Object-Level Access Control via Data Criticality Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access control systems in shared storage systems are inefficient as they often require significant computing resources and impose either overly restrictive or permissive access controls, limiting flexibility and security by applying permissions at a higher level rather than an object-by-object basis.
Innovation Solution
A method to calculate a data criticality score for each data object, using inputs such as classification, user account, location, time, retention value, and access attempts, which is then used to determine allowable actions and grant access permissions on a granular level, allowing for more precise control and security configuration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If access control constraints are applied at a container or file level rather than at the object level, then computing resource consumption is reduced, but access control precision and flexibility deteriorate
Solution Approach 1:
The patent segments access control from the traditional container/file level and applies it at the individual object level within those containers. This allows fine-grained control where each object can have its own access constraints while the system maintains the hierarchical structure of containers and files, thus achieving both precision and reasonable resource consumption.
Solution Approach 2:
The patent calculates and stores access constraints in advance during data ingestion, rather than computing them dynamically at access time. By pre-calculating constraints based on data characteristics and storing them with the data objects, the system reduces runtime computing resource consumption while maintaining object-level precision.
2Device complexity
If access control constraints are applied at a higher level (container/file level), then system complexity is reduced, but security flexibility and adaptability deteriorate
Solution Approach 1:
The patent implements local quality by allowing different access constraints to be applied to different objects within the same container or file system. Each object can have customized access control characteristics tailored to its specific security requirements, while the overall system architecture remains relatively simple and hierarchical.
Solution Approach 2:
The patent introduces dynamic access control constraints that can be adjusted based on data characteristics, user roles, and contextual information. The system dynamically determines which constraints apply to which objects rather than using static, pre-defined access control lists, thereby increasing flexibility without proportionally increasing system complexity.
3Measurement precision
If object-level access control is implemented, then access control precision is improved, but computing resource consumption increases
Solution Approach 1:
The patent performs the computationally intensive task of calculating access constraints during data ingestion and storage, rather than during access operations. By pre-calculating and storing these constraints with the data objects themselves, the system achieves object-level precision without the heavy computing burden at access time.
Solution Approach 2:
The patent creates a simplified representation of access constraints that is stored with each data object. This copy of the access control information allows the system to quickly determine permissions without re-evaluating complex access control policies from scratch, thus reducing computing resource consumption while maintaining object-level precision.
4Use of energy by moving object
If higher-level access control constraints are used, then computing resource consumption is reduced, but access control flexibility and granularity deteriorate
Solution Approach 1:
The patent segments access control into fine-grained object-level constraints while maintaining the hierarchical container/file structure. This segmentation allows the system to provide flexible, granular control where needed without requiring complete redesign of the entire access control system, thus maintaining ease of operation and flexibility.
Solution Approach 2:
The patent changes the parameters of access control from coarse-grained (container/file level) to fine-grained (object level) by introducing new constraint parameters that can be applied to individual objects. This parameter change enables enhanced flexibility and granularity without proportionally increasing computing resource consumption, as the additional parameters are evaluated efficiently during data ingestion and stored for quick reference.
Data Source
AI summary
Various systems and methods are provided for calculating a data criticality score upon ingesting a data object into a data storage system. This data criticality score can be used to control subsequent access requests for the data object. In one embodiment, a computer system receives a data object at a first node comprising a decision engine. The decision engine generates a data criticality score based, at least in part, on one or more inputs related to the data object. After calculating the data criticality score, the system uses the data criticality score to determine whether a given action is allowable for the data object. After determining whether the given action is allowable, the system receives a user request to perform a first action on the data object. The system then determines whether the user request should be granted with respect to the first action, and if allowable, performs the first action.