Rule-Repository for Heterogeneous Security Definitions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing fine-grained security definitions across heterogeneous subsystems in complex software systems is challenging due to differences in structure, technology, and data formats, leading to difficulties in maintaining synchronized security and increasing the risk of security leaks.
Innovation Solution
A three-layered security architecture is implemented, where natural language security definitions are stored in a rule-repository, converted to machine-readable XACML definitions, and then automatically generated into system-specific security definitions for each subsystem using rule-converters, ensuring synchronized and enforceable security intents across the system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual synchronization of fine-grained security definitions across heterogeneous subsystems is performed, then security coverage is improved, but maintenance complexity and time consumption increase significantly
Solution Approach 1:
The patent introduces a central rule-repository as an intermediary component that stores security rules in a standardized format and provides automated distribution to all heterogeneous subsystems. This mediator eliminates the need for manual synchronization across subsystems, reducing maintenance time while maintaining comprehensive security coverage through centralized control.
Solution Approach 2:
The system performs preliminary action by pre-defining security rules in the rule-repository with standardized formats and mappings to various subsystem-specific formats. When security requirements change, the updated rules are automatically distributed and applied across all subsystems without requiring manual intervention, thus reducing maintenance time while ensuring consistent security coverage.
2Manufacturing precision
If multiple different fine-grained security definitions are used to cover global security intents, then security precision is improved, but system complexity increases
Solution Approach 1:
The patent segments the security management system into distinct layers: a standardized rule-repository layer for storing security intents, and subsystem-specific layers for implementing fine-grained security definitions. Each subsystem receives only the security rules relevant to it, converted to its specific format. This segmentation maintains security precision through detailed subsystem-level definitions while reducing overall system complexity by organizing security management in a modular, hierarchical structure.
3Adaptability or versatility
If heterogeneous subsystems use different security definition formats, then subsystem adaptability is improved, but synchronization difficulty increases
Solution Approach 1:
The rule-repository implements a universal standardized format for storing security rules that can represent security intents applicable to multiple heterogeneous subsystems. The system includes automated conversion mechanisms that translate this universal format into subsystem-specific formats. This universality allows the same security rule to be applied across different subsystems with varying security requirements, maintaining subsystem adaptability while eliminating manual synchronization complexity through automated format conversion and distribution.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
The present invention concerns a method for generating one or more system-specific security-definitions (310, 311, 320, 321) for one or more heterogeneous subsystems (S1, S2) of a software system, the method comprising the following steps: a. storing one or more natural-language security-definitions (100) in a rule-repository; b. storing one or more machine-readable security-definitions (200) and a first mapping of each natural-language security-definition (100) onto one or more of the machine-readable security-definitions (200) in the rule-repository; and c. generating the one or more system-specific security-definitions (310, 311, 320, 321) from the one or more machine-readable security-definitions (200) by one or more rule-converters (RC1, RC2) corresponding to the one or more heterogeneous subsystems (S1, S2), wherein the generating is based on a second mapping of each machine-readable security definition (200) onto one or more of the system-specific security-definitions (310, 311, 320, 321).