Security Agent Dynamic Asset Transformation for Flexible Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computing environments employ deterministic access control, which restricts work and information flow by only allowing or denying access to assets based on user authorization, failing to provide an indeterministic response to authorization requests, thereby limiting flexibility and efficiency in data access.
Innovation Solution
A method is introduced where a computing environment security agent authenticates users and determines whether to grant access to an asset, with the option to transform the asset based on user authorization, allowing access to a transformed asset transparently or through a user-selectable transformation rule, enabling indeterministic authorization and access processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If deterministic access control is used to ensure security, then security is improved, but flexibility and efficiency of data access are worsened
Solution Approach 1:
The patent transforms the static, deterministic access control into a dynamic system that can adapt responses based on authorization levels. The security agent can now return different types of responses (denial, transformation rules, or direct access) depending on the user's authorization and the asset type, making the system flexible while maintaining security.
Solution Approach 2:
The patent changes the parameter of access control from binary (allow/deny) to multi-state (deny, transform, allow). By introducing transformation rules as an intermediate state, the system can modify assets based on authorization levels, thereby improving flexibility without compromising security.
2Device complexity
If deterministic access control is used to simplify authorization processing, then processing simplicity is improved, but information flow and work flow are worsened
Solution Approach 1:
The patent introduces transformation rules as an intermediary mechanism between the security agent and the asset. Instead of simply denying access, the system can provide transformation rules that modify the asset to match user authorization levels, enabling information flow while maintaining security control.
Solution Approach 2:
The patent performs transformation actions in advance by pre-defining transformation rules for assets. When a user requests access, the system can quickly apply these pre-defined transformations rather than performing complex real-time modifications, thereby improving information flow efficiency.
3Device complexity
If binary access control is used to maintain system simplicity, then system simplicity is improved, but false positives in security logs increase
Solution Approach 1:
The patent makes the access control system dynamic by introducing multiple response types. Instead of always returning a binary deny/allow, the system can now return transformation rules that modify the asset appropriately, reducing false positives while maintaining system manageability.
4Adaptability or versatility
If transformation rules are automatically applied to assets, then access flexibility is improved, but processing complexity is worsened
Solution Approach 1:
The patent implements self-service by having the security agent automatically select and apply appropriate transformation rules based on user authorization levels. The system autonomously determines which transformation rule to apply without requiring manual intervention, thereby managing processing complexity internally while providing flexibility to users.
Data Source
AI summary
A computing environment security agent is provided for automatically determining whether to grant access to an asset, deny access to the asset, or grant access to a transformed asset responsive to an asset request by a user of the computing environment. The security agent includes logic for authenticating a user for computing environment access, for receiving a request from the authenticated user to access an asset, and for determining whether the authenticated user is authorized to access the asset, and if so, for determining whether to transform the asset responsive to the request to access the asset by the authenticated user. The security agent can further include logic for transparently transforming the requested asset or for defining at least one transformation rule for the requested asset and saving the at least one transformation rule in a transformation list accessible by the authenticated user.