Security Rule-Set Analysis via Equivalence Class Partitioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security rule-sets face inefficiencies in auditing due to the large number of combinations required for analysis, particularly when dealing with extrinsic fields like user and application controls, which are not easily grouped into consistent subsets.
Innovation Solution
The method involves partitioning extrinsic spaces into equivalence classes, where each atomic element belongs to one class, and mapping these classes over the rule-set to generate a logically equivalent rule-set with reduced complexity, allowing for calculations per equivalence class rather than each discrete value.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If security rule-sets include detailed user and application controls with multiple extrinsic fields, then security policy coverage and control granularity are improved, but the number of combinations required for auditing increases exponentially
Solution Approach 1:
The patent segments the extrinsic space into equivalence classes based on rule membership patterns. Each equivalence class groups atomic elements (users, applications) that appear together in the same subset of rules. This segmentation transforms the auditing problem from analyzing individual element combinations to analyzing class-level patterns, dramatically reducing the combinatorial explosion while preserving security policy coverage.
2Measurement precision
If auditing analyzes each discrete value in extrinsic fields separately, then measurement precision of individual rule impacts is improved, but the time and computational resources required increase significantly
Solution Approach 1:
The patent merges the analysis of multiple discrete atomic elements by grouping them into equivalence classes. Instead of analyzing each user or application separately across all rules, the method combines elements with identical rule membership patterns into single equivalence classes. This merging preserves precise measurement of rule impacts at the class level while eliminating redundant analysis of individual elements, thereby reducing auditing time without sacrificing essential precision.
3Ease of operation
If the rule-set maintains detailed individual user and application specifications, then security control granularity is improved, but the difficulty of detecting and measuring rule interactions increases
Solution Approach 1:
The patent changes the parameter of analysis from individual atomic elements to equivalence classes defined by their rule membership patterns. This parameter transformation maintains the detailed security control granularity by preserving which specific rules apply to which groups of users and applications, while simultaneously reducing the difficulty of detecting and measuring rule interactions. The equivalence class framework provides a structured parameter space that makes interaction analysis tractable.
Data Source
AI summary
There are provided a rule-set analyzer and a method of analyzing an ordered security rule-set comprising a plurality of rules and characterized by at least one extrinsic field. The method comprises: upon specifying atomic elements constituting an extrinsic space corresponding to the at least one extrinsic field, partitioning, by a processor, the extrinsic space into two or more equivalence classes, wherein each atomic element in the extrinsic space belongs to one and only one equivalence class; mapping, by the processor, said equivalence classes over the rule-set; and analyzing, by the processor, the security rule-set using the results of mapping said equivalence classes over the rule-set.