OLAP Data Security via Pre-computed Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current OLAP systems face inefficiencies in securing and authorizing multidimensional transactional data, particularly with the filter and barrier paradigms, which lead to slow performance, user-dependent data, and difficulties in distinguishing between unauthorized and non-booked data, resulting in inconsistent and inaccurate reports.
Innovation Solution
Implementing a new paradigm that allows OLAP systems to aggregate and filter multidimensional transactional data based on user authorization, distinguishing between authorized and unauthorized data, and indicating absent data, while ensuring accurate and consistent reporting across different user authorizations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the filter paradigm is used to secure multidimensional transactional data, then data security is improved by filtering unauthorized data before display, but system performance deteriorates due to slow processing when loading and filtering large datasets
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing authorization information in the multidimensional database during data loading. The authorization data is integrated into the database structure beforehand, allowing the OLAP system to access only authorized data ranges without runtime filtering, thus resolving the contradiction between data security and system performance
Solution Approach 2:
The patent extracts the authorization filtering function from the OLAP processing stage and moves it to the database storage stage. By separating authorization data from transactional data and storing them together in the multidimensional database, the system eliminates the need for runtime filtering operations, improving performance while maintaining security
2Productivity
If the barrier paradigm is used to secure multidimensional transactional data, then system performance is improved by avoiding loading unauthorized data, but data completeness deteriorates as users cannot see all available data including absent vs unauthorized data
Solution Approach 1:
The patent introduces authorization information as an intermediary layer between the OLAP system and the transactional data. This intermediary contains range-based authorization rules that enable the system to distinguish between unauthorized data and absent data, allowing users to see complete information including both categories while maintaining security and performance
3Reliability
If traditional authorization filtering is implemented, then data security is improved, but the ability to distinguish between unauthorized data and non-booked data deteriorates, leading to inconsistent reports
Solution Approach 1:
The patent applies local quality by associating specific authorization information with each node in the multidimensional database structure. Each node contains localized authorization data indicating whether it represents unauthorized data or absent data, enabling precise distinction at the local level while maintaining overall data security and report consistency
Data Source
AI summary
In one embodiment the present invention includes a system for securing and authorizing access to multidimensional transactional data. The system includes online analytical processing (OLAP) system and a database system. The OLAP system accesses a selection of multidimensional transactional data from the database system according to a multidimensional request. The OLAP system aggregates the selection to form aggregated information. The OLAP system filters the selection according to the authorization for the user, to form a filtered selection. In this manner the user can see accurate aggregations yet not see unauthorized data.