Row-Level Dataset Permissioning Using Evaluated Policy Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems limit access to electronic data assets at the dataset level, leading to data fragmentation, inconsistency, and loss of integrity when attempting to grant permissions at the row level, and are often non-standard and idiosyncratic, making integration with cloud-based systems difficult.
Innovation Solution
Implementing row-level permissioning based on evaluated policies, using parsing rules to convert non-standard formats into a standard format with a column representing permission levels, and applying user-specific policies to filter dataset rows, allowing granular access without duplicating datasets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If row-level permissioning is implemented by duplicating datasets for different permission levels, then users can access specific rows with appropriate permissions, but data fragmentation and loss of data integrity occur
Solution Approach 1:
The patent introduces an intermediary permission evaluation mechanism that sits between the user and the dataset. Instead of duplicating data, the system evaluates user permissions against policy rules and filters visible rows dynamically. This mediator approach enables row-level access control while preserving the single source of truth for data, thus maintaining data integrity.
Solution Approach 2:
The patent segments the permission control mechanism into separate policy evaluation rules that can be applied to individual rows without segmenting the data itself. Each row can have its own permission policy attached, allowing granular access control while keeping the dataset unified and intact.
2Stability of the object's composition
If dataset-level permissioning is used, then data integrity is maintained, but granular access to specific rows cannot be provided
Solution Approach 1:
The patent applies local quality by allowing different permission policies to be attached to different rows within the same dataset. Each row can have its own security attributes and access rules, enabling granular control over which users can access which rows while maintaining the overall structure and integrity of the dataset.
Solution Approach 2:
The patent implements dynamic permission evaluation where access rights are determined at runtime based on user context, row attributes, and policy rules. This dynamic approach allows the system to adapt access control decisions for each user-row interaction without requiring static data duplication or rigid dataset-level permissions.
3Adaptability or versatility
If non-standard dataset formats are supported, then processing flexibility is improved, but integration with cloud systems becomes difficult
Solution Approach 1:
The patent changes the parameter representation by using standardized permission policy formats that can be universally interpreted. Instead of supporting multiple non-standard formats, the system translates various input formats into a unified policy evaluation language, simplifying integration with cloud systems while maintaining processing flexibility.
Solution Approach 2:
The patent creates a universal permission evaluation framework that can handle multiple dataset types and formats through a common policy interface. This multi-functional approach allows the same permissioning mechanism to work across different data sources and formats, reducing integration complexity with cloud systems.
Data Source
AI summary
A computer system is disclosed that provides classification-based access controls at the dataset row-level. The system may perform operations including: ingesting a dataset, wherein the dataset comprises a table of rows and columns; determining a column of the table that includes permissions information; applying parsing rules to the column to determine, for each row of the table, a list of permissions markings; receiving, from a user, a request to access the dataset; and in response to receiving the request: determining a permissions policy associated with the user; determining an evaluated policy associated with the user based on the permissions policy; filtering the table based on applying the evaluated policy associated with the user to the permissions markings of each row of the table; and providing the user access to the filtered table.