Offline Authorization Conditions for Collection-Level Query Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional access control mechanisms rely on binary outcomes and are inflexible, leading to underutilization of query results due to enforcement at a single item level rather than a collection level, particularly in complex data environments.
Innovation Solution
Implementing a dynamic authorization server that generates conditions based on policies, user attributes, and contextual information, which are integrated into database queries to enforce policy at a collection level, ensuring finer-grained control and efficient utilization of query results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional binary authorization decisions are used, then authorization simplicity is maintained, but policy enforcement efficiency deteriorates in complex data environments
Solution Approach 1:
The patent segments the authorization decision into two parts: an offline evaluation phase that generates conditional expressions, and an online execution phase that applies these conditions to query results. This segmentation allows complex policies to be prepared in advance without impacting real-time performance, resolving the contradiction between authorization flexibility and policy enforcement complexity.
Solution Approach 2:
The system performs preliminary authorization evaluation offline before actual data access occurs. By pre-computing conditional expressions and authorization rules in advance, the system prepares the authorization framework without adding complexity to the actual data access operations, enabling flexible policy enforcement efficiently.
2Reliability
If policy enforcement is performed at individual query result level, then precise access control is achieved, but page utilization deteriorates due to post-query filtering
Solution Approach 1:
The patent applies authorization conditions to the query itself before execution, rather than filtering results after retrieval. This preliminary action ensures that only authorized data is retrieved in the first place, maintaining precise access control while avoiding the inefficiency of post-query filtering and improving page utilization.
Solution Approach 2:
The system introduces conditional expressions as intermediaries between the authorization policy and the database query. These conditions act as a mediator that translates high-level policy requirements into executable query constraints, enabling precise access control to be integrated seamlessly into the data retrieval process without separate filtering steps.
3Productivity
If offline authorization evaluation with conditional expressions is implemented, then policy enforcement efficiency is improved, but system complexity increases
Solution Approach 1:
The authorization service automatically generates conditional expressions from policy definitions without requiring manual intervention or complex configuration. The system self-services by translating policies into executable conditions programmatically, improving enforcement efficiency while keeping the operational complexity manageable through automation.
Solution Approach 2:
The patent replaces traditional mechanical authorization checking (binary grant/deny decisions at query time) with a more sophisticated but automated system that uses conditional expressions. This substitution increases efficiency by performing evaluations offline, and the complexity is managed through systematic automation rather than manual processes.
Data Source
AI summary
Techniques for enforcing policy at a collection level are disclosed. A service receives, from a requesting entity, a set of search parameters to query a database of information. The service sends the search parameters to an authorization service, which is tasked with enforcing a collection level policy for the requesting entity by generating a set of local conditions that are injectable into a query submitted to the database. The service receives, from the authorization service, the set of local conditions. The service generates the query using a combination of the search parameters and the local conditions. The service facilitates execution of the query against the database. The service returns results of the executed query to the requesting entity. The results are organized using pages.