Data Access Logging Framework for Compliance and Performance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data access monitoring systems fail to effectively log and manage read and write accesses to ensure data confidentiality and integrity, particularly in compliance with diverse legal and privacy regulations, as they do not differentiate access levels based on data content rather than technical attributes.
Innovation Solution
A data access framework that characterizes and logs data accesses at multiple log points, identifying pre-specified attributes and values for logging, using configuration templates and rule sets to determine what to log, and asynchronously stores these values for reporting, while allowing selective logging and compliance with varying legal requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data access logging is implemented to monitor and log all read and write accesses for compliance and security purposes, then data security and regulatory compliance are improved, but system performance and processing speed deteriorate due to the overhead of logging operations
Solution Approach 1:
The patent segments the logging system into multiple independent components including log point interceptors, logging framework, buffer management, and asynchronous writing mechanisms. This segmentation allows logging operations to be performed independently without blocking main business logic, thus maintaining system performance while achieving comprehensive data access monitoring for security and compliance.
Solution Approach 2:
The patent introduces intermediary components such as log point interceptors and buffer layers between the data access operations and the final log storage. These intermediaries capture and buffer log data asynchronously, preventing logging overhead from directly impacting business transaction performance while ensuring complete logging coverage for security purposes.
2Measurement precision
If comprehensive data access logging is implemented to capture all access details for security monitoring, then detection precision of unauthorized access is improved, but device complexity increases due to configuration and management overhead
Solution Approach 1:
The patent creates a universal logging framework that can handle multiple types of data accesses (read, write, delete), various data types, and different log point scenarios through a single unified interface. This universal approach simplifies the system architecture while maintaining comprehensive monitoring capabilities, reducing complexity compared to implementing separate logging mechanisms for each access type.
Solution Approach 2:
The patent enables dynamic configuration of logging parameters such as log point selection, data fields to capture, buffer sizes, and filtering criteria. This parameter-based configuration allows the system to adapt to different security requirements and data sensitivity levels without requiring structural changes, thereby maintaining detection precision while managing system complexity through flexible parameter adjustment.
3Productivity
If selective logging based on data content classification is implemented to differentiate access levels, then logging efficiency is improved, but measurement precision of data classification deteriorates due to difficulty in deriving classification from technical attributes
Solution Approach 1:
The patent implements preliminary data classification and tagging mechanisms that categorize data by sensitivity levels and types before access operations occur. This preliminary action enables the logging system to pre-determine which accesses require detailed logging based on data classification, improving logging efficiency by avoiding unnecessary logging of non-sensitive data while maintaining accurate classification through pre-established data metadata and classification rules.
Data Source
AI summary
Data characterizing a plurality of data accesses of objects at one or more log points is received by a data access framework. Thereafter, data accesses requiring logging are identified and one or more corresponding pre-specified attributes are then logged. Related apparatus, systems, techniques and articles are also described.