Runtime Data Model for Authorization Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face performance issues in evaluating data access restrictions due to resource-intensive database operations, especially when hierarchical data objects are involved, leading to inefficient authorization checks.
Innovation Solution
The solution involves creating a schema designed for fast runtime execution, where data from design time objects is incorporated into runtime objects or referenced using pointers, reducing the need for expensive operations like UNION and non-linear JOINs, and using a performant database engine like the JOIN engine in SAP HANA.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data access permission information is stored in multiple locations to make it convenient for users to define access rights, then ease of operation is improved, but evaluation performance deteriorates due to expensive database operations like UNION and non-linear JOIN
Solution Approach 1:
The patent creates a runtime data model that copies relevant permission information from the design time data model into optimized runtime objects. This copying process transforms the complex, multi-location stored permission data into a streamlined format that can be quickly evaluated during runtime, resolving the contradiction between easy definition (design time) and fast evaluation (runtime).
Solution Approach 2:
The patent segments the data model into distinct design time objects and runtime objects, each serving different purposes. The design time model handles user-friendly permission definition, while the runtime model handles high-performance authorization evaluation. This segmentation allows each layer to be optimized independently for its specific function.
2Adaptability or versatility
If hierarchical data objects are involved in authorization evaluation, then adaptability is improved, but evaluation time increases due to multiple-level hierarchy evaluation
Solution Approach 1:
The patent performs preliminary action by pre-evaluating and storing authorization results for hierarchical objects during the design time phase. The runtime data model incorporates these pre-computed results, allowing fast retrieval during actual authorization checks without needing to traverse the entire hierarchy again, thus reducing evaluation time while maintaining adaptability.
Solution Approach 2:
The runtime data model acts as an intermediary between the hierarchical design time model and the fast authorization evaluation system. It translates complex hierarchical relationships into optimized runtime representations that can be quickly processed, serving as a bridge that maintains both adaptability and performance.
3Ease of operation
If design time data model is used for runtime authorization evaluation, then ease of operation is maintained, but device complexity increases due to schema transformation requirements
Solution Approach 1:
The patent segments the system into a design time data model layer and a runtime data model layer. The design time model maintains user-friendly interfaces and definitions, while the runtime model handles the complex transformations and optimizations needed for fast evaluation. This segmentation isolates complexity to the runtime layer, keeping the user interface simple.
Solution Approach 2:
The runtime data model serves as an intermediary transformation layer that converts design time definitions into optimized runtime representations. This intermediary handles the schema transformation complexity automatically, shielding users from the underlying computational requirements while enabling fast authorization evaluation.
Data Source
AI summary
Techniques and solutions are provided for evaluating data access restrictions. Data access restrictions are defined for a first computing object that includes data, or is usable to retrieve data, from one or more other computing objects. Data defining the data access restrictions is stored in attributes for a first plurality of computing objects. Values for less than all of the attributes are copied to a second plurality of computing objects, where the second plurality of computing objects is less than the first plurality of computing objects. A data access authorization request is received that includes, or information sufficient to identify, a user or user group identifier, and an identifier of the first computing object. Data is retrieved from at least a portion of one or more computing objects, and is returned in response to the request, or an authorization result is determined and returned in response to the request.