Query-Based Permissions for Graph Database Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current database management systems grant permissions at a coarse grain level, such as data structures, leading to an all-or-nothing access control approach, which is inefficient when creating reports that mix data from various structures, requiring administrators to grant permissions individually for each user and data structure, increasing the burden as the number of users grows.
Innovation Solution
Implementing a system and method that provides view-based or query-based permissions, where users are granted permission to access specific data subsets based on queries, allowing for user-specific data views and automatic permission management, reducing the effort required for administrators to manage permissions across multiple data structures and users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If permission is granted at the data structure level (coarse grain), then permission management is simplified, but access control precision deteriorates (all-or-nothing approach)
Solution Approach 1:
The patent segments permission control from data structure level to data instance level. Instead of granting permissions to entire tables or data structures, the system grants permissions to specific data instances returned by queries. This is achieved by associating permission tokens with individual data instances, allowing fine-grained control while maintaining simplified query-based access patterns.
Solution Approach 2:
The patent introduces permission tokens as an intermediary mechanism between users and data instances. These tokens act as mediators that carry permission information, allowing the system to track and control access to specific data instances without requiring complex permission management at the data structure level. The tokens serve as the intermediary layer that enables both simplicity and precision.
2Measurement precision
If permission is granted individually for each user and data structure, then access control precision is improved, but administrative burden increases
Solution Approach 1:
The patent makes queries universal permission carriers. A single query can serve multiple users with different permission requirements by returning different data instances with appropriate permission tokens. The query mechanism becomes multi-functional, simultaneously acting as a data retrieval tool and a permission distribution mechanism, eliminating the need for separate permission management for each user-data structure pair.
Solution Approach 2:
The system enables self-service permission management where users automatically receive appropriate permissions to data instances through query execution. The permission tokens are automatically generated and associated with data instances based on query results, without requiring manual administrative intervention for each user. This automated approach significantly reduces administrative time while maintaining precise access control.
3Measurement precision
If report creators must grant permission to each user for each data structure, then access control precision is improved, but device complexity increases
Solution Approach 1:
The patent extracts permission information from the complex permission management system and embeds it directly into data instances via permission tokens. Instead of managing permissions as separate metadata at the data structure level, the system extracts and attaches permission information to individual data instances, simplifying the overall permission management architecture while maintaining fine-grained control.
Solution Approach 2:
The patent changes the fundamental parameter of permission representation from structure-level metadata to instance-level tokens. This parameter change transforms permission management from a complex hierarchical system to a simpler token-based system, where each data instance carries its own permission information, reducing system complexity while improving granularity.
4Ease of manufacture
If coarse grain permission is used, then permission management effort is reduced, but data security deteriorates (users may access unintended data)
Solution Approach 1:
The patent applies preliminary action by pre-associating permission tokens with data instances before users access them. When data instances are created or inserted into query results, permission tokens are automatically attached with appropriate access restrictions. This preliminary permission assignment ensures that users can only access data instances they are authorized to view, preventing unauthorized access while maintaining ease of permission management.
Solution Approach 2:
The system implements feedback mechanisms where permission tokens carry information about authorized users and access conditions. When users attempt to access data instances, the system checks the permission tokens to verify authorization. This feedback loop ensures that only authorized users can access specific data instances, preventing unauthorized access while keeping the permission system simple and automated.
Data Source
AI summary
A computing device is configured to carry out actions including: generating, in a graph database, an access role vertex that defines an access role of a user, where the access role vertex is connected to a user vertex representing the user; generating a query vertex including a traversal clause that represents a query of the graph database; generating a permission edge between the access role vertex and the query vertex, where the permission edge defines the access role's permission to access the results of the query; receiving a request to execute the query on behalf of the user; in response to the request, traversing the graph database according to the traversal clause to locate a set of vertices; and generating a set of results based on the set of vertices.