Federated Query Access Control With Attribute-Level Data Masking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing federated query engines are time-consuming and resource-intensive, and they often result in data duplication and security vulnerabilities due to repeated data pulling and lack of dynamic access controls.
Innovation Solution
Implement attribute-level access control techniques to manage federated queries, allowing for dynamic masking of data based on user and data source characteristics, thereby enhancing security and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing federated query engines repeatedly pull data segments from disparate remote data sources to resolve complex federated queries, then complete query results can be obtained, but the process becomes time consuming and resource intensive
Solution Approach 1:
The system performs preliminary actions by pre-fetching data segments from remote data sources before the federated query is fully resolved. The query engine identifies required data segments, retrieves them in advance, and stores them in local memory, so that when the query execution reaches those segments, the data is already available locally, eliminating repeated network pulls and reducing query resolution time
2Productivity
If existing federated query engines repeatedly pull data segments from remote data sources, then query results are generated, but data duplication and security vulnerabilities occur
Solution Approach 1:
The system applies local quality by implementing location-aware data handling where data segments are fetched from remote sources and stored in local memory for subsequent query operations. This allows the query engine to process data locally without repeated remote access, reducing both data duplication across multiple pulls and security vulnerabilities by limiting exposure of sensitive data in transit and at remote locations
3Ease of operation
If existing federated query engines process queries without dynamic access controls, then query execution is simplified, but security vulnerabilities arise
Solution Approach 1:
The system implements dynamic access controls that adapt to the specific federated query being executed. The query engine evaluates access control policies in real-time based on query characteristics, user credentials, and data sensitivity, dynamically determining which data segments can be accessed and how they should be masked. This maintains operational simplicity for legitimate queries while providing robust security against vulnerabilities
Data Source
AI summary
Various embodiments of the present disclosure provide access control for data provided by a federated query system based on attributes of a federated query. The techniques include determining a user identifier associated with a federated query, determining a set of access controls for a plurality of third-party data sources based on the user identifier, and generating an execution plan for resolving the federated query via one or more executable tasks with respect to the plurality of third-party data sources. The techniques also include generating, using a first portion of the execution plan, a result set that comprises information aggregated from the plurality of third-party data sources in accordance with the federated query. The techniques also include generating, using a second portion of the execution plan, a user result set that masks a portion of the information for the result set in accordance with the set of access controls.