Data Platform Segmentation for Non-Inherited Security Constraints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data security approaches in data platforms lack well-defined implementation details, particularly in enforcing different security policies across segments, propagating constraints inconsistently, and failing to address conjunctive and disjunctive constraints effectively.
Innovation Solution
Implementing data security controls within a data platform by defining constraints and classification levels at the segment level, insulating these from inheritance by resources, and controlling resource ingestion based on these constraints, including maximum classification levels, mirrored user constraints, and category-specific dissemination and release controls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data security controls are implemented at the resource level, then data governance can be enforced, but the constraints cannot be effectively propagated to individual segments or portions of the data platform
Solution Approach 1:
The patent applies segmentation by introducing segment-level constraints that independently control security policies for specific portions of the data platform. Each segment can have its own maximum classification level and constraint settings, allowing differentiated security enforcement without requiring complex resource-level propagation mechanisms. This resolves the contradiction by simplifying the overall constraint propagation while maintaining effective security control.
2Adaptability or versatility
If constraints are applied at the segment level, then individual segment security can be controlled, but resources within the segment may not inherit these constraints
Solution Approach 1:
The patent implements local quality by allowing each segment to have customized security constraints and classification levels that are specific to that segment's requirements. Resources within a segment are evaluated against the segment's local constraints rather than inheriting a uniform policy, enabling adaptable security control while maintaining reliable enforcement through explicit segment-level constraint application.
3Ease of manufacture
If conventional data security approaches are used, then data controls can be implemented, but conjunctive and disjunctive constraints are not addressed effectively
Solution Approach 1:
The patent applies parameter changes by introducing multiple constraint types (conjunctive and disjunctive) with different evaluation logic. The system changes the evaluation parameters from simple inheritance to explicit constraint matching, where resources are evaluated against specific constraint categories. This enables precise constraint evaluation while maintaining ease of implementation through standardized constraint application mechanisms.
Data Source
AI summary
Computing systems and methods are provided for defining, within a data platform, a segment having constraints at a level of the segment, implementing the constraints or the classification rules within the segment while insulating resources within the segment from inheriting the constraints, and controlling an ingestion of an external resource into the segment based on the constraints.