Hierarchical Record-Level Security Using Tree Nodes and Tags
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security systems lack efficient and simple methods to secure data records in a hierarchical format, leading to delays and inefficiencies in querying and access control.
Innovation Solution
A hierarchical record-level security architecture utilizing a tree data structure with self-referencing nodes, allowing for both static and rules-based assignments of user accounts and object records, and tagging object records with accessible nodes for faster querying and secure access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional flat security models are used, then implementation is simple, but they cannot efficiently secure hierarchical data structures
Solution Approach 1:
The patent implements a nested hierarchical security tree structure where parent nodes contain child nodes, and each node represents a security domain. This nesting approach allows the security architecture to naturally model hierarchical data structures (folders, files, records) while maintaining simple assignment rules at each level, resolving the contradiction between hierarchical adaptability and architectural complexity
Solution Approach 2:
The security tree nodes serve multiple functions: they define security boundaries, establish inheritance relationships, enable efficient querying through node tags, and support both static and dynamic access control. This multi-functionality allows a single hierarchical structure to address various security requirements without proportionally increasing complexity
2Reliability
If security checks are performed at runtime for each record, then access control is secure, but runtime delays increase
Solution Approach 1:
The patent performs security assignments and node tag assignments in advance during data ingestion or security policy definition, rather than at runtime. When a record is accessed, the system simply checks pre-computed node tags on the record against the user's position in the security tree, eliminating the need for complex runtime security evaluations while maintaining secure access control
Solution Approach 2:
Instead of traversing the entire security tree at runtime to determine access, the system creates a copy of the relevant security information in the form of node tags attached to each record. This copy allows for O(1) access time complexity while the full security tree structure remains intact for policy management and updates
3Productivity
If detailed node tagging is implemented for fast querying, then data processing speed improves, but system complexity increases
Solution Approach 1:
The patent extracts the essential security identification information from the complex hierarchical security tree and places it directly on the record as simple node tags. This extraction transforms the complex tree traversal problem into a simple tag matching operation, dramatically improving query speed while adding only minimal overhead to the record structure (a few identifier fields rather than nested hierarchy references)
Data Source
AI summary
A method for providing secure and hierarchical access to an object record includes generating a tree data record including a root node data record and a multiple dependent node data records. The method further include receiving a request to perform an action on the object record. The method further includes determining the first dependent node data record based on the user account being assigned to the first dependent node data record and determining the second dependent node data record based on the second dependent node data record depending from the first dependent node data record. The method further includes determining the at least one node tag of the object record is associated with at least one of the first dependent node data record or the second dependent node data record. The method further includes executing the action on the object record.