Data Access Policy Enforcement in Secure Execution Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data protection methods fail to effectively control access and ensure privacy and security of data associated with individuals, particularly in scenarios where data is shared or accessed across different entities and systems, leading to potential breaches and compliance issues.
Innovation Solution
Implementing a system where data is stored with a user-defined data access policy that restricts access and is checked by a policy checker, allowing operations to be performed within a secure execution environment, ensuring that only authorized access and results are shared without exposing the data itself, and utilizing encryption and decentralized key management to maintain privacy and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored with encryption and access policies to improve security and privacy, then data protection is enhanced, but data accessibility and usability are reduced
Solution Approach 1:
The patent introduces a policy checker as an intermediary component that mediates between data access requests and encrypted data storage. The policy checker evaluates access requests against predefined policies without requiring decryption of the data, enabling controlled access while maintaining encryption. This resolves the contradiction by allowing selective accessibility through the intermediary layer while preserving security through encryption.
Solution Approach 2:
The patent segments data storage into encrypted data capsules that contain both the encrypted data and associated access policies. This segmentation allows the system to evaluate policies separately from decrypting data, enabling access control decisions to be made without compromising security. The segmentation of data and policy evaluation resolves the contradiction by permitting controlled access while maintaining encryption integrity.
2Reliability
If data access policies are enforced to improve privacy control, then compliance with privacy laws is enhanced, but system complexity increases
Solution Approach 1:
The patent implements preliminary action by embedding access policies directly within data capsules at the time of data storage. This allows access control rules to be predefined and attached to data before any access requests occur, enabling automated policy evaluation without requiring complex real-time negotiation or manual approval processes. The preliminary establishment of policies reduces system complexity while maintaining strong privacy control.
Solution Approach 2:
The policy checker operates autonomously to evaluate access requests against embedded policies without requiring external intervention or complex centralized authorization systems. Each data capsule independently contains its own access policies, enabling self-contained policy enforcement that reduces overall system complexity while maintaining comprehensive privacy control.
3Object-affected harmful factors
If encrypted data is stored with access policies to improve security, then breach risk is reduced, but data sharing capability is limited
Solution Approach 1:
The patent implements dynamic data sharing through configurable access policies that can be tailored to different sharing scenarios. Rather than using static all-or-nothing access control, the system allows policies to be dynamically adjusted based on the specific sharing context, such as specifying which users or systems can access particular data capsules under defined conditions. This dynamic approach reduces breach risk while maintaining flexible data sharing capability.
Solution Approach 2:
The data capsule structure with embedded policies provides universal applicability across multiple data sharing scenarios. The same encrypted data capsule can be shared with different entities under different policy conditions, enabling a single encryption mechanism to serve multiple sharing purposes. This multi-functionality reduces breach risk through consistent encryption while maintaining versatile data sharing capability across various contexts.
Data Source
AI summary
Methods and systems are disclosed. At a respective computing system, a request to run a program on first data stored within the respective computing system may be received. In some examples, the first data may be stored in association with a data access policy that defines access restrictions for the first data. In response to receiving the request, whether the request to run the program on the first data satisfies the access restrictions defined by the data access policy may be determined. In response to determining whether the request to run the program satisfies the access restrictions, in accordance with a determination that the access restrictions are satisfied, the program may be run, including performing one or more operations on the first data in an environment within the respective computing system, where a contents of the environment cannot be accessed from outside of the environment.