Policy Engine for Search Query Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing search engine security techniques are inflexible and inefficient, often relying on browser-side filtering, early binding, or late binding methods that incur performance costs and require complex access control lists, leading to inconsistencies and increased training needs.
Innovation Solution
Implementing a policy engine through an API that enforces user access privileges by modifying intermediate search query representations to exclude prohibited content, allowing for centralized, flexible, and uniform policy enforcement across users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If browser-based filtering is used to enforce security policies, then user-specific customization is improved, but consistency across users deteriorates and performance overhead increases
Solution Approach 1:
The patent introduces a policy engine as an intermediary component between the search engine and users. This policy engine centralizes policy enforcement, receiving search queries from users and applying uniform policies before returning results. The policy engine acts as a mediator that ensures consistent policy application across all users while still allowing for user-specific customization through the centralized policy framework, thereby resolving the contradiction between adaptability and reliability.
2Reliability
If early binding techniques are used to add access control terms to queries, then security enforcement is improved, but query complexity and performance overhead increase
Solution Approach 1:
The patent extracts the access control logic from the search query itself and places it in a separate policy engine. Instead of embedding access control terms directly in the search query (early binding), the system separates the security enforcement mechanism from the query processing. The policy engine independently evaluates policies against user credentials and search context, then applies appropriate filters to results. This extraction reduces query complexity while maintaining security enforcement.
3Reliability
If late binding techniques are used to filter search results, then security enforcement is improved, but processing speed deteriorates due to individualized checks on each result
Solution Approach 1:
The patent applies preliminary action by evaluating access policies before search results are generated and returned to users. The policy engine performs preliminary filtering on search results based on user credentials and applicable policies, eliminating the need for individualized checks on each result item during late binding. This preliminary enforcement maintains security while significantly improving processing speed by reducing the computational overhead of result-by-result evaluation.
Data Source
AI summary
Systems, computer program products and methods implementing policy enforcement for search engines are described. A policy engine receives a user identifier associated with a search query including one or more query terms. The policy engine receives, from a preprocessor of a search engine, an intermediate representation of the search query. The intermediate representation includes one or more index terms corresponding to the one or more query terms. The policy engine determines, based on a particular policy, if the user is prohibited from accessing data associated with a particular index term. In response, the policy engine modifies the intermediate representation, including negating the particular index term. The policy engine then submits the modified intermediate representation to a query processing module of the search engine, causing the query processing module to exclude content corresponding to the particular index term from search results.