Domain-Based Access Control for Self-Describing Data Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Implementing domain-based access control on queries in self-describing data systems is challenging due to difficulties in formulating and executing recursive search queries across dynamic data models, especially in relational databases, where changes in the data model can block query execution and result in errors.
Innovation Solution
A system and method for implementing domain-based access control on queries in self-describing data systems by determining associated domains, subdomains, user roles, and access permissions, generating outputs based on policies for each subdomain, and maintaining dynamic mappings of domain and subdomain relationships to ensure secure and efficient query execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If recursive search queries are implemented on relational databases with dynamic data models, then query functionality is enabled, but query execution is blocked when data model changes occur, resulting in errors
Solution Approach 1:
The patent implements dynamic schema validation by comparing the actual database schema with the expected schema at query execution time, rather than requiring static pre-definition. This allows the system to adapt to schema changes while maintaining query execution stability through dynamic verification and error handling mechanisms.
Solution Approach 2:
The patent introduces an intermediary layer (query validation mechanism) between the recursive search query and the relational database. This intermediary validates and adapts the query based on the current data model state, preventing direct failures when schema changes occur and enabling continued query functionality despite model evolution.
2Reliability
If domain-based access control is implemented on queries, then data security is enhanced, but system complexity increases due to multiple domain and subdomain determinations
Solution Approach 1:
The patent segments the access control system into distinct hierarchical components: domain determination, subdomain determination, role identification, and policy evaluation. This segmentation allows each component to handle a specific aspect of access control independently, making the overall complex system more manageable and maintainable while providing comprehensive security.
Solution Approach 2:
The patent adds a hierarchical dimension to access control by introducing subdomains within domains, and roles within subdomains. This multi-dimensional approach (domain → subdomain → role → policy) enables fine-grained security control without requiring a completely complex monolithic system, as each dimension adds a layer of organization and control.
Data Source
AI summary
A method for implementing access controls for items of data belonging to a self-describing data structure including obtaining a query definition specifying a requested item of data in the self-describing data structure, determining domains associated with the requested item, the domains including a set of items within the self-describing data structure on an execution path of a query executed according to the query definition. For each respective domain associated with the requested item, the method includes determining subdomains associated with the requested item, determining a role of the user for the respective domain, the role is associated with a set of access permissions to items of data within the domain, and generating an output corresponding to whether access to the requested item is granted based on a policy for each of the subdomains associated with the requested item and the role of the user for the domain.