Query Augmentation for Persistent Data Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current management systems face performance degradation and scalability issues with unbounded instance authorization, where the number of authorized instances is unknown prior to access, leading to inefficient data retrieval and processing overhead, especially in large deployments.
Innovation Solution
The method involves modifying database queries at a management device using an authorization model to enforce filtering directly at the database, incorporating authorization constraints and inheritance, allowing for a single pass data retrieval without additional filtering, and utilizing a persistent layer to intercept and augment queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all instances are read and processed one by one with post-retrieval filtering, then authorization can be enforced for unbounded instances, but system performance significantly degrades in large deployments
Solution Approach 1:
The patent applies preliminary action by modifying the database query structure in advance to include authorization filters. The query is transformed to incorporate group hierarchy conditions and instance-level authorization constraints before execution, so that only authorized instances are retrieved in a single pass, eliminating the need for post-retrieval filtering and preventing performance degradation.
2Productivity
If proxy design pattern is used to construct proxy instances instead of real instances, then system performance improves by avoiding construction of unauthorized instances, but per-object filtering overhead remains
Solution Approach 1:
The patent extracts the authorization filtering logic from the proxy interception layer and moves it into the database query layer. By taking out the filtering operation from the application layer and embedding it in the SQL query structure, the system eliminates the need for per-proxy-instance interception and filtering, reducing both complexity and overhead while maintaining performance benefits.
3Productivity
If authorization granularity is moved up to chassis level instead of port level, then performance improves by reducing the number of instances to process, but authorization precision is reduced
Solution Approach 1:
The patent applies segmentation by dividing the authorization filtering into two distinct layers: group-level filtering (chassis level) and instance-level filtering (port level). The query structure is segmented to first filter by group hierarchy conditions at the chassis level, then apply instance-level authorization constraints at the port level, enabling both efficient processing and fine-grained authorization precision simultaneously.
Data Source
AI summary
In one embodiment, a method for persistent data authorization includes receiving a query at a management device and identifying authorization constraints at the management device utilizing an authorization model. The authorization model includes at least one group hierarchy defining authorization based on a relationship between levels in the hierarchy. The query is modified based on the authorization constraints and the modified query is sent to the database. Data is received in response to the modified query and is configured for transmission from the management device without further filtering. The query received at the management device and the modified query are both configured for communication directly with the database with no modification to the database required for the modified query. A system and apparatus for persistent data authorization are also disclosed.