Flat Data Structure Access Control via Ancestor Inheritance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in efficiently distributing analytics content with tailored access rights to various tenants, particularly when using flat file structures, as they lack a straightforward method to manage hierarchical access permissions, leading to complex recursion and performance issues.
Innovation Solution
A method is implemented where a flat data structure and permissions table are processed to create an effective permitted structure, such as a tree, to recursively determine nearest ancestors and inherit access rights, allowing private distribution of analytics content to users with appropriate permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a flat file structure is used to store analytics content, then storage and retrieval are simple, but managing hierarchical access permissions becomes complex and inefficient
Solution Approach 1:
The patent segments the flat file structure into hierarchical components by introducing ancestor-descendant relationships. The system divides access control into per-user, per-item direct access rights and inherited access rights through ancestry chains, allowing complex permission management while maintaining a relatively simple underlying data structure.
Solution Approach 2:
The patent introduces an intermediary mechanism (ancestor tracking and inheritance logic) that mediates between the simple flat file structure and the complex access control requirements. This intermediary layer handles the complexity of hierarchical permissions without requiring the underlying data structure to become complex.
2Measurement precision
If direct access rights are granted for each user-item pair, then access control precision is high, but the number of permission entries and processing overhead increases significantly
Solution Approach 1:
The patent merges direct access rights with inherited access rights from ancestors. Instead of requiring separate permission entries for every user-item pair, the system combines explicit permissions with implicit permissions derived from the hierarchical ancestor relationship, reducing the total number of permission entries while maintaining precise access control.
Solution Approach 2:
The ancestor relationship serves multiple functions: it defines hierarchical structure, enables inheritance of access rights, and provides a mechanism for efficient permission management. This universal structure allows the system to handle both direct and indirect access control requirements through a single framework.
3Productivity
If hierarchical access inheritance is implemented, then access rights management becomes more efficient, but determining nearest ancestors requires complex recursion
Solution Approach 1:
The patent performs preliminary actions by pre-establishing the ancestor-descendant relationships and maintaining the flat file structure with ancestor information. This preliminary structuring allows the system to efficiently determine nearest ancestors without requiring complex recursion during access control operations, as the hierarchical relationships are already encoded in the data structure.
Data Source
AI summary
A distribution network may efficiently communicate items/item details in a private manner, with different access rights tailored to various tenants residing within a same or different customer landscape. A first input comprising a flat file with items/item details, is received. A second input comprising permissions entries for per-user, per-item direct access rights (e.g., view, read, write, delete) is also received. The first and second inputs are recursively processed to find nearest ancestors having the direct access rights, with a hash maintained including the nearest ancestors. An effective permitted structure (e.g., tree comprising root and leaf nodes) is generated by recursively adding descendant items having inherited access rights, to the nearest ancestors. Ultimately, descendant item(s) are privately distributed to a user with an access right according to the effective permitted structure. Embodiments may be particularly suited to the private distribution of analytics content (e.g., dimensions, stories, views) to various tenants.