Ontology Permission Mapping for Granular Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems lack effective methods for managing ontology data, particularly in terms of indexing, conflict resolution, and access control, which hinders efficient and secure data management.
Innovation Solution
A system is developed to manage ontology data by transforming data source updates into ontology entities, enforcing granular security policies, and resolving conflicts between data source updates and user edits, ensuring secure and flexible access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If granular access control policies are enforced on ontology data, then data security is improved, but system complexity increases
Solution Approach 1:
The patent segments access control into multiple granular levels (ontology level, entity level, property level) allowing different permission settings at each level. This segmentation enables precise security control without requiring a single complex policy framework, as each level can be independently managed with appropriate access control lists and permission sets.
Solution Approach 2:
The patent introduces an intermediary access control mechanism that sits between data sources and the ontology, transforming data source updates while enforcing security policies. This intermediary layer handles the complexity of permission enforcement, transformation, and conflict resolution, shielding the core ontology system from direct exposure to complex access control logic.
2Stability of the object's composition
If data source updates are transformed into ontology entities, then data organization is improved, but conflict resolution complexity increases
Solution Approach 1:
The patent applies preliminary action by establishing transformation rules and conflict resolution strategies before data source updates are processed. The system pre-defines how conflicts between multiple data sources should be resolved (e.g., priority-based, timestamp-based, or custom resolution logic), allowing automated conflict handling during the transformation process without requiring complex real-time decision-making.
Solution Approach 2:
The patent implements feedback mechanisms where the system monitors transformation processes and conflict situations, then adjusts resolution strategies based on observed patterns. The conflict resolution system learns from previous resolutions and can adapt its behavior, reducing complexity by automating decisions based on established feedback loops rather than requiring manual intervention for each conflict.
3Productivity
If versioning and indexing operations are performed on ontology data, then data management efficiency is improved, but processing time increases
Solution Approach 1:
The patent applies periodic action by implementing batch indexing and versioning operations instead of continuous processing. The system periodically indexes ontology data and creates versions at scheduled intervals or based on trigger events, reducing continuous processing overhead while maintaining data management efficiency. This periodic approach allows the system to balance between up-to-date data management and reduced processing time.
Solution Approach 2:
The patent implements partial action by selectively indexing and versioning only the portions of ontology data that have changed or are most frequently accessed. Rather than processing the entire ontology dataset for every indexing operation, the system identifies and processes only relevant subsets, significantly reducing processing time while maintaining data management efficiency for critical data elements.
Data Source
AI summary
A method comprises receiving a set of data source updates for datasets; transforming the set of data source updates to a list of updates to an ontology, the ontology including a definition for each ontology entity type that include one or more properties, obtaining a first transformation mapping columns of a first dataset to a first set of properties of a certain ontology entity type; obtaining a second transformation mapping columns of a second dataset to a second set of properties of the certain ontology entity type; obtaining a specific security policy that applies to the first set of properties based on a first set of permissions controlling access to rows of the first dataset; obtaining a particular security policy that applies to the second set of properties based on a second set of permissions controlling access to rows of the second dataset.