Storage and Privacy Service Access Control Graph
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network-based systems face challenges in efficiently managing and enforcing access control for user information across distributed systems, particularly in ensuring that only authorized users can access specific pieces of information while maintaining system complexity and operational efficiency.
Innovation Solution
Implementing a distributed system with a Storage and Privacy Service (SPS) that uses a high-level language to express access or privacy rules, represented as a graph, allowing for dynamic filtering and separation of data-fetching and access-control functionalities from the frontend, enabling transparent privacy logic and simplifying product development.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control is enforced by filtering data at the storage layer, then access control enforcement is improved, but data-fetching operations become more complex
Solution Approach 1:
The patent divides the system into two independent services: a data-fetching service that handles only data retrieval operations, and a privacy service that handles only access control filtering. This segmentation allows each service to be optimized independently, with the privacy service maintaining simple data-fetching operations while enforcing access control through the graph representation and filtering mechanisms.
Solution Approach 2:
The patent introduces a privacy service as an intermediary layer between the data-fetching service and the actual data storage. This intermediary receives data-fetching requests, applies privacy filtering based on the graph representation of access control rules, and returns only authorized data. This mediator approach allows data-fetching operations to remain simple while access control is enforced at the privacy service layer.
2Adaptability or versatility
If access control rules are represented as a graph for dynamic filtering, then adaptability is improved, but system complexity increases
Solution Approach 1:
The patent represents access control rules as a graph data structure where nodes represent users, groups, and data, and edges represent relationships and access permissions. This graph representation allows access control rules to be dynamically configured and modified without changing the fundamental system architecture. The graph structure enables flexible query patterns and filtering operations while maintaining a relatively simple underlying system structure.
3Reliability
If data is stored with full access control information, then access control enforcement is improved, but storage requirements and data processing load increase
Solution Approach 1:
The patent performs access control filtering in advance by representing rules as a graph structure that can be queried efficiently. Instead of storing all data with full access control metadata and filtering at retrieval time, the system pre-organizes access control information in a graph structure that enables fast querying and filtering operations, reducing the effective data volume that needs to be processed.
Data Source
AI summary
In one embodiment, a method includes receiving a request for an object; retrieving one or more rules to evaluate whether to allow or deny access to the object, wherein a first rule is of an allow-type or a deny-type; evaluating the first rule by executing one or more of its operations, wherein when any of the executed operations of the first rule returns a result that is not definitive, if the first rule is of the allow-type, assigning a final result as an indication to skip evaluation of the rule, and if the rule is of the deny-type, assigning the final result to the first rule as an indication to deny access to the object; determining final results for the one or more rules; and based on the final results, allowing or denying access to the object.