Role-Based Syslog Redaction for Secure Log Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions do not effectively limit access to sensitive information in system logs, posing security threats by allowing unrestricted access to various users.
Innovation Solution
Implement a data controller that determines user identity and applies a policy to redact portions of the system log, providing a curated version based on user roles, thus restricting access to sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If all users are allowed to access the entire system log, then users can obtain comprehensive information for troubleshooting and analysis, but security threats arise from unauthorized access to sensitive information
Solution Approach 1:
The patent applies local quality by providing different users with different versions of the system log based on their roles and permissions. Each user receives a customized log view that shows only the information they are authorized to see, rather than applying a uniform access policy to all users. This resolves the contradiction by maintaining ease of operation for authorized users while preventing security threats through role-based information filtering.
Solution Approach 2:
The patent segments the system log access into multiple authorized user groups with different permission levels. Instead of treating all users as a single group, the system divides access rights into segments based on user roles (e.g., administrators, operators, auditors), allowing each segment to access only the portions of the log necessary for their functions. This resolves the contradiction by enabling comprehensive access for each user segment while preventing unauthorized access to sensitive information outside their segment.
2Object-affected harmful factors
If access control policies are implemented to restrict sensitive information, then security is improved, but users may not access necessary information for their roles
Solution Approach 1:
The patent implements dynamic access control where the system log view automatically adjusts based on the user's identity, role, and permissions. Rather than static restrictions, the system dynamically generates customized log views that show different information to different users. This resolves the contradiction by ensuring users access all necessary information for their roles while automatically preventing unauthorized access to sensitive information outside their permissions.
Solution Approach 2:
The system provides self-service access control by automatically determining user permissions and generating appropriate log views without requiring manual intervention. The system itself manages the complexity of access control policies, automatically filtering and presenting the correct information to each user based on their role. This resolves the contradiction by maintaining full accessibility of necessary information while enforcing security restrictions, without burdening users with manual permission management.
Data Source
AI summary
Method and apparatus for providing users role-based system log entry access are described. This can be implemented using a data controller that can read and implement a policy that determines what portion of the total system log certain users (or user groups) are permitted to access. In turn, it may curate a redacted system log and present it to the user that sent the request for the system log. The data controller may act as an intermediate layer between a user wishing to view a system log, the system log itself.