Secure Hybrid File-Sharing Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise Data Leak Prevention (DLP) systems face challenges when employees need to share files outside the secure network, as existing solutions either introduce complexity with encryption or fail to ensure sensitive documents are not widely disseminated, risking data leakage and unauthorized access.
Innovation Solution
A method and system that control access by determining if the recipient belongs to the secure network or if the file is non-sensitive before sharing, using a link that is signed for external access and unsigned for internal access, ensuring only pre-screened files are shared externally without storing large access tables.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all files are encrypted and DRM is required for access, then data security is improved, but device complexity and ease of operation deteriorate
Solution Approach 1:
The patent segments the file access control into two distinct pathways: internal network access (unsigned links) and external network access (signed links). This segmentation allows the system to apply different security measures appropriate to each context, avoiding the need for universal encryption and DRM that would complicate all file access.
Solution Approach 2:
The patent applies different security qualities to different access scenarios: internal network access receives minimal security (unsigned links for ease of use), while external network access receives enhanced security (signed links with sensitivity evaluation). This local quality approach ensures security is applied where needed without introducing complexity everywhere.
2Reliability
If sensitivity evaluation is performed for all external file sharing requests, then data leakage prevention is improved, but productivity deteriorates
Solution Approach 1:
The patent performs sensitivity evaluation as a preliminary action only for external file sharing requests, before granting access. This preliminary evaluation ensures that sensitive files are identified and protected before any potential leakage can occur, while not interfering with internal file sharing operations that do not require such evaluation.
Solution Approach 2:
The patent applies sensitivity evaluation selectively rather than universally - only to external file sharing requests where it is necessary for security. This partial action approach maintains productivity by avoiding unnecessary evaluation steps for internal sharing while still providing adequate protection for external sharing.
3Reliability
If signed links are used for all external file access, then security against unauthorized access is improved, but ease of operation deteriorates
Solution Approach 1:
The patent segments link signing requirements by destination network: unsigned links for internal network access (maintaining ease of operation) and signed links for external network access (ensuring security). This segmentation allows the system to optimize for convenience where security risks are low and for security where risks are high.
Solution Approach 2:
The patent applies different link quality characteristics to different access scenarios: unsigned links provide simplicity for internal access, while signed links provide enhanced security for external access. This local quality ensures that operational ease is maintained where appropriate without compromising security where needed.
4Ease of operation
If cloud-based file depositories are used for external sharing, then ease of operation is improved, but reliability deteriorates due to external storage risks
Solution Approach 1:
The patent performs sensitivity evaluation and link signing as preliminary actions before files are shared externally through cloud depositories. This preliminary security measure ensures that only non-sensitive files are approved for external sharing, protecting against the inherent risks of cloud storage while maintaining the operational convenience of cloud-based sharing.
Solution Approach 2:
The patent introduces signed links as an intermediary mechanism between the internal network and external cloud depositories. These signed links act as a security gatekeeper, verifying file sensitivity and authorizing external access only when appropriate, thus mediating between the convenience of cloud storage and the need for data protection.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method includes (1) receiving a request to share a file stored on a secure network with a target, the request identifying the file and the target, (2) performing a location operation to determine whether the target belongs to the secure network, (3) when a result of the location evaluation operation indicates that the target does not belong to the secure network, performing a sensitivity evaluation operation to determine whether the file identified by the request includes sensitive information, and (4) performing an access control operation, the access control operation (i) rejecting the request when both (a) the result of the location evaluation operation indicates that the target does not belong to the secure network, and (b) a result of the sensitivity evaluation operation indicates that the file includes sensitive information, and (ii) otherwise causing a link to access the file to be provided to the target.