Managed Metastore for Granular Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing big data processing systems face challenges in maintaining data security due to coarse-grained access control mechanisms that are unintuitive and difficult for users to manage, especially when dealing with large datasets stored in tables with numerous rows and columns.
Innovation Solution
A system and method that utilize a managed data service to provide fine-grained data access permissions by determining the requisite permissions of a user, generating a token for access, and either instantiating a cluster to store filtered data or providing access to the data stored on the system, thereby enhancing data security and access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If coarse-grained access control is used to simplify permission management, then ease of operation is improved, but manufacturing precision deteriorates (fine-grained data access control cannot be enforced)
Solution Approach 1:
The patent segments access control into two layers: coarse-grained control for managing permissions (improving ease of operation) and fine-grained control for actual data access enforcement (improving manufacturing precision). The metastore system divides data access permissions into table-level, row-level, and column-level controls, allowing users to manage permissions easily while enforcing granular access control policies.
2Reliability
If fine-grained data access control is implemented to improve data security, then reliability is improved, but device complexity increases
Solution Approach 1:
The metastore system acts as an intermediary layer between users and the underlying data storage system. It implements fine-grained access control policies without requiring changes to the storage infrastructure. The metastore translates high-level permission definitions into fine-grained access control decisions, reducing system complexity while maintaining data security.
Solution Approach 2:
The patent creates virtual copies of data views with different permission levels. Instead of modifying the actual data storage structure, the metastore generates virtual data copies with applied access control filters. This allows fine-grained control to be enforced without increasing the complexity of the underlying storage system.
3Productivity
If users are granted access to entire datasets for efficient data retrieval, then productivity is improved, but object-generated harmful factors increase (unauthorized data access risk)
Solution Approach 1:
The patent applies local quality by granting users access to entire datasets only in the specific contexts where they have permission. The metastore dynamically applies access control filters based on the user's permissions, data location, and operation type. This allows efficient data retrieval for authorized users while preventing unauthorized access to sensitive data portions.
Data Source
AI summary
The present application discloses a method, system, and computer system for providing access to information stored on system for data storage. The method includes receiving a data request from a user, determining data corresponding to the data request, determining whether the user has requisite permissions to access the data, and in response to determining that the user has requisite permissions to access the data: determining a manner by which to provide access to the data, wherein the data comprises a filtered subset of stored data, and generating a token based at least in part on the user and the manner by which access to the data is to be provided.