Database Access Control Index Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current database systems face performance issues due to the high I/O cost of evaluating access control conditions at the row level, particularly when queries are rewritten using functional evaluation, which accesses many rows despite only a few being relevant, leading to poor query performance.
Innovation Solution
Implementing an index evaluation approach for access control rewrite, where indexes are used to determine which rows satisfy access control conditions, reducing the number of rows accessed and improving efficiency, and using a query optimizer to select between index and functional evaluation based on execution costs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If functional evaluation is used to evaluate access control conditions, then access control precision is improved, but I/O cost increases significantly
Solution Approach 1:
The system pre-evaluates access control conditions by rewriting queries to use index evaluation before functional evaluation. Indexes are used to pre-identify candidate rows that satisfy access control conditions, so that when functional evaluation is performed, it only needs to evaluate a small subset of pre-filtered rows rather than all rows in the table.
Solution Approach 2:
The evaluation process is segmented into two distinct phases: first, index evaluation to quickly identify candidate rows using pre-built indexes; second, functional evaluation to precisely determine access control permissions on the reduced set of candidate rows. This segmentation allows each method to operate on an optimized input set, reducing overall computational overhead.
2Measurement precision
If query rewrite uses CHECK_ACL function for each row, then access control accuracy is improved, but query execution time increases
Solution Approach 1:
The system performs preliminary filtering using index evaluation before applying the CHECK_ACL function. Indexes are used to pre-identify candidate rows that may satisfy access control conditions, reducing the number of rows on which the expensive CHECK_ACL function must be executed.
Solution Approach 2:
The query execution is segmented into two phases: first, index-based candidate identification; second, CHECK_ACL function evaluation on the reduced candidate set. This segmentation ensures that the time-consuming CHECK_ACL function is only invoked on a small subset of rows, dramatically reducing total execution time while maintaining accuracy.
3Reliability
If all rows are accessed to evaluate access control conditions, then completeness of access control check is improved, but system performance deteriorates
Solution Approach 1:
The system performs preliminary filtering using index evaluation to identify candidate rows before performing complete access control checks. This preliminary action ensures that only rows with potential access control relevance are subjected to full evaluation, maintaining completeness while improving performance.
Solution Approach 2:
The access control verification process is segmented into two stages: first, index-based candidate row identification that maintains completeness; second, thorough CHECK_ACL evaluation on the reduced candidate set. This two-stage segmentation ensures that no potentially accessible rows are missed while avoiding unnecessary evaluation of rows that cannot satisfy access control conditions.
Data Source
AI summary
Access control rewrites generate rewritten queries that may be executed more efficiently using index evaluation to determine which rows satisfy one or more access control conditions.