Secure Enterprise Search Filtering by User Access Rights
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing search systems in computerized environments fail to securely present search results, allowing unauthorized access to objects identified by users, as they do not adequately filter results based on user permissions.
Innovation Solution
A method and apparatus for secure searching in a computerized system that identifies and filters objects based on user-provided search criteria, including permissions, and displays only representations of objects accessible to the user, while allowing owners to grant access rights to objects for which the user lacks sufficient permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If search systems present all found items according to search keywords, then search completeness is improved, but security is worsened due to unauthorized access to objects
Solution Approach 1:
The search results are segmented into two distinct groups: accessible objects and non-accessible objects. This segmentation allows the system to maintain search completeness by identifying all matching objects while simultaneously protecting security by separating and differently treating objects based on user permissions. The segmentation is achieved through permission verification that divides the result set into viewable and non-viewable portions.
Solution Approach 2:
The system introduces an intermediary permission verification mechanism between the search query and the result presentation. This intermediary layer checks user permissions against object access rights and filters the results accordingly, allowing the system to maintain both search completeness (by finding all matches) and security (by blocking unauthorized access through the intermediary filter).
2Object-affected harmful factors
If search systems filter results based on user permissions, then security is improved, but search completeness is worsened by excluding accessible objects
Solution Approach 1:
Instead of filtering out accessible objects (which would lose information), the system inverts the approach by filtering out only non-accessible objects while preserving accessible ones. The permission verification process identifies objects the user cannot access and excludes only those from the results, while objects with proper access rights are included, thus maintaining search completeness for authorized content while ensuring security.
3Loss of information
If all search results are displayed to users, then information availability is improved, but data security is worsened
Solution Approach 1:
The system applies local quality by treating different search results differently based on their security attributes. Each object in the search results is evaluated individually for user permissions, and the presentation quality varies locally: accessible objects are displayed with full information, while non-accessible objects are excluded or marked. This local differentiation maintains information availability for authorized content while ensuring data security through targeted filtering.
Data Source
AI summary
A method for a secure search in a computerized system having a storage, comprising searching for objects in the storage of the computerized system according to search criteria provided by a user wherein the criteria comprise at least one attribute of the objects, identifying objects that meet the criteria and displaying representations respective of identified objects that are accessible to the user, and an apparatus for performing the same.