Context-Based Access Control for Enterprise Cloud Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern data storage systems in enterprise cloud environments face security risks due to their inability to account for context-associated access controls, resulting in an all-or-nothing approach that exposes data to additional risks.
Innovation Solution
A computer-implemented method for context-based rule evaluation that receives client device requests, identifies applicable rules, and determines actions based on evaluations of resource and device attributes, including geographical location, trust status, and metadata, to provide dynamic access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard access control techniques (encryption, password protection, file permissions) are used, then basic security is provided, but the system fails to account for context associated with users and operations, resulting in an all-or-nothing approach that exposes data to additional risks
Solution Approach 1:
The patent implements dynamic access control by evaluating multiple contextual attributes (user identity, device characteristics, location, time, resource sensitivity) in real-time to determine access permissions. Instead of static all-or-nothing permissions, the system dynamically adjusts access levels based on the specific context of each access request, making the security system adaptable to different situations while maintaining reliability.
Solution Approach 2:
The system changes security parameters dynamically by evaluating multiple attributes (user role, device trust level, geographic location, time of access, resource classification) and adjusting access permissions accordingly. This allows the system to transition from fixed permissions to flexible, context-dependent permissions, resolving the contradiction between reliability and adaptability.
2Reliability
If context-based rule evaluation with multiple attributes is implemented, then data security is enhanced through dynamic access control, but system complexity increases due to multiple rule evaluations and attribute assessments
Solution Approach 1:
The patent segments the access control system into distinct modular components: attribute collection modules, rule evaluation modules, and decision modules. Each component handles specific aspects of the access control process independently, making the complex system manageable and maintainable while still providing comprehensive context-based security.
Solution Approach 2:
The system introduces an intermediary access control module that sits between the user and the protected resources. This intermediary evaluates contextual attributes and applies security rules without requiring changes to the underlying storage system or user applications, thereby enhancing security while managing complexity through a dedicated intermediary layer.
3Productivity
If multiple rules are evaluated with batching calls to external services, then evaluation efficiency is improved, but the system requires coordination of multiple information retrieval operations
Solution Approach 1:
The patent merges multiple separate information retrieval operations into a single batched call to external services. Instead of making individual requests for each attribute (user profile, device information, resource metadata), the system combines these requests into one coordinated batch operation, improving evaluation efficiency while managing the complexity of coordination through unified batch processing.
Data Source
AI summary
Systems and corresponding computer-implemented methods for context-based rule evaluation in an electronic data storage system are described. A request to perform an operation with respect to a resource is received from a client device, with the request including various attributes associated with the client device. At least one set of rules applicable to the operation is identified. The rules can be formed from a combination of primitives arranged to dynamically evaluate attributes associated with the resource and attributes associated with the client device. Based on the evaluation of the rule set(s), an action is identified to be performed with respect to the resource.