Secure Data Management via Permission-Based Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large networks, such as social networks, face challenges in data privacy and dynamic data analytics due to their dynamic nature, leading to computational inefficiencies and security concerns in sharing and retrieving sensitive information.
Innovation Solution
The implementation of a system that uses drip-fed delta processing and pre-computed network data to efficiently manage and traverse networks, combined with secure data retrieval through relational filtering and data redaction based on permissions stored in a trusted store, ensuring only authorized access to sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data is made accessible to all nodes in the network, then data availability and connectivity benefits are improved, but data privacy and security risks increase
Solution Approach 1:
The patent implements local quality by assigning different data access permissions to different nodes based on their specific roles, relationships, and security clearances. Instead of uniform access, each node receives customized access rights that allow them to access only the data necessary for their function, thereby maintaining data availability while reducing privacy risks.
Solution Approach 2:
The patent introduces a centralized authorization server as an intermediary between data requests and the database. This mediator evaluates each request against stored permission policies and filters data accordingly, enabling controlled data sharing that balances accessibility with security requirements.
2Adaptability or versatility
If the network structure is dynamically updated to reflect changing connections, then network adaptability is improved, but computational complexity and data analytics challenges increase
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing access permission decisions in an authorization server before data requests are made. Permission policies are evaluated and stored in advance, allowing fast lookup during data retrieval operations without re-computing complex access decisions each time, thus reducing real-time computational complexity.
Solution Approach 2:
The patent segments the complex data access control system into separate functional components: a centralized authorization server that handles permission evaluation, a database that stores filtered data, and client nodes that make simplified requests. This segmentation divides the computational burden and simplifies the overall system architecture despite dynamic network changes.
3Reliability
If data is filtered and redacted based on node permissions, then data security is improved, but data retrieval complexity increases
Solution Approach 1:
The authorization server acts as an intermediary that handles the complex permission filtering logic centrally. It receives data requests from nodes, evaluates them against stored permission policies, and returns appropriately filtered results. This mediator approach moves complexity from individual nodes to a centralized service, simplifying client-side operations while maintaining strong security.
Solution Approach 2:
Permission policies are pre-evaluated and stored in the authorization server before data retrieval operations. When nodes request data, the system performs simple lookup operations against pre-computed permission decisions rather than performing complex real-time filtering, significantly reducing data retrieval complexity while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments include systems and methods for providing secure data management for a network of nodes. A network with a plurality of connected nodes can be stored, the nodes representing entities of the network. A request can be received from a first node of the network to retrieve data about a second node of the network. A query can be generated to retrieve the requested data. The query can be filtered based on permissions for the first node stored at a trusted store. The fields from the results of the filtered query can be redacted based on the permissions for the first node. And the redacted results can be provided to the first node.