Metadata-Based Access Control Decoupling in Heterogeneous Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing microservice and application systems face challenges in decoupling access control functionality from database technologies, requiring application developers to couple with specific syntax and details of data storage technologies, limiting flexibility and scalability in implementing access restrictions.
Innovation Solution
The implementation of a metadata-based approach that decouples applications from specific access control functionalities, allowing developers to declare access control intentions abstractly using a centralized domain service, which generates executable statements for data storage technologies, thereby distributing responsibilities for access control declaration, implementation, and role maintenance across different parties.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If application developers directly implement access control functionality using database technology syntax and details, then access control can be enforced at the data storage level, but application developers become coupled with specific database technology details, reducing flexibility and scalability
Solution Approach 1:
The patent introduces a metadata layer as an intermediary between the application and the database technology. This metadata layer abstracts the access control requirements from the specific database syntax and implementation details. The application developer works with high-level metadata descriptions of access control needs, while the system automatically generates the appropriate database-specific access control statements. This mediator pattern allows the application to enforce access control reliably without being coupled to specific database technology details, thereby resolving the contradiction between reliable access control enforcement and flexibility in implementation.
2Adaptability or versatility
If application developers implement access control using abstract metadata declarations, then flexibility and scalability are improved, but the complexity of translating abstract requirements to specific database syntax increases
Solution Approach 1:
The system employs self-service automation where the metadata-driven access control framework automatically generates the necessary database-specific access control statements from high-level metadata declarations. Instead of requiring developers to manually translate abstract access control requirements into complex database syntax, the system self-generates the appropriate SQL or other database-specific statements based on the metadata and the target database technology. This automation eliminates the complexity burden from developers while maintaining the flexibility benefits of abstract metadata declarations.
3Ease of repair
If access control functionality is centralized in a domain service, then responsibilities are distributed and maintenance becomes easier, but the system requires a centralized component that increases overall architectural complexity
Solution Approach 1:
The patent segments the access control functionality into distinct, well-defined components: a metadata layer for declaring access control requirements, a domain service for processing and translating these requirements, and a generation component for creating database-specific statements. This segmentation creates clear boundaries and responsibilities between components, making the system easier to maintain and modify. Each component has a specific, well-defined function, which simplifies debugging, testing, and updates. The modular architecture, while introducing some architectural complexity, ultimately improves maintainability by allowing independent development and modification of each segment without affecting the entire system.
Data Source
AI summary
Metadata describing access control capabilities of a database technology resource is received from an access control system. Access restrictions for accessing data of the database resource by users of an application that have a role are received from an application developer. A role maintenance user interface is generated, using the metadata, for assigning the role to users of the application. Attribute values for creating an instance of the role for a user are received, using the role maintenance user interface. The instance of the role is created for the user based on the received attribute values and the access restrictions. A request from the application for the user to access the database resource is received by the access control system when the user is logged into the application. The access restrictions are applied by the access control system in the database resource when the database resource is accessed.