Policy-Based Digital Vault Rotation for Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Role-based access control (RBAC) techniques are vulnerable to attacks such as password theft and session hijacking, necessitating improved data protection methods.
Innovation Solution
Implementing policy-based digital vault rotation, where data is stored in multiple digital vaults and moved between them based on rotation criteria, using a vault proxy service to manage access and encryption, creating a secure storage network that reduces the risk of data breaches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in a single digital vault, then access is simple and direct, but security is vulnerable to password theft and session hijacking
Solution Approach 1:
The patent divides the digital storage system into multiple digital vaults instead of using a single vault. Each vault can be independently accessed and managed, distributing the security risk across multiple locations. This segmentation prevents a single point of failure and makes password theft less effective when multiple vaults are involved.
Solution Approach 2:
The patent implements dynamic vault selection based on rotation policies. The system automatically selects different digital vaults for storing data based on predefined criteria such as time, location, or security status. This dynamic approach creates a moving target that complicates attacks like session hijacking, as the data location changes over time according to policy rules.
2Reliability
If data is rotated between multiple digital vaults, then security against attacks is improved, but the complexity of managing access and movement increases
Solution Approach 1:
The patent implements self-service through automated rotation policies. The system automatically manages data movement between vaults based on predefined criteria without requiring manual intervention. The rotation policy engine continuously monitors storage conditions and autonomously selects appropriate vaults, reducing the operational burden on administrators while maintaining security.
Solution Approach 2:
The patent introduces a vault proxy service as an intermediary between data access requests and the actual digital vaults. This proxy service handles the complexity of vault selection, data movement, and access management, shielding users from the underlying complexity. The proxy service translates simple access requests into appropriate vault operations based on rotation policies.
3Object-affected harmful factors
If a rotation policy is implemented to select different digital vaults, then the risk of unauthorized access is reduced, but the system requires additional policies and criteria management
Solution Approach 1:
The patent uses parameter changes in the rotation policy to control data storage decisions. Instead of complex rule-based policies, the system changes parameters such as time intervals, location identifiers, or security levels to determine vault selection. This parameter-driven approach simplifies policy management compared to complex rule-based systems, as parameters are easier to define, modify, and automate.
Data Source
AI summary
Techniques are provided for data protection using policy-based digital vault rotation. One method comprises obtaining data to be stored; selecting one of multiple digital vaults; and storing the data in the selected digital vault, wherein a different one of the multiple digital vaults is selected using a rotation policy in response to rotation criteria being satisfied and wherein the data is moved to the selected different digital vault. The multiple digital vaults may comprise multiple digital vaults having different memory spaces on a given device and/or multiple digital vaults on different devices. The multiple digital vaults may only respond to a designated vault proxy service. An active digital vault may be identified using the rotation policy in response to a request for data and the data may be retrieved from the active digital vault and provided to a requester associated with the request.