Database Access Control for Multiple Parent Objects

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Database systems face computational challenges and inefficiencies when performing access control on objects with multiple parents, as existing limits on parent objects lead to increased complexity and cost, making it impractical to relax these limits without addressing the associated access control difficulties.

Innovation Solution

The method involves determining user access to database objects by employing a set of access control paths that first check for permissions independent of parent objects and then dependent on parent objects, utilizing numerical counts and references to parent objects to choose the appropriate access control path, thereby optimizing access control processes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If the limit on the number of parent objects is relaxed to allow multiple parents, then the versatility and expressiveness of database relationships are improved, but the computational cost and difficulty of performing access control significantly increases

Engineering Contradiction:

Improveability to capture different instances of parent-child relationshipsVSAvoidcomputational cost and difficulty of performing access control

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The access control process is segmented into multiple distinct paths: a first set of access control paths that do not rely on parent object permissions, and a second set that does rely on parent object permissions. This segmentation allows the system to handle multiple parent objects without requiring all paths to perform expensive parent permission checks, thereby reducing overall computational cost while maintaining the ability to support multiple parents.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary actions by maintaining a numerical count of parent objects and using this count to determine which access control path to take. By pre-calculating and storing the parent count, the system avoids performing expensive parent permission checks unless necessary, thus reducing computational overhead while still supporting multiple parent relationships.

Inventive Principle:

Principle #10Preliminary action

2Ease of manufacture

If extra copies of database objects are created to work around the parent object limit, then the system can maintain single-parent relationships, but this leads to wasteful duplication of data

Engineering Contradiction:

Improveability to maintain parent-child relationships within system limitsVSAvoidwasteful duplication of database objects

Core Design Contradiction:

Ease of manufactureVSLoss of substance

Solution Approach 1:

The database object structure is made universal by allowing a single object to have multiple parent objects directly, rather than requiring separate copies for different parent relationships. This multi-functionality enables one database object to serve multiple parent-child relationship instances without duplication, eliminating waste while maintaining ease of relationship management.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If access control checks are performed on all parent objects for every access request, then security is maintained, but system performance and response time deteriorate

Engineering Contradiction:

Improveaccess control securityVSAvoidsystem performance and access speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The access control system dynamically adapts its behavior based on the number of parent objects. When an object has only one parent, the system uses a simplified access control path. When an object has multiple parents, the system selectively applies parent permission checks only when necessary, based on the specific access control path being evaluated. This dynamic approach maintains security while optimizing performance for different scenarios.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

Instead of performing full access control checks on all parent objects for every access request, the system performs partial checks only when necessary. The numerical count of parent objects is used to determine whether to invoke the second set of access control paths that check parent permissions. This partial action approach maintains security where needed while avoiding unnecessary checks that would degrade performance.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS8688736B2Determining accessibility of database objects with multiple parents

Publication Date: 2014.04.01 SALESFORCE INC

AI summary

The technology performs database access control in a manner that decreases computational cost of the database access control with an object type definition of a database object that permit multiple parent objects. The system determines whether to grant a user access to a database object via a first set of access control paths that do not rely on whether the user has permission to access a minimum number of parent objects of the database object. Responsive to a determination not to grant the user access via the first set of access control paths, the system determines whether to grant the user access to the database object via a second set of access control paths that determine whether the user has permission to access the minimum number of parent objects of the database object.