Cell-Level Access Provisioning for Least-Privilege Data Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data engineering applications face challenges in providing secure, high-granularity data access due to overprivileged permissions, leading to unauthorized data access and inefficient solutions in decoupled storage-compute architectures.
Innovation Solution
A cloud computing system generates a restricted logical view for accessing a limited set of data based on downstream requests, assigns compute clusters to this view, and limits access to a specific user group, providing cell-level security and dynamically updating access permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If file level security techniques are used to grant access to data, then ease of operation is improved, but data security deteriorates due to overprivileged permissions
Solution Approach 1:
The patent segments data access control from file-level to cell-level granularity. It divides data into tables, columns, and rows, creating logical views that expose only specific cells to authorized users. This segmentation enables precise control over which data elements are accessible, eliminating the overprivileged permissions inherent in file-level security while maintaining ease of operation through automated view generation.
Solution Approach 2:
The patent applies local quality by assigning different access permissions to different cells within the same data structure. Instead of uniform file-level permissions, each cell can have its own access control characteristics based on sensitivity, ownership, and user roles. This allows highly sensitive cells to be protected while less sensitive cells remain accessible, resolving the contradiction between ease of access and data security.
2Reliability
If cell-level security control is implemented, then data security is improved, but device complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-defining security policies, user roles, and data classifications before access requests occur. The system pre-generates logical views that encode cell-level permissions, so when a user requests access, the view is already configured with appropriate security constraints. This eliminates the need for complex real-time permission evaluation, reducing system complexity while maintaining high security.
Solution Approach 2:
The patent introduces logical views as an intermediary layer between users and the underlying data structure. These views act as mediators that translate complex cell-level security requirements into simplified access interfaces. Users interact with the view rather than directly with the data, and the view automatically enforces security policies, reducing the complexity burden on both the system and users.
3Device complexity
If traditional file level security is used, then device complexity is reduced, but access precision deteriorates leading to overprivileged permissions
Solution Approach 1:
The patent adds another dimension to access control by moving from two-dimensional file-level permissions to a three-dimensional cell-level control structure (table, column, row). This dimensional expansion enables precise targeting of specific data elements without proportionally increasing system complexity, as the additional granularity is managed through structured logical views rather than complex permission matrices.
Data Source
AI summary
Example aspects include techniques for provisioning downstream access to requested data within a data lake with cell-level granularity. These techniques include receiving a request for downstream access to filtered data from a data lake, generating a logical view to the data lake based on the request, the logical view restricted to the filtered data, and generating a temporary storage location for storing retrieved data received from the data lake via the logical view. The techniques also include assigning a compute cluster to the logical view, and accessing, via the logical view, by the compute cluster, the filtered data including storing the filtered data within the temporary storage location.