Security Descriptors for Normalized Record Access Queries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Complex computing networks face inefficiencies in record access queries due to the inability to express sharing rules in a normalized manner, leading to prolonged search times when users need to discover records they own or have access to.
Innovation Solution
Implementing security descriptors in entity share tables to normalize sharing rules, allowing for efficient record searches by identifying unique sets of users and access levels, thereby simplifying queries and reducing search times.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a denormalized share table model is used to track multiple sharing relationships, then the system can maintain detailed sharing information for each record, but query efficiency deteriorates significantly due to the inability to express sharing rules in a normalized manner
Solution Approach 1:
The patent segments the denormalized share table into multiple normalized tables: a users table, a records table, and a share relationships table that links users to records. This segmentation allows the system to maintain accurate sharing information while enabling efficient queries through proper indexing and normalized data access patterns.
Solution Approach 2:
The patent changes the data structure parameters from a denormalized format (where each share relationship is a separate row with redundant user information) to a normalized format (where users are referenced by unique identifiers). This parameter change enables the use of indexes on foreign key columns, dramatically improving query performance while maintaining data integrity.
2Loss of information
If all sharing relationships are tracked as separate rows in a denormalized table, then complete sharing information is maintained, but the complexity of expressing sharing rules increases
Solution Approach 1:
The patent extracts the user identification information from each share relationship row and consolidates it into a separate users table. This extraction eliminates the complexity of expressing sharing rules by allowing queries to reference users by their unique identifiers rather than repeating user information in each relationship row.
Solution Approach 2:
Instead of storing complete user information in each share relationship row (denormalized approach), the patent inverts the approach by storing only user identifiers in the relationships table and maintaining complete user information in a separate users table. This inversion simplifies the query structure while maintaining complete sharing information.
3Loss of information
If a denormalized share table is used to store all sharing relationships, then detailed access information is preserved, but search time increases beyond acceptable levels
Solution Approach 1:
The patent segments the data into normalized tables with proper indexing, allowing the database engine to efficiently access access level information through indexed foreign key relationships rather than scanning entire denormalized tables. This segmentation preserves all access level information while reducing search time to acceptable levels.
Solution Approach 2:
The patent performs preliminary organization of data into normalized tables with indexes on foreign key columns before queries are executed. This preliminary structuring enables the database engine to quickly locate and retrieve access level information without performing time-consuming full table scans.
Data Source
AI summary
Embodiments regard security descriptors for record access queries. An embodiment of a method includes: receiving a record access query, the query regarding records for a certain one or more users at a certain access level; searching one or more sharing tables of entities in a computing environment for security descriptors, each security descriptor being associated with a set of one or more users having access to one or more records of a set of records at an access level; identifying any security descriptors in the one or more sharing tables that relate to the certain one or more users with at least the certain access level; and searching the one or more records associated with each of the identified security descriptors according to the record access query.