Security Abstraction Layer for Encrypted Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies face challenges in preventing unauthorized access to data stored on computing platforms, as authentication methods do not adequately ensure that only authorized entities can access sensitive data, leaving a vulnerability to malicious applications and unauthorized entities.
Innovation Solution
Implementing a system with encryption and decryption processes managed by a secondary layer that supplements data storage services, using appliances to control access based on security policies and authentication, and employing a security abstraction layer to authorize access requests by comparing user or application identities against access control lists.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication processes are used to verify identity before data access, then data security is improved, but system complexity increases due to additional authorization layers
Solution Approach 1:
The patent segments the data storage system into distinct layers: a data storage layer for holding encrypted data and a security abstraction layer for managing authorization. This segmentation allows each layer to have specialized functions, improving security without requiring the entire system to become more complex. The security layer handles authentication and authorization independently from the storage operations.
Solution Approach 2:
The security abstraction layer acts as an intermediary between authenticated users and the encrypted data in storage. This intermediary layer manages the complexity of authorization by providing a standardized interface that handles security policies, access control lists, and decryption permissions without exposing the underlying complexity to either users or the storage system.
2Reliability
If encryption is implemented to protect stored data, then data security is improved, but access interoperability may deteriorate due to decryption requirements
Solution Approach 1:
The security abstraction layer serves as an intermediary that handles decryption operations. Authorized users interact with this layer, which automatically manages the decryption process based on stored credentials and access policies. This maintains interoperability because users don't need to understand or implement decryption logic themselves - the intermediary handles it transparently.
Solution Approach 2:
The system maintains copies of decryption keys and authorization credentials in the security abstraction layer. This allows multiple authorized users to access the same encrypted data without sharing actual cryptographic keys, preserving interoperability while maintaining security. Each user has their own authenticated session with the security layer.
3Measurement precision
If access control lists are maintained to manage authorized entities, then authorization precision is improved, but device complexity increases due to additional management overhead
Solution Approach 1:
The patent separates access control list management from data storage operations by placing it in the security abstraction layer. This segmentation allows precise authorization control through structured access control lists while keeping the storage system simple. The security layer independently manages user credentials, permissions, and access policies without complicating the core storage functionality.
Data Source
AI summary
Embodiments of methods and/or systems to authorize access to stored data are disclosed.