Row-Level Dataset Access Through Evaluated Permission Policies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems limit access to electronic data assets at the dataset level, leading to data fragmentation, inconsistency, and loss of integrity when different users require varying permission levels for different rows within a dataset.
Innovation Solution
Implementing row-level permissioning based on evaluated policies, where each row is assigned a permission level, allowing users to access specific rows without duplicating datasets, thus maintaining data integrity and reducing fragmentation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If dataset-level permissioning is implemented, then access control is simplified, but data fragmentation and inconsistency occur when different users require varying permission levels for different rows
Solution Approach 1:
The patent segments permission control from data storage by introducing a separate permission table that divides permission information into reusable components. This allows row-level permissioning without duplicating data, resolving the contradiction between simplified access control and data integrity by enabling granular permissions while maintaining a single source of truth for the dataset.
Solution Approach 2:
The patent introduces a permission table as an intermediary between users and the dataset. This intermediary stores permission information that can be applied to multiple users and rows without modifying the original data structure, enabling flexible access control while preserving data integrity and avoiding fragmentation.
2Reliability
If separate datasets are created for different permission levels, then users can access only their permitted rows, but data fragmentation and duplication occur
Solution Approach 1:
The patent merges permission control with the existing dataset structure by creating a single unified dataset with an associated permission table. This combination allows the system to maintain one authoritative copy of the data while enforcing different permission levels through the permission table, avoiding the need for multiple fragmented datasets and reducing structural complexity.
Solution Approach 2:
The permission table serves multiple functions: it stores permission information for different users, defines access levels for different rows, and enables flexible permission assignment without requiring separate datasets. This multi-functionality resolves the contradiction by providing accurate access control through a single unified structure.
3Reliability
If permission information is duplicated across datasets, then access control is enforced, but data consistency is lost
Solution Approach 1:
The patent performs preliminary organization of permission information in a dedicated permission table before access control is enforced. By pre-structuring permission data in a reusable format, the system can enforce access control reliably without duplicating permission information across multiple datasets, thereby maintaining data consistency while ensuring proper access enforcement.
Data Source
AI summary
A computer system is disclosed that provides classification-based access controls at the dataset row-level. The system may perform operations including: ingesting a dataset, wherein the dataset comprises a table of rows and columns; determining a column of the table that includes permissions information; applying parsing rules to the column to determine, for each row of the table, a list of permissions markings; receiving, from a user, a request to access the dataset; and in response to receiving the request: determining a permissions policy associated with the user; determining an evaluated policy associated with the user based on the permissions policy; filtering the table based on applying the evaluated policy associated with the user to the permissions markings of each row of the table; and providing the user access to the filtered table.