform access control, the system tailors control actions to the specific characteristics of each application-data interaction, such as allowing read operations for certain applications while blocking write operations for others, based on label analysis.
2Ease of manufacture
If uniform access control policies are applied to all applications, then implementation simplicity is improved, but fine-grained control over specific application operations on data elements is lost
Solution Approach 1:
The patent creates a universal label-based framework that can control multiple aspects of application operations through a single mechanism. The same label analysis process handles read operations, write operations, delete operations, and other data manipulations uniformly. This universal approach maintains implementation simplicity while achieving fine-grained control across diverse operation types.
3Device complexity
If traditional access control mechanisms are used, then credential management is simplified, but they cannot prevent unauthorized operations by privileged accounts
Solution Approach 1:
The patent introduces an intermediary control layer between the application instance and the data element. Instead of relying solely on credentials at the application level, the label-based operational policy acts as a mediator that intercepts and controls specific operations on data elements. This intermediary mechanism prevents unauthorized operations even when privileged accounts are involved, by enforcing controls at the data access level rather than just at authentication level.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A method for controlling application operations on data elements includes identifying an activity by an instance of an application (215) running on a host (210) to perform an operation associated with a data element (225). The method further includes obtaining an application label (202) which includes information regarding the instance of the application (215), and obtaining a data element label (201) which includes information regarding the data element (225). Then, based on a combined analysis of the data element label (201) and the application label (202), an operational policy (205) governing the operation of the instance of the application (215) with respect to the data element (225) is determined. A control action is applied to the operation, according to the operational policy (205), so as to control the operation by the instance of the application (215) with respect to the data element (225).