Declarative Attribute Security for View Objects
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security methods in enterprise environments are inadequate as they often provide insufficient access control, allowing users to view more data than permitted by security privileges, especially when applying security at the entity object level.
Innovation Solution
Implementing declarative attribute security by associating data security privileges with custom properties of view objects, allowing for attribute-based access control, where only authorized users can view specific attributes, and redacting unauthorized data with asterisks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data security is applied at the entity object level, then data access control is simplified, but users can still access more data than permitted by security privileges
Solution Approach 1:
The patent segments security control from the entity object level to the attribute level. Instead of applying security uniformly at the object level, it divides control into individual attributes, allowing granular security privileges to be assigned to specific attributes (e.g., salary, department) of view objects. This enables precise control where users can access some attributes but not others, resolving the contradiction between simplified access control and strict privilege enforcement.
2Reliability
If attribute-based security is implemented with custom properties, then access control precision is improved, but system complexity increases
Solution Approach 1:
The patent introduces custom properties as intermediaries to bridge the gap between view objects and security privileges. These custom properties serve as metadata carriers that store security privilege information without requiring changes to the core view object structure. The base class modifications provide automated retrieval and evaluation of these custom properties, reducing the perceived complexity while maintaining high access control precision.
Solution Approach 2:
The system implements self-service security evaluation through base class modifications that automatically retrieve custom property values and determine attribute accessibility. The view objects themselves participate in the security process by exposing their custom properties, eliminating the need for external security management complexity while achieving precise attribute-level control.
3Reliability
If declarative attribute security is used, then data security is enhanced, but implementation complexity increases
Solution Approach 1:
The patent performs preliminary actions by modifying the base class to include automated security evaluation logic. This preliminary setup establishes the framework for declarative attribute security, where custom properties are automatically retrieved and evaluated without requiring complex implementation details during application development. The base class modifications pre-configure the security mechanism, making it easier to implement while maintaining strong data security.
Data Source
AI summary
In various embodiments, application development tools can allow developers to control whether or not an attribute of a view object is displayed by declaratively associating a data security privilege with the attribute. Associating a data security privilege with the attribute can be done by adding a specially named custom property on the view object attribute. Modifications to a base class can provide any necessary support to retrieve the privilege and determine whether a current user is allowed to view the attribute for the current record/row. If the user is authorized to view the attribute for the current record/row, then the attribute value is returned and displayed. Otherwise, redacting information, such as “*****” can be returned and displayed.