Boundary Labels for Edge Data Access Across Security Boundaries

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Edge computing environments face challenges in securing data access due to the lack of well-defined perimeters, increasing sophistication of information security threats, and the need for real-time data access, while traditional centralized control methods are impractical and inefficient.

Innovation Solution

Implementing data boundaries through boundary labels that are attached to data, using metadata to control data flow based on roles, context, and affiliations, and employing a data access intermediary service to manage data access permissions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional centralized control methods are used to manage data access, then data security can be maintained, but system complexity and impracticality increase in edge computing environments

Engineering Contradiction:

Improvedata securityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments data access control into distributed boundary labels attached to individual data objects rather than centralized control. Each data object carries its own boundary label with access control metadata, enabling decentralized security enforcement across edge computing nodes while maintaining reliability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The boundary label acts as an intermediary between data objects and access control policies. It mediates access decisions by containing metadata that defines boundary conditions, allowing edge nodes to autonomously evaluate and enforce security without complex centralized coordination.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If boundary labels with comprehensive access control metadata are attached to data, then data access control precision is improved, but data processing overhead increases

Engineering Contradiction:

Improveaccess control precisionVSAvoidprocessing overhead

Core Design Contradiction:

Measurement precisionVSLoss of energy

Solution Approach 1:

The boundary label includes only the necessary access control metadata required for enforcement at edge nodes, avoiding excessive information storage. The label contains minimal but sufficient boundary conditions and access control policies to enable precise control without unnecessary processing overhead.

Inventive Principle:

Principle #16Partial or excessive action

3Productivity

If real-time data access is enabled in edge computing, then productivity is improved, but data leakage risk increases

Engineering Contradiction:

Improvedata access speedVSAvoiddata leakage risk

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

Boundary labels are pre-attached to data objects with embedded access control metadata and boundary conditions before data is made available in edge computing environments. This preliminary action enables real-time access while automatically preventing leakage by evaluating boundary conditions at the time of access requests.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12483889B2Methods, apparatus and systems to enforce data boundaries through the use of boundary labels

Publication Date: 2025.11.25 INTEL CORP

AI summary

An apparatus of an edge gateway disclosed herein includes an access evaluator to determine whether a data access attempt, if permitted, will cause data specified in the data access attempt to cross a data boundary, the data boundary associated with at least one condition to be met before the data specified in the data access attempt will be permitted to cross the boundary. The apparatus further includes an operations determiner to determine an operation to be applied to the data for which access is being attempted, in response to determining the data access attempt will cause the data to cross the data boundary, and an operation applier to apply the operation to the data. The application of the operation to the data causes the condition to be met, so that the data access occurs in conformance with the condition.