Object Replication Control via Policy Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current digital rights management (DRM) techniques face challenges in controlling the replication of individual objects within a document file, as they often apply uniform access controls, failing to account for varying importance levels of objects, and may lack necessary attribute data during copy and paste operations, leading to inadequate access determinations.
Innovation Solution
An object replication control apparatus that includes a resource access unit, policy evaluation units, and processing units to manage copy and paste operations based on base and assertion policy data, ensuring that attribute data is evaluated and matched against specific conditions for each object, allowing granular control over replication processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If uniform access control is applied to all objects in a document file, then security management is simplified, but granular control over individual objects with different importance levels cannot be achieved
Solution Approach 1:
The patent segments the document file into individual objects (images, texts, shapes, etc.) and applies access control policies to each object separately. Each object can have its own policy data with unique conditions, allowing granular control over replication based on object-specific attributes and importance levels.
Solution Approach 2:
The patent implements local quality by assigning different access control policies to different objects within the same document file. Each object can have customized policy data that reflects its specific security requirements, importance level, and replication conditions, rather than applying a uniform policy to all objects.
2Reliability
If access control policy evaluation is performed during copy processing, then security control is established early, but attribute data for the destination resource may be missing leading to incomplete evaluation
Solution Approach 1:
The patent performs preliminary access control evaluation during the copy processing stage by evaluating the policy data associated with the source object. This preliminary action establishes security control early in the replication process, before the paste operation occurs, ensuring that only authorized objects are copied.
Solution Approach 2:
The patent uses an intermediary mechanism where the system stores and manages policy data separately from the objects themselves. The policy data acts as an intermediary that contains all necessary attribute information and conditions, allowing complete evaluation to be performed even when destination resource attributes are not yet available.
3Loss of information
If access control policy evaluation is performed during paste processing, then complete attribute data is available, but the replication source may no longer be clear making policy lookup difficult
Solution Approach 1:
The patent performs the policy lookup and evaluation during the copy processing stage rather than waiting for paste processing. This preliminary action captures the policy data and source object information while they are still clearly identified, eliminating the need for time-consuming lookups later during paste operations.
4Device complexity
If replication control is applied at the file level, then security management is simplified, but convenience is reduced when objects need to be frequently reused across documents
Solution Approach 1:
The patent segments the security control from the file level to the object level, allowing individual objects to be controlled independently. This enables frequent reuse of specific objects across different document files without requiring complex file-level security management, as each object carries its own policy data.
Solution Approach 2:
The patent implements a copying mechanism where policy data is copied along with the object during the copy operation. This allows the object to be reused across multiple documents while maintaining its associated security policies, providing both granular control and operational convenience.
Data Source
AI summary
According to one embodiment, the resource access unit accesses a first resource including a replication target object and policy data assigned to the object. The policy data includes base policy data including a first condition and assertion policy data including a second condition. The first retrieval unit obtains first attribute data for accessing the first resource. The first policy evaluation unit determines whether the first attribute satisfies the first condition. When the first condition is satisfied, the copy processing unit executes the copy processing for copying the object. The second retrieval unit obtains the second attribute data for accessing the second resource. The second policy evaluation unit determines whether the second attribute data satisfies the second condition. When the second condition is satisfied, the paste processing unit executes paste processing for pasting the object to the second resource.