Shared Data Asset Access Approval for Secure Auditable Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems are insufficient for protecting and auditing access to electronic data assets, particularly for sensitive information, as they lack mechanisms for designating, discovering, tracking, filtering, and revoking access to shared data assets, leading to inefficiencies and potential unauthorized modifications.
Innovation Solution
A computer system with technical mechanisms and interactive graphical user interfaces that enable designating data assets for sharing, tracking access requests, filtering shared data assets, and revoking access, using data objects to integrate governance and provide visibility, accountability, and time-bound permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication credentials and authorization restrictions are used to protect data assets, then security is improved, but administrative complexity and time consumption increase significantly
Solution Approach 1:
The patent introduces data asset objects as intermediaries that encapsulate metadata including authentication credentials and authorization restrictions. This object-oriented approach serves as a mediator between the complex security mechanisms and the users, allowing security policies to be managed through standardized object operations rather than direct configuration of individual security parameters, thereby reducing administrative complexity while maintaining security
2Reliability
If authentication credentials and authorization restrictions are used to protect data assets, then security is improved, but time consumption for access management increases
Solution Approach 1:
The patent implements preliminary action by pre-defining data asset objects with complete metadata including authentication credentials, authorization restrictions, and access policies before actual data access operations. This allows the system to perform security validations using pre-configured object parameters rather than requiring real-time security policy configuration, significantly reducing time consumption during access operations while maintaining security
3Ease of operation
If traditional authentication and authorization mechanisms are used, then access control is provided, but mechanisms for sharing, tracking, and revoking access to data assets are insufficient
Solution Approach 1:
The patent implements feedback mechanisms by incorporating tracking functionality within the data asset object framework. The system automatically tracks access requests, sharing operations, and permission changes through object metadata updates and version control. This provides continuous feedback on data asset access and sharing activities, enabling comprehensive auditing and monitoring while maintaining ease of operation through automated tracking rather than manual record-keeping
4Adaptability or versatility
If data assets are shared across organizations, then visibility and collaboration are improved, but security risks and administrative burdens increase
Solution Approach 1:
The patent applies local quality by allowing different security and sharing configurations for different data asset objects. Each data asset object can have its own metadata specifying authentication credentials, authorization restrictions, and sharing policies tailored to its specific security requirements and organizational context. This enables fine-grained control where highly sensitive assets can have strict access controls while less sensitive assets can be shared more freely, allowing versatile data sharing across organizations while maintaining appropriate security controls for each specific asset
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A computer system provides shared access to electronic data assets. The system may perform operations including: receiving, from a first user, a request to access a shared data asset, wherein: the shared data asset is associated with a shared data asset object, and the shared data asset object identifies at least a second user authorized to approve sharing of the shared data asset; in response to receiving the request from the first user: generating a data access request object including at least an identification of the first user and an identification of the shared data asset object; and providing an indication of the data access request object to a computing device associated with the second user, the second user associated with the shared data asset object; receiving, from the computing device of the second user, an approval of the request; and in response to receiving the approval of the request from the computing device associated with second user: granting the first user access to the shared data asset associated with the shared data asset object.