Association-Based Access Control Delegation for Database Entities
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access control methods for database systems require manual replication and maintenance, leading to increased development and maintenance costs, and potential inconsistencies when derived entities are created from existing entities, as they often fail to decouple the originating and derived entities effectively.
Innovation Solution
The implementation of an association-based access control delegation approach that automatically creates an implicit backreference to the originating entity when a derived entity is created, allowing access control definitions to be modified to use this backreference, thereby decoupling the entities and reducing maintenance costs while preserving flexibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual replication of access control logic is used when creating derived entities, then access control can be implemented, but development and maintenance costs increase and inconsistencies occur
Solution Approach 1:
The system creates a copy of the access control definition from the originating entity when a derived entity is created. This copy mechanism ensures that access control logic is automatically replicated without manual intervention, maintaining consistency while reducing maintenance burden. The copied access control definition is then associated with the derived entity through an implicit backreference.
Solution Approach 2:
An implicit backreference is introduced as an intermediary element that connects the derived entity to the originating entity's access control definition. This backreference acts as a mediator that allows the derived entity to inherit and apply access control rules without directly containing the full access control logic, thereby reducing complexity while maintaining reliability.
2Reliability
If access control logic is manually replicated for derived entities, then access control can be enforced, but development time and costs increase
Solution Approach 1:
The system performs preliminary action by automatically creating and associating the access control definition with the derived entity at the moment of derivation. This eliminates the need for manual replication of access control logic later, saving development time and ensuring that access control is enforced from the outset without additional manual effort.
Solution Approach 2:
The access control definition is automatically copied from the originating entity to the derived entity during the derivation process. This copying mechanism eliminates manual replication efforts, reducing development time while ensuring that access control enforcement is properly established for the derived entity.
3Reliability
If derived entities are tightly coupled with originating entities, then access control can be maintained, but flexibility in modifying derived entities is reduced
Solution Approach 1:
The implicit backreference serves as an intermediary that decouples the derived entity from the originating entity while maintaining access control preservation. This backreference allows the derived entity to reference the originating entity's access control definition without being tightly coupled, enabling independent modification of the derived entity's structure and behavior while maintaining access control integrity.
Solution Approach 2:
The system segments the relationship between originating and derived entities by introducing the implicit backreference as a separate, manageable component. This segmentation allows the derived entity to be modified independently while the access control definition remains preserved through the backreference connection, providing both reliability and flexibility.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure involves systems, software, and computer implemented methods for access control delegation. One example method includes identifying creation of a derived entity from an originating entity. A definition of the derived entity is modified to include an association to the originating entity. A derived access control definition is created based on an originating access control definition. Access control condition(s) in the derived access control definition are identified. Modified access control condition(s) are created by modifying column reference(s) to include a reference to the association to the originating entity. A query is received for the derived entity. A modified query is created by including, in the received query, the modified access control condition(s) and unfolding the association to the originating entity. The modified query is executed, including evaluation of the modified access control condition(s) to determine records of the derived entity that are accessible to a query user.