Logical Expression Permissions for Row-Level Database Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing row-level security (RLS) systems require manual definition of permissions for each row and user, leading to significant maintenance overhead and inefficiencies, especially when new data is added or users with full access are managed.
Innovation Solution
Implement a permissions object that uses logical expressions and operators to define access permissions, allowing for a single string to represent complex authorization rules, reducing the need for manual enumeration and improving maintenance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional row-level security is used with manual permission lists for each user and row, then data access control is achieved, but the system complexity and maintenance overhead increase significantly
Solution Approach 1:
The patent uses templates to define permission criteria that can be copied and applied to multiple users and rows. Instead of manually creating individual permission entries for each user-row combination, administrators create a template once with the desired access criteria, and this template is then reused across multiple instances, dramatically reducing the complexity of permission management while maintaining reliable access control.
Solution Approach 2:
The permission templates are designed to be universal and reusable across different users, rows, and even different tables. A single template can serve multiple functions by being applied to various contexts with different parameters, eliminating the need for separate permission definitions for each user-row pair and reducing overall system complexity.
2Reliability
If traditional row-level security is used with manual permission lists for each user and row, then data access control is achieved, but the time required to add new rows or users increases significantly
Solution Approach 1:
The patent implements templates that pre-define permission criteria, user roles, and access conditions in advance. When new users or rows are added to the system, the pre-configured templates can be automatically applied or quickly customized, eliminating the need to manually create permission lists from scratch for each new entity and significantly reducing maintenance time.
Solution Approach 2:
Templates can be copied and reused across multiple users and rows. When new users are added, existing templates can be copied and assigned to them automatically. When new rows are added, the same templates can be applied to those rows, dramatically reducing the time required to maintain access control permissions as the system grows.
3Measurement precision
If detailed permission lists are maintained for each user and row, then precise access control is achieved, but the administrative burden increases
Solution Approach 1:
Templates encapsulate detailed access control logic that can be copied and applied to multiple users and rows. This allows administrators to define precise access control rules once in a template, then reuse them across many instances without manually recreating the same detailed permissions repeatedly, maintaining precision while reducing administrative burden.
Solution Approach 2:
The patent segments access control management into template definition and template application phases. The complex detailed permissions are segmented into reusable template units with specific functions (e.g., row-level filters, user role definitions). This segmentation allows administrators to work with high-level template concepts rather than managing individual detailed permission entries, making administration easier while preserving precise control through the template logic.
Data Source
AI summary
Provided herein is a process that converts unprotected data into protected data based on permissions defined using logical operators. As such, user permissions can be managed with a simple string of data. In one example, the method may include receiving a request for data from a user device, identifying a permission object corresponding to the user device, retrieving a string comprising a logical expression with a logical operator and one or more values from the permission object, wherein the logical expression defines access permissions of the user device with respect to a database, executing a database query on the database based on the request to generate results, and filtering the results from the database query based on the logical expression to generate filtered results and outputting the filtered results to the user device.