Building Entity PII Masking for Template-Based Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Building management systems face challenges in efficiently managing and protecting large volumes of private data from various interconnected devices, requiring effective data analysis and access control while ensuring privacy and security.
Innovation Solution
A building management system that utilizes a processing circuit to select and apply mask templates based on access values, generating masked information data structures to protect private information and control access, while allowing public information to be accessed without masking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If mask templates are used to manage access to private information, then data security and privacy are improved, but device complexity increases due to the need to manage and select appropriate mask templates
Solution Approach 1:
Mask templates are pre-configured with masking rules and stored in the entity database before access requests occur. When a client device requests private information, the system automatically selects and applies the appropriate pre-defined mask template based on the device's access values, eliminating the need for complex real-time access control logic and reducing runtime processing complexity
Solution Approach 2:
Mask templates serve as an intermediary layer between the entity database and client devices. Instead of implementing complex access control logic directly in the database or at each client device, the mask templates act as pre-processed access control rules that simplify the interaction between entities and clients while maintaining security
2Measurement precision
If extensive user-specific access tables are created to manage access rights, then access control precision is improved, but storage requirements and system complexity increase
Solution Approach 1:
Mask templates are designed to be universally applicable across multiple entities and client devices. A single mask template can serve multiple entities with similar access requirements, and can be applied to multiple client devices based on their access values. This eliminates the need to create separate access tables for each user-entity pair, significantly reducing storage requirements while maintaining precise access control
Solution Approach 2:
The system uses access values (such as role information, device type, geographic location, etc.) as parameters to dynamically select appropriate mask templates. This parameter-based selection approach allows the system to maintain precise access control without requiring extensive hardcoded access tables, as the same template can be reused with different parameter combinations
3Reliability
If all private information is masked by default, then data privacy is improved, but ease of operation deteriorates due to the need to manage masking and unmasking operations
Solution Approach 1:
The system automatically performs masking and unmasking operations based on the client device's access values and the selected mask template. The processing circuit is configured to automatically apply the appropriate masking rules without requiring manual intervention from users or administrators. This self-service approach maintains strong data privacy while simplifying operations, as the system handles the complexity of masking/unmasking automatically
Data Source
AI summary
A building system for operating a building and managing private building information includes a processing circuit configured to receive a request for information for a building entity of a building entity database. The processing circuit is configured to select one of the mask templates from the entity database based on access values associated with the requesting device and a relational link between the building entity and the mask templates, retrieve private information for the building entity in response to a reception of the request for the information, and generate a masked information data structure based on the private information and the one of the mask templates.