Fine-grained access control based on database's procedural language for the accessed resource

Abstract

Methods, systems, apparatus, and computer program products are provided for controlling access to a database. A data processing application can receive a request from a user to access data elements stored in a distributed database, the request including a block of procedural language code. A procedural language code analyzer can retrieve an access control policy that indicates permissions to access the data elements. A control system can determine, based on the access control policy, that access to a restricted portion of the data elements is denied. A refactoring system can generate a refactored code block that allows the user to access unrestricted data elements, such as by modifying the request to remove a portion of the data elements for which access is sought. The refactoring system can then provide the modified request to the distributed database to receive the data elements that the user is allowed to access.

Description

Technical Field

[0001] This application generally relates to databases and access control rules and policies that define user access rights and restrict user access to data or processing sensitive business logic. Background Technology

[0002] Procedural language extensions can be used with relational database languages. Such extensions allow users to combine database languages ​​and procedural programming to retrieve and manipulate data stored in database tables. An example of such a procedural language extension is PL / SQL, available in Oracle databases. PL / SQL can be written as blocks containing complex business logic and embedded SQL statements for accessing data elements. Blocks without names are called anonymous blocks. An anonymous block is the simplest unit in PL / SQL. It is called an "anonymous" block because it is not stored in the Oracle database. Embedded SQL statements from PL / SQL blocks access data elements, such as databases, schemas, and tables that are access-controlled using various rules and access control policies. Access control rules and policies define a user's access rights and restrict user access to data or processing sensitive business logic. Summary of the Invention

[0003] In general, this specification relates to fine-grained access control for procedural code blocks defined as accessing data from a database. Systems, computer program products, and methods for implementing access control to distributed databases or file systems are described.

[0004] Methods, systems, apparatus, and computer program products for controlling access to a database are provided. A data processing application can receive a request from a user to access data elements stored in a distributed database; this request includes a procedural language code block (e.g., a PL / SQL code block). A procedural language code block analyzer can obtain an access control policy indicating the permissions to access the data elements. The control system can determine, based on the access control policy, that access to a restricted portion of a data element is denied. A refactoring system can generate a refactored code block that allows the user to access the data element without restriction. For example, the refactoring system can modify a user-supplied request by refactoring the PL / SQL block to remove the request seeking access to a restricted portion. The refactoring system can then provide the modified request to the distributed database to receive a second portion of the data element that the user is allowed to access.

[0005] In general, one innovative aspect of the subject matter described in this specification can be embodied in methods that include enforcing access control at the distributed computing level of a distributed computing system, either within a procedural language extension block or before that block is executed. An example of such a procedural language extension for SQL is PL / SQL, which is available in Oracle databases. Other examples of procedural language extensions for SQL include SQL / PSM, PSQL, and ABAP, as well as Perl and Python for PostgreSQL.

[0006] Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform actions of the method. The configuration of one or more computer systems to perform a specific operation or action means that the system has software, firmware, hardware, or a combination thereof installed thereon that causes the system to perform the operation or action in operation. The configuration of one or more computer programs to perform a specific operation or action means that the one or more programs include instructions that, when executed by a data processing apparatus, cause the apparatus to perform the operation or action.

[0007] The foregoing and other embodiments may each optionally include one or more of the following features, either individually or in combination. In particular, one embodiment includes all of the following features in combination.

[0008] The sample data access system enhances data security by ensuring fine-grained security rules and policies when supplying data via PL / SQL procedures. The benefits of using stored procedures instead of application code stored locally on client computers include allowing modular programming, faster execution, reduced network traffic, and the ability to serve as a security mechanism.

[0009] The data access system described in this manual improves data security by intercepting PL / SQL code blocks before they access data and by enforcing the rules and policies of the policy engine when accessing data from the database.

[0010] Details of one or more embodiments of the subject matter of this specification are set forth in the accompanying drawings and the following description. Other features, aspects, and advantages of the subject matter will become apparent from the specification, drawings, and claims. Attached Figure Description

[0011] Figure 1 This is a block diagram illustrating an example distributed computing system.

[0012] Figure 2 An example architecture for access control of procedural code blocks is described.

[0013] Figure 3 The architecture for access control used to refactor procedural code blocks is described.

[0014] Figure 4 It is a flowchart used to determine data access based on access control policies.

[0015] Figure 5 This is a sample procedure code block.

[0016] Figure 6 This is an example procedural code block after the refactoring of the PL / SQL code block.

[0017] Figure 7 This is a sample user data access element.

