Hierarchical Permission Evaluation via Pre-computed Requirement Sets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Evaluating permissions in a large data repository with a hierarchical organization is computationally expensive due to overlapping permissions across multiple hierarchical levels, requiring systems to assess each level for document access control.
Innovation Solution
A server computer identifies permission sets for each hierarchical level and computes requirement sets for documents, storing these in an index to efficiently evaluate access requests by matching user identifiers against the requirement sets, thereby reducing computational complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the system evaluates permissions by checking each hierarchical level for document access control, then access control accuracy is improved, but computational complexity increases
Solution Approach 1:
The system pre-computes and stores requirement sets for each document at each hierarchical level before access requests are made. These requirement sets contain pre-processed permission information that can be quickly evaluated during access control decisions, eliminating the need to re-evaluate all hierarchical levels for every access request
Solution Approach 2:
The system creates simplified copies of permission information in the form of requirement sets that are stored in document metadata. These requirement sets are condensed representations of the full hierarchical permission structure, allowing fast evaluation without accessing the complete hierarchical permission data for each access request
2Speed
If the system pre-computes and indexes requirement sets for all documents, then access control evaluation speed is improved, but initial processing time increases
Solution Approach 1:
The system performs permission evaluation computations in advance during document creation, modification, or when permission changes occur. The requirement sets are computed and stored beforehand, so when access requests are made, the system only needs to evaluate pre-computed requirement sets rather than re-evaluating the entire hierarchical permission structure
Solution Approach 2:
The system changes the state of permission data from raw hierarchical permission sets to pre-computed requirement sets with specific parameters optimized for evaluation. The requirement sets contain pre-processed information in a format that enables fast comparison with user identifiers during access control decisions
Data Source
AI summary
Systems and methods for evaluation hierarchical permissions are described herein. In an embodiment, a system identifies a plurality of permission sets for a document that is digitally stored in a data repository system, the data repository system having a hierarchical organization, the plurality of permission sets comprising a first permission set for a first hierarchical level of the data repository system and a second permission set for a second hierarchical level of the data repository system. Using at least the first permission set and the second permission set, the system identifies a plurality of requirement sets, each of the plurality of requirement sets comprising one or more required identifiers to satisfy the requirement set. When the system receives a request to access the document, the system determines whether identifiers corresponding to the request satisfy at least one requirement set of the plurality of requirement sets and, if so, permits access to the document.