Policy Enforcer and Transparent Encryption for Secure Document Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information management systems face challenges in protecting sensitive information from insider theft, ensuring confidentiality, and preventing data loss while enabling collaboration both inside and outside a company, particularly in handling different data types, controlling access and use, and managing policies for information at-rest, in-transit, and in-distribution.
Innovation Solution
A system employing client-server architecture with policy enforcers and encryption modules to manage and protect information, where policies are defined and enforced at the server level and subsets are deployed at clients, with transparent encryption and decryption handled by encryption modules, and access control decisions made by policy enforcers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If information is stored in unencrypted format for easy access and collaboration, then ease of operation is improved, but security and confidentiality are compromised
Solution Approach 1:
The system dynamically changes the encryption state of documents based on operational context. Documents are encrypted at rest but automatically decrypted when accessed by authorized applications, and re-encrypted when saved. This parameter change between encrypted and unencrypted states resolves the contradiction by providing both security (encrypted storage) and ease of operation (automatic decryption for authorized access).
Solution Approach 2:
The policy enforcer acts as an intermediary between the document management system and encryption modules. It intercepts document access requests, evaluates policies, and coordinates with encryption modules to decrypt documents for authorized operations and re-encrypt them after saving. This intermediary mechanism enables automatic encryption/decryption workflows that maintain both security and operational ease.
2Object-affected harmful factors
If encryption is applied to protect information at rest and in transit, then security is improved, but device complexity and operational overhead increase
Solution Approach 1:
The system implements self-service encryption where the policy enforcer and encryption modules automatically handle encryption and decryption operations without requiring manual user intervention. When a document is saved, the system automatically detects if it should be encrypted, performs the encryption, and manages key distribution. This automation reduces operational overhead despite the added complexity of encryption infrastructure.
Solution Approach 2:
Encryption policies and rules are pre-configured and deployed to policy enforcers before document operations occur. The system performs preliminary evaluation of access requests against pre-established policies, and encryption/decryption operations are triggered automatically based on these pre-defined rules. This preliminary configuration reduces runtime complexity and streamlines operations.
3Object-affected harmful factors
If access control policies are enforced at the client level, then security control is improved, but processing overhead and latency increase
Solution Approach 1:
Access control policies are pre-evaluated and cached at the client level policy enforcers. When document access requests occur, the policy enforcer quickly checks against cached policy decisions rather than performing full policy evaluation from scratch. This preliminary caching significantly reduces processing time while maintaining effective access control.
Solution Approach 2:
The system segments policy evaluation into separate components: the policy enforcer handles access control decisions, while encryption modules handle decryption/encryption operations. This segmentation allows parallel processing of policy evaluation and encryption operations, reducing overall processing time and latency.
Data Source
AI summary
A technique and system protects documents at rest and in motion using declarative policies and encryption. Encryption in the system is provided transparently and can work in conjunction with policy enforcers installed at a system. A system can protect information or documents from: (i) insider theft; (ii) ensure confidentiality; and (iii) prevent data loss, while enabling collaboration both inside and outside of a company.