Column-Level RBAC Using Data Tags and Usage Scenarios
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Role-Based Access Control (RBAC) systems are limited to row-level access security, requiring manual updates and are prone to errors, failing to provide dynamic updates and ensuring least privilege access at a column level.
Innovation Solution
Implementing a system that assigns data tags to database attributes, associates them with usage scenarios, and user roles, dynamically updating access permissions based on these associations to provide column-level security and ensure least privilege access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional RBAC is used for access control, then row-level access security is provided, but column-level security and dynamic updates are not available
Solution Approach 1:
The patent segments access control from row-level to column-level by introducing data tags that can be assigned to specific columns. This allows different access permissions to be granted for different columns within the same row, enabling fine-grained column-level security while maintaining the existing RBAC framework.
Solution Approach 2:
The patent implements dynamic access control by establishing automated workflows that respond to system changes. When changes occur in the system, the workflow automatically updates access permissions without requiring manual administrator intervention, making the access control system adaptive and dynamic.
2Reliability
If manual updates of RBAC configuration are performed, then access permissions can be updated, but the process is cumbersome and prone to error
Solution Approach 1:
The patent implements self-service access control updates through automated workflows. When system changes occur, the workflow automatically determines the appropriate access permission updates and applies them without requiring manual administrator intervention, reducing errors and improving reliability.
Solution Approach 2:
The patent establishes a feedback mechanism where system changes are automatically detected and fed into the workflow system. The workflow then processes this feedback and automatically updates access permissions accordingly, creating a closed-loop system that reduces manual intervention and improves accuracy.
3Productivity
If traditional RBAC is implemented, then basic access control is achieved, but dynamic updates and automated responses to system changes are not provided
Solution Approach 1:
The patent implements preliminary action by pre-defining data tags and their associated access permissions before they are needed. When data is tagged, the corresponding access control rules are automatically applied, eliminating the need for manual configuration and speeding up the access control update process.
Solution Approach 2:
The patent enables self-service automated updates through workflows that automatically respond to system changes. The system monitors for changes, determines the appropriate permission updates needed, and applies them automatically without requiring administrator intervention, significantly improving update efficiency.
Data Source
AI summary
Example aspects include techniques for role based access control for data. These techniques may include assigning a data tag to an attribute of a plurality of database rows of a database table, the data tag identifying a pre-defined category associated with the attribute and generating an association between the data tag and a data usage scenario, the association indicating that the attribute is accessible to a plurality of requests associated with the data usage scenario. In addition, the techniques may include associating a user role to the data usage scenario, and determining, in response to a request, a permission of an account based on the data usage scenario and the user role associated with the request. Further, the techniques may include providing the attribute for a database row of the plurality of database rows based on the permission.