Time Series Access Control via Aggregated Data Grouping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing access to time series data in computing environments is complex due to its hierarchical structure, long time ranges, and numerous tenants with varying access rights, making it impractical to apply access policies and revoke permissions effectively.
Innovation Solution
Implementing a security module that groups time series data streams based on rules and assigns them to access control containers, which enforce access policies through defined access control rules, allowing or denying access based on user permissions and time ranges.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If access policies are applied to each individual time series metric, then access control precision is improved, but device complexity and processing overhead increase significantly
Solution Approach 1:
The patent merges multiple individual time series metrics into a single aggregated time series that represents the collective state of multiple resources. Access policies are applied to this aggregated series rather than to each individual metric, reducing the number of access control decisions from thousands to a manageable number while maintaining security. This combining approach resolves the contradiction by reducing system complexity without sacrificing access control precision at the aggregated level.
Solution Approach 2:
The aggregated time series serves multiple functions simultaneously: it acts as both a data structure for storing metric information and as an access control unit for enforcing security policies. This multi-functionality eliminates the need for separate access control mechanisms for each individual metric, thereby reducing device complexity while maintaining precise access control through the universal application of policies to the aggregated series.
2Reliability
If access control is implemented for each tenant with individual permissions, then security is improved, but processing overhead and system complexity increase
Solution Approach 1:
The patent segments the multi-tenant environment into isolated access control contexts where each tenant's access policies are evaluated independently against their own aggregated time series. This segmentation allows security to be maintained for each tenant without requiring the system to process access control decisions for all tenants simultaneously, thereby improving security while managing processing overhead through temporal and logical separation.
Solution Approach 2:
Within each tenant's context, multiple access control decisions for different metrics are merged into a single access control evaluation against the aggregated time series. This combining reduces the number of processing operations required per tenant from potentially thousands of individual metric checks to a single aggregated series check, significantly improving processing efficiency while maintaining security through the unified access control mechanism.
3Reliability
If access permissions are revoked for a metric stream, then security is improved, but determining retroactive access requirements becomes complex
Solution Approach 1:
The patent establishes access control policies on the aggregated time series before any permission revocations occur. When access permissions are revoked, the system can retroactively determine which individual metrics within the aggregated series were affected by the policy change, because the aggregated series serves as a pre-defined access control boundary. This preliminary structuring simplifies retroactive access management compared to managing individual metric permissions.
Solution Approach 2:
When a tenant's access is revoked, the system extracts only the specific metrics within the aggregated time series that were subject to the revoked policy, rather than having to manage access control for the entire aggregated series or all individual metrics. This extraction approach reduces access management complexity by isolating only the affected data elements while maintaining security through the structured access control framework.
Data Source
AI summary
Systems, methods, and other embodiments associated with implementing access control to time series data are described. In one embodiment, a method includes associating streams of time series data to a group and assigning the group to an access control container. The example method may also include defining an access policy specifying access control rules for authorizing access to the time series data. The example method may also include receiving a request from a requestor to access the time series data of the group through the access control container. The example method may also include executing the access control rules within the access policy to either deny the request or allow implementation of the request.