[0018] Figure 8 This is a sample process data access element.

[0019] Figure 9 This is a sample user data access element after the reconstruction.

[0020] The same reference numerals and names in different figures indicate the same elements. Detailed Implementation

[0021] I. Example Implementation

[0022] As mentioned above, procedural language extensions can be used with relational database languages. One issue is that access control for procedural language blocks is binary. In other words, if a user does not have permission to access at least one database element required by the procedural language block, the block will not execute, causing the entire query to fail. By refactoring (or modifying) the procedural language block, it is possible to execute the refactored block to provide at least a partially responsive answer to the query without accessing restricted database elements.

[0023] Figure 1 This is a block diagram illustrating an example distributed computing system 100. As shown, system 100 includes a client layer 102 (including client devices 122), a distributed computing layer 104 (including a distributed execution framework 114, a strategy engine 116, and a data processing application 118), a procedural language code block layer 106, and a data layer 108 (including a distributed database or distributed file system 112).

[0024] Client layer 102 may include one or more client devices 122 used by one or more users 120. Client devices 122 run software that can request procedures to be performed by a data processing application 118 executed in distributed computing layer 104 (e.g., in distributed execution framework 114). Distributed computing layer 104 connects to one or more distributed databases or file systems 112 in data layer 108 to retrieve data for data processing application 118.

[0025] Data processing application 118 can receive data access requests from user 120. Data access requests can be received in the form of procedural language code blocks 106a (e.g., PL / SQL).

[0026] Before executing procedural language code block 106a, data access system 114a reads the data access requests of procedural language code block 106a to determine which data elements, such as databases, schemas, tables, and columns, procedural language code block 106a will access. Data access system 114a then retrieves one or more access control policies for user 120 corresponding to these data elements (e.g., databases, schemas, tables, and columns) from policy engine 116. Data access system 114a may be embedded in distributed execution framework 114. Typically, data access system 114a sends a call to policy engine 116 including user identifiers and data element identifiers, and receives back access control policies for individual users and / or for data elements. Policy engine 116 may be embedded in distributed execution framework 114.

[0027] If the access control policy settings for a user are inconsistent with procedural language code block 106a, then user 120 does not have permission to access one or more data elements requested by procedural language code block 106a. In this case, although the distributed execution framework 114 could deny permission to execute procedural language code block 106a, this is not ideal because the user may still have access to other data elements requested in procedural language code block 106a that are not restricted by the access control policy. One solution discussed in this disclosure is to refactor procedural language code block 106a to conform to user 120's access control policy settings and allow execution of the refactored code block.

[0028] Specifically, data access system 114a can modify data access requests to conform to the access control policy retrieved for a specific user 120. Specifically, data access system 114a can modify procedural language code block 106a to generate a refactored procedural language code block 106b, which requests only the allowed data elements set by the access control policy for user 120. The refactored procedural language block 106b is then executed (e.g., by distributed execution framework 114) to retrieve the allowed data elements from distributed file system 112. Distributed execution framework 114 then provides the retrieved data to data processing application 118, which in turn provides the data to client device 122 or user 120's account.

[0029] Data processing application 118 includes data access methods. These data access methods can call data access methods executed by procedural language code layer 106 using direct application programming interface methods. Data access methods in procedural language code layer 106 can override data access methods in data processing application 118, thus implicitly calling data access methods in procedural language code layer 106.

[0030] A second data access request can be received from a second data processing application executing in the distributed computing layer 104. The second data access request can be associated with a second user. The second data access request can be directed to a secure application executing in the distributed execution framework 114 to obtain data access.

[0031] Figure 2 An example architecture for access control of procedural language code block 106a is depicted. For example, data access system 114a determines access permissions for the procedural language code block 106a by comparing the data element requested by the procedural language code block 106a with the user permissions for the user submitting the procedural language code block 106a. If necessary, data access system 114a then refactors the procedural code block to conform to the access control permissions. For example, if the requested data element does not match the allowed data element for the user, data access system 114a refactors the procedural code block to remove a portion of procedural language code block 106a that requests access to the restricted data element.

[0032] User 120 can submit procedural language code block 106a as part of a data access request through client device 122. Figure 5 Example procedural code block 106a is shown. This example procedural language code block provides an example of requesting an update to an employee's salary. Naturally, the code block can be used to perform many other functions.

