Dynamic Policy Trees for Security Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security management systems inefficiently evaluate security policies due to the need to match and evaluate a large number of policies, often prioritizing irrelevant attributes, leading to unnecessary processing and delayed user request processing.
Innovation Solution
The system analyzes security policies to determine relevant attributes for building policy trees, organizing them based on important attributes for each application, domain, or system, allowing for efficient identification and evaluation of relevant policies, reducing unnecessary evaluations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional systems evaluate all security policies irrespective of attribute importance, then comprehensive policy coverage is achieved, but policy evaluation time increases unnecessarily
Solution Approach 1:
The patent changes the parameter of policy evaluation by introducing attribute importance scoring. Policies are evaluated based on matching attributes weighted by their importance scores, transforming the evaluation from a blanket approach to a prioritized approach that considers attribute significance.
Solution Approach 2:
The patent segments the policy evaluation process by dividing policies into different importance levels based on their attributes. The system processes policies in segments according to attribute importance, evaluating high-importance policies first and potentially skipping low-importance ones, thus reducing overall evaluation time while maintaining reliability for critical policies.
2Device complexity
If policy trees are generated based on a single attribute such as resource attribute, then policy organization is simplified, but evaluation efficiency decreases when another attribute such as identity attribute is more important
Solution Approach 1:
The patent makes the policy tree structure dynamic by allowing the system to generate different policy trees based on the most important attribute for the current evaluation context. Instead of a fixed single-attribute tree, the system dynamically selects which attribute to base the tree on, optimizing for evaluation efficiency in each specific scenario.
Solution Approach 2:
The patent creates a universal policy tree generation mechanism that can adapt to different attribute types (identity, resource, action, etc.). The same policy tree structure can serve multiple functions by being regenerated based on different important attributes depending on the evaluation context, making the system versatile rather than specialized for a single attribute type.
3Reliability
If all security policies are parsed through the policy tree until relevant policies are found, then comprehensive policy matching is ensured, but processing time increases significantly
Solution Approach 1:
The patent performs preliminary action by pre-calculating and storing attribute importance scores for each policy before actual policy evaluation occurs. This preprocessing step allows the system to quickly identify and prioritize relevant policies during runtime without having to parse through all policies, thus ensuring accurate matching while reducing processing time.
Solution Approach 2:
The patent applies partial action by evaluating only the necessary portion of policies based on attribute importance matching. Instead of parsing through all policies in the tree, the system performs partial evaluation focused on policies with high-importance attribute matches, achieving sufficient accuracy without the excessive action of comprehensive parsing.
Data Source
AI summary
A system and method is provided for evaluating one or more security policies. Security policies may be analyzed to determine one or more policy attributes based on which one or more policy trees should be generated. These policy trees may be utilized for evaluation purposes.