UI Access Policy Objects for Dynamic Database Permissions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user interfaces often unintentionally expose sensitive or confidential database information, and existing access control methods are inadequate for dynamically changing interfaces.
Innovation Solution
A system that generates and enforces access control policies by creating a policy object based on user and element permissions, ensuring only authorized data is accessed and displayed in real-time user interfaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If user interfaces dynamically change in real time to allow customization and collaboration, then adaptability and ease of operation are improved, but access control security deteriorates due to unintentional exposure of sensitive data
Solution Approach 1:
The system performs preliminary actions by generating a policy object before serving queries to the user interface. This policy object is constructed by analyzing the interface schema, identifying all database cells that could be accessed through the interface elements, and establishing access rules in advance. This preliminary policy generation ensures that even as the interface dynamically changes, there is always a pre-established security framework in place to prevent unauthorized data exposure.
Solution Approach 2:
The patent introduces a policy object as an intermediary layer between the user interface and the database. This intermediary contains access control rules that mediate all data requests, filtering out sensitive information that should not be accessed. The policy object acts as a security gateway that allows legitimate interface functionality while blocking unauthorized access to confidential data, thus resolving the contradiction between dynamic adaptability and security.
2Reliability
If access control policies are enforced on dynamically changing interfaces, then data security is improved, but system complexity increases due to real-time policy evaluation
Solution Approach 1:
The system generates the policy object in advance by analyzing the interface schema and identifying all potential data access paths. This preliminary generation of access control rules eliminates the need for complex real-time policy evaluation during query processing. The policy object is constructed once based on the interface structure, and then reused for all subsequent queries, significantly reducing system complexity while maintaining security.
Solution Approach 2:
The patent creates a simplified copy of the interface schema in the policy object that contains only the access control information necessary for security enforcement. Instead of evaluating complex interface dynamics in real-time, the system uses this copied structural representation to determine data accessibility. This copying approach reduces computational complexity while preserving the essential security requirements.
3Ease of operation
If all database cells are made accessible to user interfaces for full functionality, then ease of operation is improved, but information security deteriorates due to exposure of confidential information
Solution Approach 1:
The patent applies local quality by making different database cells accessible to different user interfaces based on their specific needs. The policy object is constructed by analyzing each interface element and determining which cells should be accessible to that particular interface. This granular, localized approach to access control ensures that each interface receives only the data it requires for its function, maintaining ease of operation while preventing unauthorized access to confidential information through selective data exposure.
Data Source
Figure 1~2
Figure 3
Figure 4A
AI summary
A computing system may receive a schema of user interface comprising an arrangement of interface elements, each element configured to display data from cells of a database. The system may receive a user permission for the user interface and an element permission for an interface element. The system may generate a policy object for the user interface based on the user permission and the element permission. The policy object specifies which cells of the database can be accessed by the user interface. The system may receive a query from a client device associated with a user to implement a local instance of the user interface. The system may serve the query according to the policy object, where serving the query includes providing data from the database that the user interface provides access to without providing other data from the database that should not be accessible according to the policy object.