File Permission Mapping for Sensitive Data Access Aggregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems face challenges in efficiently managing and securing access to sensitive data across large file systems, particularly in determining which users or groups have access to specific types of sensitive information, leading to high computational complexity and resource usage.
Innovation Solution
A data management system (DMS) indexes file systems by leveraging permission sets associated with each file, generating mapping tables to aggregate policy information efficiently, reducing complexity by focusing on unique permission and sensitive information pairs, and generating per-principal security information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional methods are used to determine access to sensitive data, then comprehensive security coverage is achieved, but computational complexity and resource usage increase significantly
Solution Approach 1:
The patent segments the file system access control problem by introducing distinct data structures: permission sets for access rights and sensitive information type mappings. This segmentation allows the system to separately manage and process access control information from sensitive data identification, reducing computational complexity while maintaining comprehensive security coverage through structured query processing.
Solution Approach 2:
The patent introduces permission sets as intermediary structures between users and files, and between sensitive information types and access control. These permission sets act as mediators that pre-process and organize access rights, enabling efficient querying without requiring complex real-time analysis of all file access permissions across the entire system.
2Measurement precision
If detailed per-file access control is implemented, then precise security management is achieved, but system performance decreases due to high processing overhead
Solution Approach 1:
The patent applies preliminary action by pre-establishing permission sets and sensitive information type mappings before actual access queries occur. The system pre-processes access control information and stores it in optimized data structures, enabling fast retrieval during runtime without requiring complex on-the-fly processing of individual file permissions.
Solution Approach 2:
The patent changes the parameter representation from detailed per-file permission lists to aggregated permission set identifiers. Instead of processing individual file access control entries during queries, the system operates on summarized permission parameters, significantly reducing processing overhead while maintaining precise access control through the structured mapping of permission sets to sensitive information types.
Data Source
AI summary
Methods, systems, and devices for data management are described. A data management system (DMS) may obtain a snapshot of a file system that includes multiple files and permission sets associated with the files. A permission set may indicate one or more access approvals for associated principals. The DMS may scan the files to identify unique pairs each including a unique combination of a respective permission set and a respective sensitive information type. The DMS may store a first mapping that maps the unique pairs to respective values that indicate an amount of sensitive information, of the respective sensitive information type, that is included in one or more files associated with the unique pair. The DMS may identify a respective set of sensitive data types included in files to which a principal has access based on the first mapping and an evaluation of the permission sets.