OS-Level Credential Mediation for Cloud Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data leakage occurs in cloud and mobile environments due to unauthorized access by applications that do not adhere to data protection policies, as they are not properly controlled or managed, leading to sensitive information being transferred to unsecured locations.
Innovation Solution
Implementing a system where a computing device determines which applications are compliant with data protection policies by providing access credentials only to those that adhere to the policies, denying access to noncompliant applications, thereby preventing data leakage. This involves a client device receiving a data protection policy from a policy management service and using an operating system to store and manage access credentials, ensuring only compliant applications can access protected data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If access credentials are provided to all applications requesting data, then applications can access network resources freely, but data leakage occurs due to unauthorized access by noncompliant applications
Solution Approach 1:
The operating system acts as an intermediary between applications and network resources. It receives credential requests from applications, evaluates their compliance with data protection policies, and selectively provides access credentials. This mediator approach allows free access for compliant applications while blocking noncompliant ones, resolving the contradiction between ease of access and data protection.
2Object-affected harmful factors
If access credentials are restricted only to compliant applications, then data leakage is prevented, but system complexity increases due to policy evaluation and credential management
Solution Approach 1:
The operating system performs self-service by automatically evaluating application compliance and managing credential distribution without external intervention. The system autonomously determines which applications receive credentials based on policy compliance, reducing the need for manual access management and minimizing system complexity while maintaining security.
3Device complexity
If data is stored on corporate servers, then data control and management are simplified, but data leakage risk increases in mobile and cloud environments where data may be accessed from multiple locations
Solution Approach 1:
The patent extends data protection from the traditional single-location corporate server model to a multi-dimensional distributed environment. By implementing policy-based access control at the operating system level across multiple devices and locations, the system maintains simplified centralized policy management while enabling secure access from diverse cloud and mobile environments, effectively adding a new dimension to data protection architecture.
Data Source
AI summary
A data protection policy can specify which applications are allowed and/or dis-allowed from accessing cloud data that is subject to a data protection policy (i.e., data that has been assigned a classification and/or an owner.) To enforce that policy, the operating system (or other trusted entity) that stores or caches access credentials only provides these credentials to applications that are allowed by the policy. In this manner, because they are not provided with the credentials required to access the network resource, the dis-allowed applications cannot access the ‘protected’ data thereby helping prevent these dis-allowed (or non-compliant) applications from leaking data.