Storage Access Control via Policy Segmentation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing access control techniques for storage devices connected to computers are inefficient and cumbersome for designers to implement, lacking a comprehensive solution to manage access based on both current and secondary security policies.

Innovation Solution

A system that identifies a current security policy and a secondary access control state for a computing device, determining an access state by combining both policies to control access to storage devices, using a control module and access guard to enforce access permissions based on access state vectors and security policy operators.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If multiple security policies are applied to storage devices, then security is improved, but device complexity increases

Engineering Contradiction:

ImprovesecurityVSAvoidaccess control implementation

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The access control system is segmented into distinct components: a control module that manages policy evaluation and an access guard that enforces access decisions. This segmentation allows multiple security policies to be evaluated without creating a monolithic complex system, as each component has a specific responsibility in the access control workflow.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary evaluation of the secondary access control state before final access decisions are made. By pre-evaluating the device's current security state and comparing it against the current security policy, the system prepares access decisions in advance, reducing the complexity of real-time access control management.

Inventive Principle:

Principle #10Preliminary action

2Measurement precision

If secondary access control state is evaluated, then access control precision is improved, but processing time increases

Engineering Contradiction:

Improveaccess control state determinationVSAvoidaccess decision time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The control module pre-evaluates the secondary access control state of the storage device and caches this information. When access requests are made, the system uses this pre-evaluated state information to quickly determine access permissions, avoiding repeated evaluation of the device's security state and reducing processing time while maintaining precision.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If cascading security policies are implemented, then security reliability is improved, but ease of operation deteriorates

Engineering Contradiction:

ImprovesecurityVSAvoidaccess control management

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The access control system operates autonomously by automatically evaluating the secondary access control state, comparing it with the current security policy, and determining access permissions without requiring manual intervention. The control module and access guard work together to self-manage the cascading security policies, reducing the operational burden on users while maintaining high security reliability.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS8387109B2Access control state determination based on security policy and secondary access control state

Publication Date: 2013.02.26 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

In accordance with one or more aspects, a current security policy for accessing a device or volume of a computing device is identified. A secondary access control state for the device or volume is also identified. An access state for the device is determined based on both the current security policy and the secondary access control state.