[0033] A user request that may include procedural language code block 106a may be intercepted by an interception module 208 in a data access system 114a. The interception module may be configured to intercept requests submitted by a user via a communication channel (such as a network) between the communication coupling client 102 and the distributed computing layer 104. In an implementation, the interception module 208 may also intercept identification information of the user 120 submitting the request, which includes procedural language code block 106a. The interception module 208 identifies which part of the request is procedural language code block 106a. The interception module 208 then outputs the identified procedural language code block 106a to a procedural language (PL) block analyzer 210.

[0034] The PL code block analyzer 210 generates or restores a PL code block description 214 (“P-DSTC”), which includes a list of data elements for each data element.

[0035] 214a, such as databases, schemas, tables, and columns (“DSTC”) in procedural language code blocks

[0036] As specified in 106a, the PL code block analyzer 210 can be configured to extract code in various ways.

[0037] Data element list 214a. In one implementation, PL code block analyzer 210 can be configured to perform lexical analysis on procedural language code block 106a to lexically represent the code block contained therein to generate one or more tokens (e.g., strings). Based on the generated tokens, PL code block analyzer 210 can tag DSTC elements, such as by using predefined metadata to identify pre-stored procedures or elements discovered by PL code block analyzer 210. In another implementation, the PL code block analyzer can search for keywords in procedural language code block 106a to identify certain terms or operators (e.g., DECLARE, SELECT, JOIN, etc.) and tag DSTC elements that can follow such terms or operators.

[0038] Example of P-DSTC 214 in Figure 8 As shown in the example, list 214a in P-DSTC 214 comprises multiple rows, each indicating a data element requested for access by procedural language code block 106a. For example, row 214a-1 indicates that procedural language code block 106a includes a data access request for the "Emp" table in the "Example" schema of the "Example" database, and row 214a-2 indicates that procedural language code block 106a includes a data access request for the social security number column in the "Emp" table in the example schema of the example database.

[0039] In addition, P-DSTC 214 may include a permission list 214b that specifies read, write, and execute permissions for the data elements in list 214a that apply to all users. Permission list 214b may be part of the same table as the data element list 214a; for example, each row in the table may include a field specifying the permissions for the associated data elements.

[0040] The PL block analyzer 210 uses the policy engine 116 to generate or restore the permission list 214b of the P-DSTC 214. To generate the P-DSTC 214, the block analyzer 210 can invoke the policy engine 116, which includes identifiers for data elements in list 214a. The policy engine 116 searches its policies and returns to the PL block analyzer 210 the policies associated with the requested data. These policies may include execute permissions associated with the data for all users (e.g., all standard users). The PL block analyzer 210 enters the received policies into the P-DSTC 214 to provide the permission list 214b for all users.

[0041] If a P-DSTC 214 was previously generated and stored for a data element specified in procedural language code block 106a, the PL block analyzer 210 can restore the stored P-DSTC instead of generating a new one. This can be determined by the data access system 114a by cross-referencing the process name with the database of stored P-DSTC 214. For example, a previously submitted procedural language code block could have a process name that matches the process name of the current procedural language code block 106a.

[0042] If P-DSTC 214 for procedural language code block 116a does not exist in the P-DSTC list, the block parser generates P-DSTC 214 as described above. Even if P-DSTC 214 for the submitted procedural language code block 106a exists in the database, it can still be updated. For example, a P-DSTC can be updated based on an update to a policy associated with one or more data elements specified in procedural language code block 116a. In some implementations, if the procedure is anonymous, it is not added to the database.

[0043] The PL block analyzer 210 also generates a list of P statements 212 (also referred to herein as the "P list"). The code block analyzer 210 derives the list of P statements from the procedural language code block 106.

[0044] 212, for example, SQL. List 212 in P is used in procedure code block 106 to access the database.

[0045] SQL database statements. Exporting and storing list 212 in... Figure 3 This is described in more detail below. At runtime, the PL block analyzer 210 generates an access control description 218 (“ACL-DSTC”), which includes a list 218a of data elements (e.g., databases, schemas, tables, and columns) requested by the procedural language code block 106a and a list 218b of user permissions for the specific user making the data request. The ACL-DSTC 218 may have a similar format to the P-DSTC 214, and its generation may be similarly guided by the policy engine 116. Specifically, for example, by submitting identification information (e.g., user employee ID) of the user who submitted the PL / SQL code block 106a to the policy engine, the PL block analyzer 210 may make a call to the policy engine 116, including identifiers for the data elements in list 214a and an indication that the call is for a specific user. In response, the PL block analyzer 210 receives user-specific permissions from the policy engine 116, and these user-specific permissions can then be entered into the ACL-DSTC 214 to provide the user-specific permission list 218b. Generating and storing ACL-DSTC 218 references Figure 7 To describe in more detail.

