Document Policy Enforcement Using Centralized and Embedded Rules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information management systems face challenges in effectively protecting sensitive information from unauthorized access and use, particularly in business contexts, including insider theft, external sharing, and confidentiality issues, with operational challenges in classification, access control, and policy management.
Innovation Solution
A system and method using declarative policies, access rights, and encryption to control document access and use, involving a data protection client that evaluates policies and makes decisions on file operations, combining decisions from multiple policy levels to enforce access and use controls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized policies are implemented to control document access, then security is improved, but device complexity increases due to multiple policy levels and evaluation mechanisms
Solution Approach 1:
The patent segments policy management into two distinct levels: centralized policies stored in a policy database and discretionary policies embedded within individual documents. This segmentation allows the system to handle different types of access control requirements separately, improving security through comprehensive policy coverage while managing complexity by organizing policies into manageable, distinct categories with different evaluation contexts.
2Reliability
If multiple policy levels are evaluated for each document operation, then access control reliability is improved, but processing time increases due to sequential policy evaluation
Solution Approach 1:
The patent applies preliminary action by pre-storing centralized policies in a policy database before they are needed for access decisions. When a document operation occurs, the system retrieves relevant centralized policies and combines them with discretionary policies from the document metadata, then evaluates the combined policy set. This preliminary organization of policies reduces the computational burden during actual access operations, maintaining high reliability through comprehensive evaluation while minimizing processing time through efficient policy retrieval and combination.
3Adaptability or versatility
If discretionary policies are embedded in documents, then adaptability is improved, but information loss increases due to potential policy conflicts and complexity in policy combination
Solution Approach 1:
The patent introduces an intermediary mechanism in the form of a policy evaluation system that acts as a mediator between centralized policies and discretionary policies. This intermediary evaluates both policy types, detects conflicts, and resolves them through a defined combination process. The intermediary ensures that policy conflicts are systematically identified and resolved rather than causing information loss, while maintaining the adaptability benefits of discretionary policies embedded in documents.
Data Source
AI summary
Technique and system protects documents at rest and in motion using declarative policies, access rights, and encryption. Methods, techniques, and systems control access to documents and use of content in documents to support information management policies. Documents are protected using centralized and discretionary policies. Control and protection functions of information or documents may be through one policy or multiple policies defined centrally. A policy server is an intelligent system that has the ability to decide if a single or multiple policies or subset of policies are applicable to a client.