Graph-Based Unauthorized File Possession Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data access control methods in networked computing environments face challenges in efficiently detecting unauthorized access, particularly in large and complex organizations, where top-down policies can be cumbersome and prone to circumvention, and bottom-up approaches are needed to determine authorized access based on user connections and file sharing patterns.
Innovation Solution
A system that constructs a graph representing users and files, with edges indicating file possession, uses statistical methods to estimate authorized access probabilities, and generates alerts for unlikely file possession, employing metrics like minimum degree of separation, neighbor connections, and bridge analysis to identify potential unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If top-down access control policies are implemented, then access security is improved, but system complexity and difficulty of management increase
Solution Approach 1:
The patent inverts the traditional top-down access control approach by implementing a bottom-up model. Instead of administrators manually assigning access rights based on credentials, the system automatically determines authorized possession by analyzing actual user connections and file sharing patterns within the network. This inversion transforms access control from a management-heavy process to an automated, data-driven process that adapts to actual usage patterns.
Solution Approach 2:
The system enables self-service access control by allowing the network structure itself to determine authorized access. The graph-based model automatically analyzes connection paths, neighbor connections, and file sharing patterns to identify who should have access to which files, eliminating the need for manual policy configuration and credential management by administrators.
2Reliability
If credential-based access control is used, then access authorization is improved, but susceptibility to credential theft and circumvention increases
Solution Approach 1:
The patent introduces an intermediary layer between users and files - the graph-based access analysis system. Instead of directly relying on user credentials to grant access, the system uses the network structure (connection paths, neighbor relationships, file sharing patterns) as an intermediary to verify whether access is authorized. This intermediary mechanism detects unlikely possession by comparing actual access patterns against expected patterns derived from the network graph.
3Measurement precision
If external software scanning is implemented, then detection of sensitive data is improved, but false positives and limited pattern detection increase
Solution Approach 1:
The patent moves the detection problem from content analysis (one dimension: scanning file contents for patterns) to structural analysis (another dimension: analyzing the graph structure of user-file connections). By examining the topological relationships in the network graph - such as connection paths, neighbor connections, and bridge relationships - the system detects unauthorized access without needing to scan file contents or rely on predetermined sensitive data patterns.
Data Source
AI summary
Systems and techniques for an automatic graph-based detection of unlikely file possession are described herein. In an example, a system for detecting unauthorized file possession is adapted to generate a networked computing environment graph for files and the devices which store the files. The detection system may be further adapted to identify a file in question and a device in question that is in possession of the file in question. The detection system may be further adapted to generate a set of connection paths from the device in question to the file in question based upon the edges of the graph. The detection system may be further adapted to determine the device in question should not have possession of the file in question based on a set of metrics derived from the connection paths. The detection system may be further adapted to generate an alert based on the determination.