Real-time Analytical Queries Preserving Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional analytics processes in content management systems (CMS) lose access controls and security measures during data extraction, transformation, and loading (ETL), leading to resource-intensive and time-consuming processes that do not reflect recent changes in the CMS or content.
Innovation Solution
A system and method for processing analytical queries on a CMS document store that preserves access control by generating an execution plan based on user permissions, constraining search results using a content index, and aggregating a permissions-filtered results set, ensuring secure access and real-time processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional ETL processes are used for analytics, then data extraction and transformation can be performed, but access controls and security measures are lost and processing becomes resource-intensive and time-consuming
Solution Approach 1:
The system pre-generates execution plans that incorporate access control lists and permission constraints before analytics queries are executed. These execution plans are cached and reused, allowing the system to maintain security constraints without re-evaluating them for each query, thus preserving access controls while reducing processing time
Solution Approach 2:
The patent introduces an execution plan as an intermediary layer between the analytics query and the document store. This execution plan contains pre-computed access control constraints and permission filters that mediate the query execution, ensuring access controls are maintained while avoiding the resource-intensive traditional ETL process
2Loss of information
If traditional ETL processes are used for analytics, then data can be extracted and transformed, but the processes are resource-intensive and time-consuming
Solution Approach 1:
The system extracts only the necessary permission constraints and access control rules from the execution plan and applies them directly to filter query results. This selective extraction avoids the need to extract, transform, and load entire datasets through traditional ETL processes, reducing computational resource usage while maintaining data completeness for authorized users
Solution Approach 2:
The patent changes the parameter of data processing from bulk ETL operations to targeted query execution with applied constraints. By transforming the approach from extracting all data and filtering later to executing queries with pre-applied filters, the system reduces computational resources while maintaining data integrity
3Reliability
If access control lists are applied to constrain query results, then security is maintained, but query processing complexity increases
Solution Approach 1:
The system pre-computes and caches execution plans that include access control constraints before query execution. These pre-computed plans are stored and reused for subsequent queries with similar parameters, reducing the complexity of applying access controls in real-time while maintaining security
Solution Approach 2:
The patent creates simplified copies of access control constraints within the execution plan that can be efficiently applied during query execution. Instead of evaluating complex access control rules against every document, the system uses pre-processed constraint representations that reduce processing complexity while maintaining security enforcement
Data Source
AI summary
A method for real-time analytical queries of a documents store is provided. The method includes receiving a query and an access control list associated with a user, the query requesting content managed by a content management system. The method further includes generating an execution plan based on the query and the access control list. The method further includes constraining, based on the execution plan, possible results returned from the query using a content index of a plurality of content items maintained in a repository of the content management system. The constraining includes limiting the at least one processor from adding a content item of the plurality of content items to a permissions-filtered results set based on the access control list identifying the user as not having permission to access the content item. The method further includes aggregating the permissions-filtered results set and returning the aggregated permissions-filtered results set.