Code-Based Data Access Control With Trusted Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As organizations grow, managing data access control becomes increasingly complex due to the rapid expansion of data and the number of entities needing access, especially when dealing with sensitive data, existing techniques struggle to provide granular and efficient access management.
Innovation Solution
Implementing a data access control system that isolates data processing applications within a trusted space, using a security boundary to enforce policies through a data access analysis module (DAAM) and isolation components, allowing administrators to define customized policies based on entity identity and data access requests, and execute data access operations within this trusted space.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional data access control methods are used to manage data access for multiple entities, then basic access control is provided, but the system complexity and administrative burden increase rapidly as the organization grows
Solution Approach 1:
The patent segments data access control into two distinct layers: (1) data source-level policies that define what data can be accessed and by whom, and (2) application-level code transformations that enforce these policies. This segmentation allows independent management of access rules and their enforcement mechanisms, reducing overall system complexity while maintaining flexibility.
Solution Approach 2:
The patent introduces code transformation as an intermediary layer between data sources and applications. This intermediary automatically transforms application code to enforce access policies without requiring direct administrative intervention for each access request, thereby reducing administrative burden while maintaining granular control.
2Reliability
If granular access control policies are implemented for each entity and data source, then data security is improved, but the administrative burden and time required to manage access control increases
Solution Approach 1:
The patent implements preliminary action by establishing data source policies in advance that pre-define access rules for different entities. When applications request data access, these pre-established policies are automatically applied through code transformation, eliminating the need for administrators to manually configure access control for each individual access request and significantly reducing administrative time.
Solution Approach 2:
The system enables self-service by allowing data sources to declare their own access policies and having the code transformation mechanism automatically enforce these policies. This automated self-enforcement mechanism maintains high data security through granular control while minimizing administrative intervention and time investment.
3Extent of automation
If code transformation is used to enforce access policies, then automated policy enforcement is achieved, but the data processing time and computational overhead increase
Solution Approach 1:
The patent replaces manual mechanical processes of access control enforcement with automated code transformation. Instead of administrators manually reviewing and approving each access request, or applications repeatedly checking access rights, the system automatically transforms application code at compile or load time to embed policy enforcement, eliminating runtime overhead while maintaining high automation.
Data Source
AI summary
Techniques for data access control in data processing applications are described. A portion of user code including a first data access directed to a data source is received from an application. An identity associated with the portion of user code is obtained. A policy including an access control rule that limits access to the data source based at least in part on the identity is obtained. Data access code is generated by evaluating at least a portion of code associated with the first data access. A permitted data access result that complies with the policy is obtained by evaluating the data access code. The permitted data access result is sent to the application.