Sidecar Data Masking for Granular Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security models for data protection are inadequate as they fail to effectively control access to sensitive and non-sensitive data across multiple user levels, and they do not support advanced security features like tokenization and federated identity management, especially in diverse data sources such as databases and distributed message queues.
Innovation Solution
A system utilizing a sidecar with a data-agnostic dispatcher and various services that provide security features like authentication, tokenization, encryption, and federated identity management, which intercepts communications between clients and data sources, determines the level of access, and applies data masking to ensure secure data handling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security models with secure perimeters are used to protect data, then basic data protection is achieved, but access control for multiple user levels and advanced security features like tokenization and federated identity management are insufficient
Solution Approach 1:
The patent introduces a sidecar component as an intermediary between clients and data sources. This sidecar includes a dispatcher that intercepts communications, determines access levels, and applies appropriate data masking. The intermediary enables advanced security features like tokenization and federated identity management without requiring changes to existing data sources, thus resolving the contradiction between maintaining basic security and enabling versatile access control.
Solution Approach 2:
The security system is segmented into independent components: the sidecar, dispatcher, and various services. Each component performs a specific function (interception, access determination, data masking), allowing the system to provide granular access control for different user levels while maintaining the overall security perimeter. This segmentation enables the system to handle both basic and advanced security requirements simultaneously.
2Reliability
If data sources are modified to support advanced security features like tokenization and federated identity management, then security capability is improved, but system complexity and implementation cost increase
Solution Approach 1:
The sidecar acts as an intermediary that provides advanced security features without requiring modifications to existing data sources. It intercepts communications, performs tokenization and federated identity management operations, and returns masked data to clients. This approach maintains high security capability while minimizing system complexity and implementation cost.
Solution Approach 2:
The patent extracts advanced security functionality from the data sources themselves and places it in the sidecar component. By taking out the complexity of implementing tokenization, encryption, and federated identity management from the data sources and consolidating it in the sidecar, the system achieves high security capability while keeping individual components simple and unchanged.
3Measurement precision
If granular access control is implemented for sensitive and non-sensitive data, then data protection precision is improved, but administration complexity increases
Solution Approach 1:
The dispatcher dynamically determines the appropriate access level for each communication based on the client's authorization level and the data being accessed. It automatically applies the correct data masking strategy without requiring manual configuration for each access scenario. This dynamic behavior enables precise granular access control while reducing administration complexity through automation.
Solution Approach 2:
The system implements feedback mechanisms where the dispatcher continuously monitors communications, determines access levels, and adjusts data masking accordingly. This feedback loop ensures precise access control is maintained automatically, reducing the need for manual administration and lowering complexity while maintaining high precision in data protection.
Data Source
AI summary
A method for protecting sensitive data is described. The method includes receiving a communication for data for a data source. The method includes rewriting the communication to generate a rewritten communication. The rewritten communication utilizes data masking resources at the data source. The rewritten communication is provided to the data source. Masked data is generated by the data masking resources in response to the rewritten communication.