Database Roles for Native Apps in Secure Data Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data sharing methods are cumbersome, slow, and insecure, making it difficult for smaller entities to access valuable data sets, and traditional methods do not allow scalable sharing or real-time access.
Innovation Solution
A data exchange platform using cloud computing services allows data providers to create share objects that grant controlled access to database objects, enabling secure data sharing without copying, and supports native applications that can be shared and installed by consumers, facilitating data processing without exposing sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional data sharing methods are used, then data can be shared between entities, but the process is cumbersome and slow
Solution Approach 1:
The patent uses share objects that create virtual copies of database object access rights without physically copying the actual data. The share object contains metadata and grant information that allows consumers to access provider's database objects through a lightweight reference mechanism, eliminating the need to copy large volumes of data while enabling fast access.
Solution Approach 2:
The share object acts as an intermediary between data providers and consumers. It contains grant metadata that mediates access control, allowing consumers to access provider's database objects through controlled interfaces without direct exposure to the underlying data storage mechanisms, thus enabling efficient and secure data sharing.
2Reliability
If data is shared using traditional methods, then access is possible, but security is compromised and sensitive information may be exposed
Solution Approach 1:
The patent implements fine-grained access control by granting specific privileges (SELECT, INSERT, UPDATE, DELETE) on specific database objects (tables, views, columns) to specific roles. This local quality approach allows the data provider to precisely control what each consumer can access, ensuring security while maintaining ease of operation through role-based access management.
Solution Approach 2:
The share object serves as a security intermediary that encapsulates all access control logic. It contains grant metadata that defines exactly what database objects can be accessed and under what conditions, acting as a mediator between the provider's security requirements and the consumer's access needs, thus simplifying security management.
3Productivity
If data is copied for sharing, then access is enabled, but storage space is consumed and latency increases
Solution Approach 1:
Instead of copying actual data, the system copies only the access rights metadata in share objects. The share object contains grant information that references the provider's database objects, allowing consumers to access data through these lightweight references without duplicating the underlying data storage, thus eliminating storage space consumption while maintaining fast access speeds.
4Adaptability or versatility
If smaller entities want to access valuable data sets, then data sharing is needed, but traditional methods are not scalable
Solution Approach 1:
The share object is a universal mechanism that can share any database object (tables, views, materialized views) with any number of consumers under different access conditions. This multi-functional approach allows a single share object to serve multiple purposes and multiple consumers, making the system highly scalable and adaptable without increasing complexity for each additional user or object type.
Data Source
AI summary
Embodiments of the present disclosure related to sharing applications within a data sharing platform. An example method includes replicating a database from a provider account of a data sharing platform to a consumer account of the data sharing platform. The method further includes executing an installation script within the consumer account to install an application in the consumer account of the data sharing platform responsive to the replicating. The method further includes creating, by a processing device, a set of database roles to manage execution of the application in the consumer account, wherein one or more of the set of database roles determine access privileges granted to the application for accessing the database inside the consumer account. The application is to perform a data processing service relative to a data asset in the database.