[0046] The P-DSTC provides a list of general access permissions for all users (or all standard users without specific privileges) to the data elements specified in process language code block 106a. Control system 220 receives P-DSTC 214 as input to determine whether user 120, as a standard user, has sufficient permissions to execute the current process code block 106. For example, Figure 5 The example process block depicted requests access to the salary column of the payroll table. If P-DSTC 214 indicates that the standard user does not have permission to read the salary column of the payroll table, the control system 220 denies user 120 execution of the current process code block.

[0047] If user access based on P-DSTC is denied, the control system 220 checks whether the user can receive access to at least a portion of the requested data element based on the refactored procedure code block. For example, the control system 220 may receive ACL-DSTC 218 and P-DSTC 214 as input to determine whether user 120 has sufficient permissions to execute a previously stored procedure code block (pre-PLCB), such as the refactored procedure code block pre-106b for an anonymous user. The control system 220 determines such permissions by running a matching algorithm on ACL-DSTC 218 and P-DSTC 214 at runtime, for example, as... Figure 7 and 8As shown. The output representation is implementation-specific. For example, determining whether a user has permission to execute a code block can be binary, such as 1 indicating access is allowed and the system can execute the code block, or 0 indicating access is denied and an exception can be thrown. If P-DSTC 214 and ACL-DSTC218 have matching policies, the previously stored procedural code block pre-106b (e.g., the original procedural language code block can be replaced with pre-PLCB) is executed. This previously stored procedural code block pre-106b can be generated by running the refactoring process discussed below using ACL-DSTC 218.

[0048] However, if P-DSTC 214 and ACL-DSTC 218 do not have a matching strategy (e.g., when P-DSTC 214 and ACL-DSTC 218 have a partially matching list of data elements),

[0049] 214a and 218a, but without matching strategies 214b and 218b, then there is no previously...

[0050] The stored procedure code block pre-106b can be executed. This is because such a mismatch indicates that user 120 has fewer privileges than the anonymous user to access the database, tables, or schema in order to execute the previously stored procedure code block pre-106b.

[0051] If the control system 220 determines that user 120 does not have permission to execute the current process code block as a standard user or to execute a previously stored process code block, the refactoring system 222 receives P-DSTC 214 and an SQL statement as input from the P statement list 212 and generates a modified or refactored process code block referred to as the modified process 224. How process code block 106 is refactored will be determined later. Figure 3 A more detailed description is provided below.

[0052] The PL block analyzer 210 also generates a P control flow tree 226. The P control flow tree 226 can be configured to generate the control flow of PL / SQL block 106a. In some examples, the policy engine 116 may include access policies based on control flow patterns, which can be defined based on access patterns. If the control flow violates one or more control flow pattern-based policies in the policy engine 116, PL / SQL block 106a can be rejected. For example, if PL / SQL block 106a includes a process of selecting data from a table containing employee information and storing the data in a temporary table, even if the user submitting PL / SQL block 106a is granted access to the employee table, there is still a risk that the temporary table storing sensitive data may be accessible to other users without access to the employee table. Therefore, in such a case, the P control flow tree 226 can reject PL / SQL block 106a based on the control flow pattern access policy. If the control flow is rejected, the P control flow tree can be provided to the pattern-based control system 228 to determine whether PL / SQL block 106a should be modified, at least based on the access pattern.

[0053] The pattern-based control system 228 can identify and / or generate access patterns 230 related to elements, control flow, and dependencies in previous PL / SQL code blocks and / or stored procedures. For example, access pattern 230 can indicate that certain access elements present in PL / SQL code block 106a can be used for computational, analytical, or other decision-making purposes within the control flow, but underlying data (e.g., sensitive information such as individual payroll information) must not be copied, stored in other tables, or otherwise returned to the user. In other words, the pattern-based control system 228 can be configured to determine secure access based at least on individual user access permissions and / or control flow-based access patterns. As a result, data leakage problems can be minimized by modifying or refactoring PL / SQL code block 106a to remove portions of PL / SQL code block 106 that violate control flow-based access policies. In some implementations, the pattern-based control system 228 can also identify or learn new access patterns based on PL / SQL code block 106a and store these new patterns in access pattern 230. In some other implementations, the history of accessed data elements based on PL / SQL code blocks (e.g., refactored procedures) and / or previously defined stored procedures can be stored in a log by the data access system 114a. For example, the log may identify the user accessing the data element, the user accessing and / or being allowed access to the data element, the access time and / or access type (e.g., read, write, etc.). In some other implementations, the log may also identify attempted accesses, such as attempted accesses to data elements in the original refactored PL / SQL code block as described herein. The historical access log may be available to certain users (such as administrators) to identify any potential vulnerabilities and / or access control issues, thereby enabling the generation or modification of access control policies in the policy engine 116 and / or access mode 230.

