Cloud Database Certification Through Limited Consumer Views
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud database platforms like Snowflake struggle to efficiently manage data sharing among consumers with varying access permissions, leading to cumbersome and resource-intensive processes due to the need for duplicating and processing data, which can result in inefficiencies and potential data breaches.
Innovation Solution
Implementing limited consumer view definitions that allow data producers to set access rules without modifying or copying the underlying data, enabling consumers to access only permitted data portions through virtual warehouses, thereby ensuring compliance with permissions and reducing resource waste.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is duplicated and processed for different consumers with varying access permissions, then data access control and security are improved, but storage efficiency and resource utilization deteriorate
Solution Approach 1:
The patent uses virtual copies of data through view definitions rather than physical duplications. Multiple consumers can access the same underlying data through different virtual views that enforce their specific access permissions, eliminating the need to create and maintain multiple physical data copies while still providing customized access control for each consumer.
Solution Approach 2:
The underlying data storage serves multiple consumers simultaneously through a single instance. The system provides universal access to the same data repository while applying different permission sets and view definitions for each consumer, allowing one data storage system to fulfill multiple access control requirements without duplication.
2Reliability
If data is copied and processed for each consumer, then access permissions can be enforced, but processing time and computational resources increase
Solution Approach 1:
Access permissions and view definitions are established in advance for each consumer before actual data access occurs. The system pre-configures what data each consumer can access and under what conditions, so that when queries are executed, the permission checks are already in place and do not require time-consuming processing during data retrieval operations.
Solution Approach 2:
Instead of copying data for permission checking, the system copies the access control metadata (view definitions and permission sets) and applies them to queries against the single underlying data source. This approach enforces permissions efficiently without the overhead of processing multiple physical data copies.
3Reliability
If traditional data sharing methods are used, then data security and access control are maintained, but data freshness and real-time access deteriorate
Solution Approach 1:
The patent creates virtual copies of data access paths rather than physical data copies. Multiple consumers access the same real-time data through virtual views that enforce security permissions, ensuring data freshness while maintaining security. The virtual view layer provides security enforcement without creating data replication delays.
4Adaptability or versatility
If data is duplicated for different consumers, then access permissions can be customized, but system complexity and maintenance burden increase
Solution Approach 1:
The patent segments access control into separate view definitions for each consumer rather than duplicating data. Each consumer gets a customized view that defines their specific access permissions, while the underlying data remains unified. This segmentation of access control logic from data storage reduces system complexity compared to maintaining multiple data copies with different permission settings.
Data Source
AI summary
Methods, systems, and apparatuses for providing access to records of a database stored on a database server in a cloud database platform are described herein. A data sharing platform may determine a shared view definition for access to the database. The data sharing platform may determine rules that specify criteria that limit access to the records stored by the database. The one or more first rules may be received via a user interface. The data sharing platform may perform, based on the rules, a data access certification process on the records stored by the database to generate a table of certification results. The data sharing platform may generate, based on the table of certification results, and without modifying the records stored by the database, a limited consumer view definition. Based on updates to the records, a new limited consumer view definition may be generated.