Enforcement Knowledge Graph for Dynamic Tabular Data Policy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data security systems face challenges in dynamically enforcing data protection policies for arbitrary tabular data access across multiple information assets with different columnar schemas, leading to increased complexity and inefficiency in policy enforcement decisions.
Innovation Solution
The implementation of an enforcement knowledge graph that captures deep data semantic knowledge, column schema knowledge, and historic user access patterns, combined with a bag of columns enforcement model, allows for dynamic construction of access enforcement decisions by analyzing arbitrary SQL statements and applying policy rules based on user context.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control methods are used for tabular data access across multiple information assets, then policy enforcement can be implemented, but the complexity of enforcing policies across different columnar schemas increases significantly
Solution Approach 1:
The patent segments the policy enforcement process into distinct components: an enforcement knowledge graph that stores policy rules and data asset metadata separately, a virtual information asset layer that abstracts heterogeneous schemas, and an access enforcement engine that processes requests. This segmentation allows complex policies to be managed in modular units rather than as monolithic rules, reducing enforcement complexity while maintaining accuracy.
Solution Approach 2:
The patent introduces a virtual information asset as an intermediary layer between the physical data assets with different columnar schemas and the access control system. This intermediary abstracts the heterogeneity of underlying schemas, allowing policy enforcement to operate on a unified view without directly handling schema differences, thereby reducing complexity while ensuring reliable policy application.
2Adaptability or versatility
If static data access methods are used, then system simplicity is maintained, but the system cannot dynamically adapt to arbitrary tabular data access requests
Solution Approach 1:
The patent implements dynamic policy enforcement by constructing a virtual information asset on-demand for each access request. The system dynamically determines term intersections between the requested columns and policy-defined terms, and dynamically applies relevant policy rules based on the specific access pattern. This dynamic approach allows the system to adapt to arbitrary tabular data access requests while maintaining manageable complexity through the use of the enforcement knowledge graph for rule storage.
3Reliability
If comprehensive policy rules are applied to all data access requests, then data protection is ensured, but processing time and computational resources increase
Solution Approach 1:
The patent extracts and pre-processes policy rules into the enforcement knowledge graph during system initialization, separating policy definitions from access request processing. When a data access request arrives, the system only needs to evaluate the specific request against the pre-organized policy structures, rather than processing all policy rules from scratch. This extraction significantly reduces policy decision time while maintaining comprehensive data protection coverage.
Solution Approach 2:
The patent applies partial policy enforcement by determining term intersections between requested columns and policy terms, and applying only the relevant subset of policy rules that pertain to the specific access request. Rather than evaluating all policy rules for every request, the system identifies and applies only the necessary portion of policies, reducing processing time while ensuring adequate protection for the accessed data.
Data Source
AI summary
Enforcement of policies for tabular data access as a collection of columns over a plurality of different information assets is provided. In an enforcement knowledge graph, information asset-assigned terms are found that correspond to information assets in a virtual information asset that references a set of tabular data. Transitive closures of the information asset-assigned terms are found in a business glossary to form a table of business glossary terms. Term intersection is determined between a hash table of any column-assigned terms and the table of business glossary terms. The information assets are assigned to the virtual information asset when the term intersection is not empty. A set of policy rules associated with the set of tabular data and a context of a user making a data access request to the set of tabular data is applied to the virtual information asset to determine an access enforcement decision.