Data Stream Access Control with ML Tagging and Client-Side Masking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data streaming platforms face challenges in providing fine-grained access control and proactive protection for sensitive data, often requiring manual intervention and complex encryption schemes, and struggle to scale for large and continuous data streams in near real-time, lacking intelligent classification and tagging mechanisms to enforce effective access policies.
Innovation Solution
A data streaming system with attribute-based access control (ABAC) that uses machine learning-based data classification tagging to automatically apply data tags and schema versions for real-time access control, enabling decentralized masking and unmasking of data items based on client permissions, with a monitoring apparatus updating schemas dynamically to manage access policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption schemes are used to protect data in data streams, then data security is improved, but system complexity and management overhead increase significantly
Solution Approach 1:
The patent extracts the access control logic from the data stream itself and places it in a separate policy server. The policy server evaluates access policies independently and returns only the necessary permission decisions to clients, rather than embedding complex encryption and access control logic within the data stream processing components. This separation reduces the complexity of key management and access control implementation.
Solution Approach 2:
The patent implements a universal attribute-based access control policy that can evaluate multiple access conditions and data types through a single policy evaluation mechanism. The policy server handles diverse access control requirements (different clients, data items, and permission levels) through a unified ABAC framework, eliminating the need for separate encryption schemes for different access scenarios.
2Reliability
If manual intervention is used for data classification and access control, then access policies can be enforced, but productivity and real-time response capability deteriorate
Solution Approach 1:
The patent implements automated data classification and tagging systems that operate without manual intervention. The system automatically analyzes data stream content, classifies data items according to predefined schemas, and applies appropriate access control tags. This automation enables real-time access policy enforcement while maintaining high data processing throughput, as the classification and policy evaluation occur programmatically rather than through manual processes.
Solution Approach 2:
The patent pre-defines access control schemas and policies before data streams are processed. Classification rules, data tags, and access policies are established in advance, allowing the system to quickly evaluate and enforce access controls during real-time data streaming without requiring manual classification decisions. This preliminary setup enables both automated enforcement and high productivity.
3Reliability
If fine-grained access control is implemented for each client, then data privacy is improved, but scalability to large numbers of clients deteriorates
Solution Approach 1:
The patent implements attribute-based access control where access permissions are determined by evaluating attributes of clients, data items, and environmental conditions rather than by individual client-specific encryption keys. This parameter-based approach allows the system to maintain fine-grained access control for numerous clients by evaluating attribute combinations dynamically, enabling scalability while preserving data privacy through policy-based rather than key-based access control.
4Reliability
If complex encryption schemes are used to protect sensitive data, then data security is improved, but ease of operation and implementation deteriorate
Solution Approach 1:
The patent introduces a policy server as an intermediary between data producers and data consumers. This intermediary handles the complex access policy evaluation and permission determination, returning simple allow/deny decisions to clients. The policy server acts as a mediator that manages the complexity of access control logic centrally, making the system easier to operate and implement while maintaining strong data security through centralized policy management rather than distributed encryption complexity.
Data Source
AI summary
Systems and methods for data streaming with attribute-based access control. A client apparatus in a data streaming system receives a message via a data stream. The message has a schema version of the schema associated therewith. The client apparatus processes the message to retrieve a record, the record including a data item and a data tag corresponding to the data item. The client apparatus, with reference to the schema version, determine whether an identifier of the client apparatus has permission to access the data item associated with the data tag. After detecting that the identifier does not have permission, the client apparatus masks the data item to produce a masked data record and releases the masked data record for further processing by the client apparatus. A monitoring apparatus of the system uses a machine learning model, such as a neural network, to identify a category for a data tag.