Secure Investigation Workspaces Within Sovereign Cloud Boundaries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Investigating incidents across different sovereign clouds is challenging due to compliance boundaries that restrict data access and movement, making troubleshooting difficult and potentially illegal.
Innovation Solution
A secure investigations platform allows investigators to create ad-hoc workspaces within a compliance boundary, using a request processing system isolated from the workspace, with a control message processing system managing tasks and data ingestion, and incorporating machine learning for predictive investigation assistance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data is accessed across sovereign clouds for incident investigation, then investigation capability is improved, but compliance rules are violated
Solution Approach 1:
The system segments the investigation platform into isolated workspaces, each confined to a specific sovereign cloud boundary. Investigators are provided with dedicated workspaces that can access only the data and resources within their assigned compliance boundary, eliminating cross-boundary data access while maintaining full investigation capabilities within the permitted scope.
Solution Approach 2:
The patent introduces an intermediary layer (the workspace environment) between investigators and the underlying data sources. This intermediary enforces compliance rules by design, allowing investigators to perform analysis and generate findings without directly accessing or moving data across sovereign cloud boundaries, thus maintaining compliance while enabling investigation.
2Productivity
If investigators are granted direct access to workspaces and data, then investigation efficiency is improved, but security risks increase
Solution Approach 1:
The patent introduces an intermediary layer (the workspace environment) between investigators and the underlying data sources. This intermediary enforces compliance rules by design, allowing investigators to perform analysis and generate findings without directly accessing or moving data across sovereign cloud boundaries, thus maintaining compliance while enabling investigation.
Solution Approach 2:
The system creates isolated workspace copies or representations of the investigation environment that contain the necessary data and tools. Investigators interact with these copied environments rather than directly with production systems, enabling efficient investigation while preventing security risks through isolation.
3Reliability
If compliance boundaries are enforced across sovereign clouds, then data security is improved, but incident investigation becomes difficult
Solution Approach 1:
The system segments the investigation platform into isolated workspaces, each confined to a specific sovereign cloud boundary. Investigators are provided with dedicated workspaces that can access only the data and resources within their assigned compliance boundary, eliminating cross-boundary data access while maintaining full investigation capabilities within the permitted scope.
Solution Approach 2:
The patent creates a universal workspace environment that can be instantiated in any sovereign cloud with consistent capabilities and tools. This multi-functional approach allows the same investigation techniques and tools to be applied across different compliance boundaries, making troubleshooting equally effective regardless of which sovereign cloud contains the incident.
4Manufacturing precision
If data is moved across compliance boundaries for analysis, then investigation thoroughness is improved, but regulatory compliance is violated
Solution Approach 1:
The patent introduces an intermediary layer (the workspace environment) between investigators and the underlying data sources. This intermediary enforces compliance rules by design, allowing investigators to perform analysis and generate findings without directly accessing or moving data across sovereign cloud boundaries, thus maintaining compliance while enabling investigation.
Solution Approach 2:
The system creates isolated workspace copies or representations of the investigation environment that contain the necessary data and tools. Investigators interact with these copied environments rather than directly with production systems, enabling efficient investigation while preventing security risks through isolation.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A secure investigation platform in a sovereign cloud includes a request processing system that is a user-facing system and receives requests to prepare for an incident investigation. A control message processing system creates a workspace, within the sovereign cloud, so that an investigation can be conducted within that workspace. The request processing system does not access the workspace and the control message processing system is not available for external access by a user. Data and functionality are ingested into the workspace. The control message processing system performs investigation preparation tasks within the workspace. The results of the investigation tasks are surfaced for user access.