Virtual Database Policy Enforcement Across Heterogeneous Repositories
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems struggle with enforcing complex and dynamic policies across diverse data storage units, lacking the ability to manage static and hard-to-manage metadata, and failing to provide effective policy enforcement for user sets defined by roles, groups, and hierarchies.
Innovation Solution
A virtual database system acts as a middleware tier that enforces diverse policy requirements across various data stores by translating user metadata into command graphs, applying security policies, and optimizing these graphs to ensure efficient data transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional systems attach metadata directly to users and roles with storage systems enforcing policies, then policy enforcement is simple for single data storage units, but the system becomes static and hard to manage across multiple data storage units
Solution Approach 1:
The patent introduces a virtual database system as an intermediary layer between users and multiple data storage units. This virtual database receives policy definitions from users and automatically translates them into appropriate policies for each underlying data storage unit, eliminating the need for manual metadata management across multiple systems while maintaining adaptability.
Solution Approach 2:
The virtual database system provides a universal policy enforcement mechanism that works across diverse data storage units (relational databases, NoSQL databases, data warehouses, etc.). It offers a single interface for policy management that adapts to different storage unit requirements, making the system versatile without increasing user-facing complexity.
2Reliability
If systems forward changes to separate external data storage units, then some policy synchronization is achieved, but numerous data storage units still lack the ability to express or enforce policies
Solution Approach 1:
The virtual database acts as a mediator that translates universal policy expressions into storage-unit-specific policy formats. It receives high-level policy definitions and automatically adapts them to the capabilities of each target data storage unit, ensuring consistent policy enforcement across heterogeneous systems without requiring each storage unit to natively support all policy types.
Solution Approach 2:
The system changes the parameter representation of policies based on the target data storage unit. It transforms a unified policy language into storage-unit-specific parameters and formats, allowing the same policy intent to be enforced across different technologies (SQL databases, NoSQL databases, data lakes) with varying capabilities.
3Ease of operation
If simple policy assignment methods are used, then basic policy enforcement is achieved, but limited ways exist to assign policy items to complex user sets defined by memberships within larger data structures
Solution Approach 1:
The virtual database serves as an intermediary that handles complex user set definitions (groups, hierarchies, roles) internally. Users simply define policies for logical user sets, and the virtual database automatically resolves the complex membership relationships and translates them into appropriate access controls for each underlying data storage unit, maintaining both simplicity and complexity support.
Data Source
AI summary
A method for transacting data with a data repository via a virtual database system includes receiving a query comprising user metadata and a request for transacting data with one or more data repositories and parsing the query to create a command graph comprising one or more nodes and node-associated metadata, wherein each of the one or more nodes represents a command action for processing or transacting the data, and the node-associated metadata describes a behavior of the command action. Further, the method includes retrieving one or more policy rules based on the user metadata, applying security policies to the one or more nodes by updating the node-associated metadata, updating the command graph based on the updating of the node-associated metadata, and executing each of the command actions corresponding to the one or more nodes of the updated command graph.