Secure Role Hierarchies for Scalable Data Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data sharing methods are inefficient and costly, particularly for large datasets, as they often require cumbersome data transfer processes and do not allow for scalable sharing, leading to latency and access issues.
Innovation Solution
The implementation of a data exchange platform using inherited grants within a role-based access control (RBAC) framework, which allows data providers to share data without copying it, enabling secure and scalable access to data assets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If data is shared by copying it to another location, then data accessibility is improved, but data storage requirements and transfer time increase
Solution Approach 1:
The patent uses virtual copying through grants and shares rather than physical data duplication. When data is shared via grants, the recipient gets access to the original data without actual copying, eliminating transfer time while maintaining fast access through direct references to the source data.
Solution Approach 2:
The patent introduces an intermediary layer (grants and shares mechanism) between data provider and consumer. This intermediary enables instant access to data without physical transfer, resolving the contradiction between fast access and transfer time by creating a logical connection rather than requiring physical data movement.
2Adaptability or versatility
If data is shared with multiple parties, then data utility is improved, but access control complexity increases
Solution Approach 1:
The patent segments access control into hierarchical layers: accounts, roles, and grants. This segmentation allows multiple parties to access data through structured role assignments rather than individual permissions, reducing complexity while enabling versatile sharing across many recipients through role-based access patterns.
Solution Approach 2:
The patent creates universal access control mechanisms where roles can be assigned to multiple users and granted access to multiple data objects. This multi-functionality allows a single role definition to serve numerous parties simultaneously, improving data utility while maintaining simplified access control through reusable role templates.
3Reliability
If data is encrypted for security, then data protection is improved, but data processing efficiency decreases
Solution Approach 1:
The patent applies encryption selectively at the data storage level while maintaining unencrypted access during processing. Data is encrypted at rest for security, but when accessed through grants and shares, it can be processed in an unencrypted state, achieving both security and processing efficiency through different encryption states for different operational contexts.
Data Source
AI summary
Embodiments of the present disclosure provide systems and methods for managing role hierarchies and assignment of permissions by providing secure roles which are roles where the only user that can grant any privilege to the secure role, is the role that owns the secure role. A set of secure roles that defines a role hierarchy may be generated, wherein only a role that owns the set of secure roles can grant any privilege to each of the secure roles. The role that owns the set of secure roles may grant one or more privileges to a first secure role of the set of secure roles. In response to a user other than the role that owns the set of secure roles attempting to grant a privilege to the first secure role or modify a privilege granted to the first secure role, the attempt may be denied.