Unstructured Object Security Framework with Query-Based Rules

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Designing a flexible and easily-adaptable security framework for network-accessible storage services that can effectively manage access to unstructured data objects and respond to diverse security needs while minimizing overhead and ensuring granular control.

Innovation Solution

Implementing a multi-faceted security framework that supports container-based, object-level, user/group-based security rules, along with query-based and accumulated records-based rules, which utilize probabilistic analytics tools for adaptive security enforcement, allowing for complex query predicates and transformation functions to manage access and protect sensitive data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If a security framework supports multiple types of security rules (container-based, object-level, user/group-based, query-based, accumulated records-based) with probabilistic analytics tools, then security control granularity and adaptability are improved, but system complexity and overhead increase

Engineering Contradiction:

Improvesecurity control granularityVSAvoidsystem complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The security framework is divided into multiple independent rule types (container-based, object-level, user/group-based, query-based, accumulated records-based) that can be applied separately to different data access scenarios. Each rule type operates independently with its own evaluation logic, allowing granular security control without requiring a monolithic complex system.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The security framework implements a universal rule evaluation engine that can process multiple types of security rules through a common architecture. The system uses a unified interface for specifying security rules while supporting diverse rule types, reducing overall system complexity through multi-functionality.

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Measurement precision

If query-based security rules with arbitrary complexity are supported, then security enforcement precision is improved, but processing overhead and evaluation time increase

Engineering Contradiction:

Improvesecurity enforcement precisionVSAvoidevaluation time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system pre-compiles query predicates into optimized evaluation forms and pre-evaluates conditions that can be determined in advance. By performing preliminary actions on query preparation and condition assessment, the system reduces the time required for runtime evaluation while maintaining precise security enforcement.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The security rule evaluation system automatically optimizes query predicates and selects appropriate evaluation strategies without requiring manual intervention. The system self-adjusts the evaluation process based on the complexity of queries and the characteristics of the data being accessed, reducing processing overhead while maintaining precision.

Inventive Principle:

Principle #25Self-service

3Reliability

If accumulated records-based security rules with probabilistic analytics are implemented, then adaptive security response to threats is improved, but computational overhead and resource consumption increase

Engineering Contradiction:

Improveadaptive security responseVSAvoidcomputational overhead

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system applies probabilistic analytics selectively to accumulated records based on threat indicators and risk thresholds. Rather than continuously analyzing all records with full probabilistic models, the system performs partial analysis only when security conditions warrant it, reducing computational overhead while maintaining reliable adaptive security response.

Inventive Principle:

Principle #16Partial or excessive action

4Object-affected harmful factors

If transformation functions are applied to objects as part of security enforcement, then data protection capability is improved, but processing time and computational resources increase

Engineering Contradiction:

Improvedata protection capabilityVSAvoidprocessing throughput

Core Design Contradiction:

Object-affected harmful factorsVSProductivity

Solution Approach 1:

The system extracts and applies only the necessary transformation functions to specific portions of objects that require security enforcement, rather than processing entire objects. By taking out only the relevant data portions that need transformation, the system improves data protection capability while minimizing the impact on processing throughput.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS11275850B1Multi-faceted security framework for unstructured storage objects

Publication Date: 2022.03.15 AMAZON TECH INC

AI summary

At an object storage service, one or more security rules to be implemented for a request directed to an unstructured object are identified, including a content query-based rule. The query-based rule indicates a query predicate and a security enforcement action. A value of an attribute is extracted from the unstructured object using a rule obtained via a programmatic interface, and used to verify that the predicate is satisfied. The security enforcement action is then implemented.