Shared Record Access Control With Section-Level Data Permissions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in maintaining separation between common and exclusive data sets, leading to errors and increased computational complexity in data storage and synchronization, particularly in scenarios involving multiple computing subsystems with varying access rights.
Innovation Solution
An intermediation server implements differential access control by storing data in a shared record with owner identifiers and access control data, allowing selective access to subsets of data based on requester identifiers, and using presentation configuration data for display formatting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If common data and exclusive data are stored separately to maintain clear access rights, then data security and access control precision are improved, but device complexity and data synchronization complexity increase
Solution Approach 1:
The patent segments data access control by introducing owner identifiers for different data sections and requester identifiers for different computing subsystems. Each data section is associated with an owner identifier, and access control data specifies which requester identifiers can access each section. This segmentation enables precise control over which subsystems can access which data sections without requiring completely separate storage systems.
Solution Approach 2:
The patent introduces an intermediation server as a mediator between computing subsystems and data storage. The intermediation server stores access control data that maps requester identifiers to permitted data sections, and it mediates all access requests by verifying requester credentials against the stored access control data. This intermediary layer simplifies the architecture by centralizing access control logic rather than distributing complex synchronization mechanisms across multiple subsystems.
2Productivity
If all computing subsystems access all common data sets, then data sharing efficiency is improved, but data security and access control capability deteriorate
Solution Approach 1:
The patent applies local quality by associating different access rights with different requester identifiers for different data sections. Instead of uniform access control across all data, the system assigns specific owner identifiers to specific data sections and configures access control data to grant appropriate rights to specific requesters for specific sections. This allows highly efficient data sharing within permitted boundaries while maintaining security through localized access restrictions.
3Device complexity
If access control is enforced at the file or dataset level, then implementation simplicity is improved, but access control precision deteriorates
Solution Approach 1:
The patent segments access control precision by introducing section-level granularity within data structures. Data is organized into sections, each with its own owner identifier and access control settings. The access control data stores mappings between requester identifiers and specific data sections, enabling precise control at the section level rather than forcing all-or-nothing access at the file or dataset level. This segmentation achieves fine-grained control without requiring completely separate storage systems.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of data access control in an intermediation server includes: storing a record containing: a record identifier; a plurality of sections each containing data; and in association with each section, an owner identifier selected from a set of requester identifiers corresponding to respective requester subsystems; storing access control data corresponding to each requester identifier; wherein the access control data for a given requester identifier indicates which other requester identifiers are permitted to access a section of the record having the given requester identifier associated therewith as the owner identifier; responsive to receiving, from one of the requester subsystems, a request containing the record identifier and an active one of the requester identifiers corresponding to the active requester subsystem: granting access to a subset of the sections according to the active requester identifier, the owner identifiers and the access control data.