Federated Storage Access Across Mixed Classification Levels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches to enable data access across computing environments with different classification levels compromise security, flexibility, or user-friendliness, making collaborative projects cumbersome, time-consuming, or insecure, particularly in military or defense domains.
Innovation Solution
A method and system for federated storage that enables secure and user-friendly data access by determining classification levels of computing environments and using appropriate communication paths and access restrictions to manage data access across different security levels, including encrypted channels, VPNs, and data diodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data are stored in different computing environments with different classification levels to meet security requirements, then data security is improved, but data access complexity increases
Solution Approach 1:
The patent introduces a data access control system as an intermediary layer between clients and federated storage systems. This mediator automatically determines classification levels, selects appropriate communication paths, and manages access rights, thereby reducing the complexity faced by users while maintaining security across different classification environments
Solution Approach 2:
The federated storage system provides universal access mechanisms that work across multiple computing environments with different classification levels. The system handles diverse storage locations (cloud, on-premises, different security zones) through a unified access control framework, simplifying the user experience while maintaining security
2Reliability
If strict access control rules are enforced across classification boundaries, then data security is improved, but user-friendliness deteriorates
Solution Approach 1:
The access control system performs self-service by automatically determining classification levels of data and computing environments, selecting appropriate communication paths, and managing access rights without requiring manual user intervention. This automation maintains security while providing a user-friendly experience
Solution Approach 2:
The system dynamically adjusts access parameters based on the classification levels of data and computing environments. By automatically changing access control parameters (such as communication paths, encryption requirements, and data transfer rules) based on detected classification levels, the system maintains security while presenting a consistent user interface
3Reliability
If data subsets are stored in different storage locations with varying access restrictions to ensure data ownership, then data security is improved, but access efficiency decreases
Solution Approach 1:
The system performs preliminary actions by pre-determining classification levels of data and computing environments before access is requested. It pre-establishes communication paths and access rules based on classification levels, so that when access is needed, the system can quickly retrieve data through pre-configured channels without repeated security assessments, thereby improving access efficiency
Solution Approach 2:
The access control system incorporates feedback mechanisms that continuously monitor access requests and adjust routing decisions based on the classification levels detected in the data and computing environments. This feedback loop ensures optimal access paths are selected while maintaining security, improving overall access efficiency
Data Source
AI summary
There is provided a method and device for enabling data access to a federated storage, the method including: receiving, from a client device operating in a first computing environment, a request for a data set stored in the federated storage, wherein the data set includes one or more data subsets; determining a first classification level of the first computing environment and a respective second classification level of one or more second computing environments, the one or more data subsets of the requested data set each being stored in a corresponding storage location in one of the one or more second computing environments; based on the determined first and one or more second classification levels, in particular based on a comparison of the first and one or more second classification levels, enabling or denying access to the one or more data subsets of the requested data set for the client device.