Query-Based Data Permissions for Fine-Grained Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In traditional database management systems, permission to access data is granted at a coarse grain level, forcing database administrators to provide all-or-nothing access control, which is inefficient when creating reports that mix data from various structures, leading to increased burden as the number of users grows.
Innovation Solution
Implementing a system and method where permissions are provided via database queries, allowing users to access specific data subsets based on query results, with user-centric queries generating data views or subsets specific to each user, reducing the effort required to manage permissions across multiple users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If permission to access data is granted at the level of data structures (coarse grain approach), then access control is simplified and can be granted all-or-nothing, but it forces administrators to provide permission to all data of a particular data type without regard to specific instances, reducing flexibility and precision
Solution Approach 1:
The patent segments permission control from coarse-grain data structure level to fine-grain specific data instance level. Instead of granting permission to entire tables or data types, the system allows administrators to grant permission to specific instances of data within structures, enabling precise control over what each user can access while maintaining ease of management through automated inheritance mechanisms.
Solution Approach 2:
The patent applies local quality by allowing different permission levels for different specific instances of the same data structure. Each piece of data can have its own access control list, enabling localized permission settings that tailor access rights to specific data instances rather than applying uniform permissions across all data of a particular type.
2Ease of manufacture
If permission is granted at coarse grain level of data structures, then administrative effort is reduced for simple cases, but the burden on report creators increases significantly when creating reports that mix data from various structures with multiple users
Solution Approach 1:
The patent creates a universal permission management system that handles both simple and complex reporting scenarios through a single mechanism. The system provides multi-functionality by supporting automatic permission inheritance for simple reports while also enabling fine-grained permission control for complex reports mixing multiple data structures, eliminating the need for different approaches based on report complexity.
Solution Approach 2:
The patent implements self-service through automated permission inheritance mechanisms. When a user is granted permission to a parent data structure, the system automatically inherits and applies appropriate permissions to child structures and specific data instances. This automation reduces administrative effort while maintaining precise control, allowing report creators to focus on report logic rather than manual permission configuration.
3Device complexity
If all-or-nothing access control is used at data structure level, then permission management is simpler, but it prevents selective access to specific data instances, reducing security and data protection capabilities
Solution Approach 1:
The patent segments access control from structure-level to instance-level permissions, allowing selective access to specific data instances. This segmentation enables the system to maintain simple management through automated inheritance while simultaneously providing fine-grained security control over individual data pieces, thus improving data protection without significantly increasing system complexity.
Solution Approach 2:
The patent changes the parameter of permission granularity from coarse (structure-level) to fine (instance-level). By allowing permission settings at multiple levels of granularity, the system can adjust the degree of control based on security requirements, enabling both simple and secure permission management configurations as needed.
Data Source
AI summary
A method includes generating a database query in a database; receiving a first request to execute the database query on behalf of a first user; in response to the first request, executing the database query to generate a first set of results such that the first set of results is limited to data with which there is a semantic relationship in the database to a first datum representing the first user; receiving a second request to execute the database query on behalf of a second user; in response to the second request, executing the database query to generate a second set of results such that the second set of results is limited to data with which there is a semantic relationship in the database to a second datum representing the second user, where the first set of results and the second set of results are at least partially non-overlapping.