Entity-Access Correlation for Cybersecurity Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As the number of entities deployed in computing environments increases, tracking access activities becomes more difficult, particularly when identities are assigned to these entities. This leads to challenges in effectively identifying entities accessing resources or services, especially for external tools that do not have full information about the computing environment.
Innovation Solution
A method is introduced that involves extracting access properties from access data, correlating these properties with entity data to identify the initiating entity, and applying security policies based on the identified entity and the access event. This method utilizes time and source information, such as IP addresses, to accurately correlate entities with access events, even in cases of indirect access via intermediaries like secrets managers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If more entities are deployed in computing environments, then service delivery capability is improved, but tracking access activities becomes more difficult
Solution Approach 1:
The patent segments access activity tracking by creating distinct correlation keys (first correlation key for direct access, second correlation key for indirect access) that separate different access paths. This allows the system to manage complex access patterns by dividing them into manageable segments, each tracked independently through entity data and access property correlations.
Solution Approach 2:
The patent introduces an intermediary correlation mechanism that links access properties to entity data through correlation keys. This intermediary layer enables external tools to track access activities without requiring direct integration with all entities, solving the tracking difficulty while maintaining service delivery scalability.
2Reliability
If identities are assigned to entities, then access control is improved, but identifying entities accessing resources becomes more difficult
Solution Approach 1:
The patent implements feedback mechanisms where access properties (source, time) are correlated with entity data to identify which entities accessed which resources. This feedback loop enables external tools to trace access activities back to specific entities, maintaining reliable access control while improving entity identification capability.
Solution Approach 2:
The patent replaces direct mechanical tracking of entity access with an information correlation system. Instead of directly monitoring each entity's access actions, the system uses correlation between access properties and entity data to identify access patterns, simplifying the identification process while maintaining control reliability.
3Loss of information
If access data is collected from multiple sources, then access visibility is improved, but data correlation complexity increases
Solution Approach 1:
The patent applies local quality by creating specific correlation keys tailored to different access scenarios (direct vs. indirect access). Each correlation key handles a specific type of access pattern with dedicated logic, reducing overall complexity by localizing correlation operations to specific contexts rather than requiring a universal complex correlation system.
Data Source
AI summary
A system and method for policy enforcement. A method includes extracting access properties for an access event from access data indicating the access event, wherein the access properties include a time of the access event and a source of a first entity which initiated the access event; correlating the access properties with entity data of a plurality of second entities in order to identify the first entity among the plurality of second entities, wherein the entity data indicates a source of each of the plurality of second entities at the time of the access event, wherein the source of each of the plurality of second entities is unique among the plurality of second entities; and applying a security policy based on the access event and the first entity identified as the entity which initiated the access event.