Data Access Control Policy Evaluation via External Attribute Acquisition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data access control methods face challenges in maintaining and managing access control policies due to the need for frequent updates in database structures, leading to enlarged policy descriptions and increased complexity.
Innovation Solution
A data access control method that acquires a rule for data access based on a preset access control policy, optionally acquiring attribute information from outside a database, and either evaluating the rule with the attribute information or instructing the database to filter data based on the rule.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control policies are updated frequently to match database structure changes, then access control accuracy is improved, but policy maintenance complexity increases
Solution Approach 1:
The system enables self-service by automatically acquiring attribute information from external sources and using it to evaluate access rules. The policy determination unit automatically obtains updated attribute data without manual intervention, allowing the system to adapt to database changes autonomously while maintaining accurate access control.
Solution Approach 2:
The system performs preliminary action by pre-acquiring and storing attribute information about data records from external sources before access requests are made. This advance preparation ensures that when access control decisions are needed, the necessary attribute data is already available, eliminating the need for frequent manual policy updates.
2Reliability
If attribute information is acquired from external sources for every access request, then access control accuracy is improved, but processing time increases
Solution Approach 1:
The system applies partial action by selectively acquiring attribute information only when necessary for rule evaluation. The policy determination unit evaluates whether external attribute data is needed based on the specific access request and rule requirements, avoiding unnecessary external queries and reducing processing time while maintaining accuracy when needed.
Solution Approach 2:
The system performs preliminary acquisition of attribute information and caches it for future use. By obtaining attribute data in advance and storing it locally, the system reduces the need for repeated external queries during access control decisions, significantly reducing processing time while maintaining access control accuracy.
3Device complexity
If all attribute information is stored within the database, then system complexity is reduced, but adaptability to external data sources decreases
Solution Approach 1:
The system achieves universality by designing the policy determination unit to handle multiple data sources seamlessly. It can evaluate access rules using attributes from both internal database storage and external sources uniformly, making the system adaptable to various data source configurations without increasing apparent complexity for users.
Solution Approach 2:
The system introduces an intermediary mechanism in the form of the policy determination unit that mediates between the database and external attribute sources. This intermediary layer manages the complexity of external data integration internally while presenting a simplified interface to users, allowing the system to adapt to external data sources without exposing complexity.
Data Source
AI summary
A policy determination unit acquires a rule for a request for accessing data based on a preset access control policy, and selects whether to acquire attribute information about an attribute of each record of the data from the outside of a database in which the data is stored. As a result, when selecting acquisition of the attribute information, the attribute information is acquired and the rule based on the attribute information is evaluated, and when selecting no acquisition of the attribute information, the database is caused to execute filtering of the data based on the rule. Then, based on the evaluation result of the rule or the filtering execution result, a record of the data corresponding to the access request is acquired from the database.