Row and Column Access Policies for Credential-Based Data Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems face challenges in efficiently managing access permissions for large numbers of users with varying credentials, leading to potential security risks and inefficiencies in data access control.
Innovation Solution
A policy service is employed to generate and maintain a data-set with assigned access policies for rows and columns, filtering data based on user credentials and providing access only to authorized users, while updating credentials in real-time and allowing administrators to define access rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional database access control methods are used to manage permissions for large numbers of users, then basic security can be maintained, but the system becomes inefficient and difficult to manage as user credentials vary
Solution Approach 1:
The patent segments access control into three distinct layers: (1) data-set level policies that define overall access rules, (2) row-level policies that control access to specific record groups, and (3) column-level policies that manage access to specific fields. This hierarchical segmentation allows complex permission requirements to be broken down into manageable, reusable policy components that can be independently configured and maintained.
Solution Approach 2:
The system performs preliminary action by pre-defining access policies with specific credential requirements before users attempt to access data. Administrators configure policies in advance that specify which credentials are required for accessing particular data-sets, rows, or columns. When users request access, the system automatically evaluates their credentials against these pre-configured policies, eliminating the need for real-time permission evaluation and reducing management complexity.
2Reliability
If separate data-sets are created for different user groups to ensure security, then access control can be enforced, but the system requires multiple data-sets and increases complexity
Solution Approach 1:
The patent implements universality by creating a single unified data-set structure that serves all user groups simultaneously. Instead of maintaining separate data-sets for different user groups, the system uses universal data-sets with attached access policies that dynamically determine which users can access which data based on their credentials. This allows one data-set to fulfill multiple security requirements for different user groups without replication.
Solution Approach 2:
The system introduces access policies as an intermediary layer between users and the unified data-set. These policies act as mediators that evaluate user credentials and enforce appropriate access control without requiring separate physical data-sets. The policy layer translates security requirements into access decisions, allowing a single data-set to securely serve multiple user groups with different permission levels.
3Ease of operation
If traditional permission management is used, then basic access control is possible, but real-time updates to credentials are difficult and time-consuming
Solution Approach 1:
The system implements feedback mechanisms that automatically monitor and respond to credential changes. When user credentials are updated in the identity management system, the policy service receives feedback about the changed credentials and automatically re-evaluates which access policies should be applied. This automatic feedback loop eliminates manual intervention for permission updates and ensures real-time synchronization between credential changes and access control enforcement.
Solution Approach 2:
The access control system is designed to be dynamic rather than static. Access policies are not fixed assignments but dynamic evaluations that continuously adapt based on current user credentials. When credentials change, the system dynamically re-evaluates policy matching without requiring manual reconfiguration. This dynamic approach allows credential updates to propagate automatically through the access control system, reducing update time from manual processes to automated real-time adjustments.
Data Source
AI summary
Example embodiments relate to a policy service employed to perform operations to: generate and maintain a data-set that comprises at least a column and a row that intersect at a cell; assign an access policy to a row or column of the data-set, wherein the access policy is defined by one or more access credentials required to receive access the cell that intersect with the row or column; receive a request to read the data-set from a user account, wherein the user account has an associated credential; filter the cell that intersects with the row or column of the data-set based on the access policy and the credential of the user account, in response to receiving the request from the user account; and provide the user account with access to the filtered data-set.