Role-Based Entitlement Views for Secure Sensitive Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Institutions face challenges in safeguarding sensitive data while ensuring regulatory compliance and efficient access, as current systems often lead to financial or reputational loss due to unauthorized access or scattered reporting.
Innovation Solution
A system and method for democratizing sensitive data by using role-based entitlements and secured views, generating entitlement tables through functional and control table joins, and providing centralized data access via a data lake and warehouse, ensuring secure and efficient data sharing across divisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If sensitive data is centralized for democratized access, then data sharing efficiency improves, but security risks increase
Solution Approach 1:
The patent segments sensitive data into classified categories (public, internal, confidential, restricted) and implements division-level isolation where each division can only access its own sensitive data. This segmentation allows democratized access within boundaries while maintaining security through architectural isolation at the data lake, entitlement table, and query execution layers.
Solution Approach 2:
The patent introduces an intermediary entitlement validation mechanism that sits between data requests and the centralized data lake. The system automatically validates user roles, divisions, and data classifications through entitlement tables before allowing access, acting as a mediator that enables efficient centralized access while enforcing security policies without manual intervention.
2Reliability
If role-based access control is implemented for sensitive data, then security is improved, but system complexity increases
Solution Approach 1:
The patent implements preliminary action by pre-computing and storing entitlement relationships in entitlement tables before data access requests occur. The system pre-establishes which users can access which data based on their roles and divisions, and pre-classifies sensitive data by division and sensitivity level. This eliminates the need for complex real-time security calculations during data access operations.
Solution Approach 2:
The patent creates simplified copies of security-relevant information in entitlement tables that can be quickly queried without accessing the full complexity of the underlying security policy engine. These entitlement tables contain pre-processed access permissions that serve as lightweight proxies for the complete role-based access control system, enabling fast validation with minimal computational overhead.
3Adaptability or versatility
If data access is democratized across divisions, then analytics capability improves, but unauthorized access risk increases
Solution Approach 1:
The patent applies local quality by allowing each division to have customized access policies tailored to its specific analytics needs and security requirements. The system dynamically adjusts entitlement validation based on the user's division, role, and the specific data being accessed, rather than applying a uniform security model. This enables optimized analytics capabilities for each division while maintaining appropriate security boundaries.
4Reliability
If sensitive data is scattered across divisions, then security isolation is maintained, but reporting efficiency decreases
Solution Approach 1:
The patent merges scattered divisional sensitive data into a unified data lake while maintaining security isolation through logical organization. All sensitive data from different divisions is consolidated in the data lake but organized by division identifiers and sensitivity classifications. The entitlement validation mechanism enables efficient cross-division reporting by automatically filtering and joining data from multiple divisions based on user permissions, eliminating the need for manual data consolidation while maintaining security boundaries.
Data Source
AI summary
In one embodiment, a method includes obtaining datasets from one or more applications. The datasets comprise functional data and control data related to a plurality of events. The method also includes defining a functional table using the functional data and defining a control table using the control data. The method further includes joining the functional table and the control table to generate an entitlement table. In another embodiment, a method includes receiving a request from a user to access sensitive data related to an event. The method also includes identifying a role of the user and identifying a role-based entitlement of the user based on the role of the user. The method also includes determining, using the role-based entitlement of the user, a user entitlement. The method further includes generating a secured view associated with the user entitlement and communicating the secured view to the user.