Database Role Sharing for Fine-Grained Cloud Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data sharing methods are cumbersome, slow, and inefficient, particularly for smaller entities, as they require data transfer and copying, lack control over data usage by recipients, and do not allow scalable sharing, leading to latency and accessibility issues.
Innovation Solution
A cloud-based data exchange system using database roles allows data providers to create share objects that encapsulate access privileges, enabling controlled data sharing without copying, with consumers managing local access through account-level roles and database roles, allowing selective object access and secure joins.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional data sharing methods are used, then data can be shared, but the process is cumbersome and slow requiring data transfer and copying
Solution Approach 1:
The patent applies the copying principle by creating share objects that contain references to underlying data without actually copying the data itself. The share object encapsulates metadata and access privileges, allowing multiple users to access the same underlying data simultaneously without physical data duplication, thereby eliminating transfer time while maintaining access efficiency
Solution Approach 2:
The share object serves as an intermediary between data providers and consumers. It mediates the data sharing process by containing references to underlying data and managing access privileges, eliminating the need for direct data transfer and copying while enabling efficient access control and data sharing
2Ease of operation
If data is shared with recipients, then data accessibility is improved, but control over data usage by recipients is lost
Solution Approach 1:
The patent applies segmentation by dividing data access control into multiple levels: account-level roles that manage overall access, database-level roles that control specific data access, and share-level permissions that define usage restrictions. This hierarchical segmentation enables granular control over data usage while maintaining ease of access through role-based authorization
Solution Approach 2:
The patent implements local quality by allowing different levels of access control at different scopes. Each share object can have customized access privileges and restrictions tailored to specific users or groups, enabling fine-grained control over data usage while maintaining overall system accessibility through role-based management
3Adaptability or versatility
If data sharing is implemented, then data can be accessed by multiple parties, but scalability is limited and latency occurs
Solution Approach 1:
The patent applies universality by designing a multi-functional share object system that can serve multiple purposes: it acts as a data reference container, an access control mechanism, and a permission management system. This universal design enables scalable data sharing across multiple parties without introducing latency, as all access control operations are handled through the share object's built-in mechanisms rather than requiring separate data transfer and permission validation processes
Data Source
AI summary
Embodiments of the present disclosure relate to sharing data using database roles. Database roles are generated within a database container of a provider account. Grants to a particular subset of the plurality of data objects of the database container may be assigned to each of the database roles, and each of the database roles are granted to a share object. The share object is mounted within a consumer account to generate an imported copy of each of the database roles. The imported copy of one or more of the database roles is granted to each of one or more account level roles of the consumer account. When a new object is added to a particular database role, it is immediately available for consumption by any account level roles to which the imported copy of the particular database role has been granted.