Policy Enforcement System for Masking Sensitive Data in File Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file systems, such as HDFS, do not effectively manage sensitive data access by simply denying unauthorized access, exposing sensitive information when users lack proper credentials, and lack mechanisms to mask or filter data based on user permissions.
Innovation Solution
A policy enforcement system that stores policies and user credentials, intercepts data requests, appends user credentials to redirect requests, filters data based on policies, and sends masked data to clients, ensuring only authorized data is accessible without interfering with existing communication protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a file system simply denies unauthorized access, then security is maintained through access control, but sensitive information is still exposed when users lack proper credentials
Solution Approach 1:
The patent introduces a policy enforcement system as an intermediary component between the file system and clients. This mediator intercepts data requests, applies masking policies to sensitive data fields, and returns masked data to clients. The policy enforcement system includes a policy store containing masking policies and a data request interceptor that applies these policies, thereby preventing sensitive information exposure while maintaining seamless integration with existing file systems.
2Object-affected harmful factors
If data is masked or filtered based on user permissions, then sensitive information protection is improved, but system complexity increases
Solution Approach 1:
The policy enforcement system is designed to work with existing file system architectures without requiring fundamental changes. It implements a universal interface that can be integrated into various file system implementations, applying masking policies across different data types and access scenarios. The system maintains compatibility with existing communication protocols and can enforce policies on both read and write operations, thereby reducing the need for separate systems for different functions.
3Object-affected harmful factors
If masking policies are applied to data requests, then data privacy is enhanced, but processing time increases
Solution Approach 1:
The patent implements a policy store that pre-loads and caches masking policies before they are needed for data operations. By preparing the policy enforcement rules in advance and storing them in an accessible format, the system minimizes the time required to apply masking during actual data requests. The interceptor is pre-configured with policy lookup mechanisms, enabling rapid application of masking rules without significant processing delays during data access operations.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for storing, by a policy enforcement system, a plurality of policies and data associating a plurality of user credentials with the plurality of policies; receiving, from a client device, a request for data from a file system, the request further comprising user credentials; forwarding the request for data to a second node that stores the data from the file system; receiving, from the node, the data from the file system; selecting from the plurality of policies, based on the received user credentials and the data associating the plurality of user credentials with the plurality of policies, one or more policies that correspond to the received user credentials; filtering, by the policy enforcement system, the data from the file system based on the one or more policies; and sending the filtered data to the client device.