Metadata Table Access Control via Row-Level Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for user-specific access control in metadata tables are complex and resource-intensive, requiring multiple views and substantial database resources, which increases maintenance costs and slows query performance.
Innovation Solution
Implementing automatic real-time authorization checks on metadata table rows, allowing users to access only relevant rows based on ownership or access permissions, without relying on view objects or complex predicates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple views are used for user-specific access control in metadata tables, then access security is improved, but device complexity and resource consumption increase
Solution Approach 1:
The patent extracts the security check logic from the view layer and implements it directly in the query processor. Instead of using multiple views to enforce access control, the system processes metadata table rows directly with embedded authorization checks that determine visibility based on user permissions and object ownership, eliminating the need for complex view structures.
Solution Approach 2:
The query processor is enhanced to perform both query processing and access control functions universally. The same query processing mechanism that retrieves metadata rows also evaluates user permissions and object ownership to determine row visibility, consolidating multiple functions into a single universal process rather than requiring separate view-based access control mechanisms.
2Reliability
If multiple views are used for user-specific access control in metadata tables, then access security is improved, but maintenance costs increase
Solution Approach 1:
The patent removes the maintenance burden associated with multiple views by extracting access control logic from the view layer and implementing it in the query processor. This eliminates the need to create, update, and maintain multiple views to enforce different access control policies, as the same query processing mechanism handles all access control decisions dynamically.
3Reliability
If view-based security mechanisms are used, then access control is achieved, but query performance decreases
Solution Approach 1:
The patent merges access control evaluation with query processing in a single unified operation. Instead of first retrieving rows through views and then filtering based on access control, the system combines both operations so that the query processor simultaneously retrieves metadata rows and evaluates user permissions, eliminating redundant processing steps and improving query performance.
Solution Approach 2:
The system skips the intermediate step of materializing view results before applying access control filters. By rushing through the combined operation of retrieval and filtering in a single pass through the metadata table with embedded authorization checks, the system avoids the performance overhead of multiple processing stages required by view-based mechanisms.
Data Source
AI summary
The present disclosure involves systems, software, and computer implemented methods for user-specific access control for metadata tables. An example method includes receiving, from a user, a query that queries a metadata table. For each metadata table row, a determination is made as to whether the user owns the object represented by the metadata table row. If the user owns the object, the row is included in a result set for the query. If the user does not own the object, a determination is made as to whether the user has access permission to the object. If the user has access permission to the object, the row is included in the result set. If the user does not have access permission to the object, the row is excluded from the result set. After all metadata tables rows are processed, the result set is provided in response to the query.