[0054] Figure 3 Describing the use of reconstruction Figure 5 The example code block demonstrates access control for accessing the employee payroll architecture.

[0055] refer to Figure 3 The PL block analyzer 302 generates database statements 304, such as SQL statements, from the procedure code block 106. The code block analyzer 302 stores the database statements 304 in memory.

[0056] The refactoring system 308 receives user database statements 304 and user database elements 306 (i.e., ACL-DSTC) as input for the execution procedure code block. The refactoring system 308 identifies elements of the database statement 304 that the user does not have permission to access, such as databases, tables, schemas, or columns. The refactoring system 308 can do this by checking permissions in the ACL-DSTC. The refactoring system 308 refactors the database statement 304 and generates a modified or refactored procedure code block called the refactored procedure 310 at runtime, such that the database statement 304 and the refactored procedure 310 are syntactically consistent with the user access control policy represented by the user database element 306.

[0057] The refactoring system 308 can rewrite the database statement 304 using various methods. For example, in a particular embodiment, if the user database element 306 specifies that the user does not have execution permissions on a first part of the database element, then the second part of the database element can be executed. In another embodiment, if the user database element 306 specifies that the user does not have read permissions on a specific column, the refactoring system 304 can rewrite elements in the database statement 304 to include pre-initialized variables instead of reading directly from the column. For example, if the user cannot read the salary column, the refactoring system 304 rewrites the database statement 304 to include a salary variable pre-initialized to zero instead of reading the salary amount from the salary column. The refactoring system 308 then generates a refactored procedure 310 from the refactored database statement 304, which removes requests for access to data elements that the user does not have access to, and the refactoring system 308 can then provide the refactored procedure to the distributed database to receive data elements that the user is allowed to access (e.g., defined by a modified procedure). An example refactored procedure code block including pre-initialized variables is shown in [the original text]. Figure 6 A more detailed description is provided below.

[0058] The refactoring system 308 can generate a modified or refactored procedure 310 from the database statement 304 in various ways. For example, in a particular embodiment, the refactored procedure code block can point to the database statement. Therefore, when the procedure code block is executed, the procedure code block implicitly invokes the database statement 304. In another embodiment, the database statement 304 can be used to create a copy of the original procedure code block, or the original procedure can be modified to include the database statement 304. The refactored procedure 310 is stored.

[0059] In some implementations, the refactoring system 308 may generate the refactored process 310 in other ways, including but not limited to modifying the semantics of the original process code block or portions thereof. For example, the refactoring system 308 may modify the original process code block to add or remove logic based on user database element 306. As an illustration, the PL block analyzer may determine the execution context of the original process code block as a calculation for aggregating values ​​of multiple employees (e.g., aggregating salaries). At least based on the execution context, the refactoring system 308 may implement one or more filters or other logic in the process code block to perform the aforementioned execution.

[0060] Figure 4 This is a flowchart for determining data access based on access control policies. For convenience, process 400 will be described as being executed by a system of one or more computers located in one or more locations. For example, a distributed computing layer appropriately programmed according to this specification (e.g., Figure 1 The distributed computing layer 104) can execute process 400.

[0061] like Figure 2 The PL block analyzer shown receives at least one procedural language code block (PLCB) requesting access to one or more data elements from a database (step 402). The code block analyzer may receive the procedural language code block as part of a request submitted by a user (or client device) to the database (e.g., a distributed database). An example of a procedural code block used to update employee salaries is shown in... Figure 5 As shown in the image.

[0062] like Figure 2 The PL block analyzer shown identifies the database elements that a procedural language code block requests access to. The PL block analyzer derives a P-DSTC. The P-DSTC specifies the database, schema, tables, and columns accessed by the procedural language code block. An example P-DSTC for updating employee salaries is shown below. Figure 8 As shown in the example P-DSTC, the example procedure code block can access every column of the employee and payroll tables, but is denied read access to the salary column of the payroll table.

[0063] Figure 2 The computer system shown determines the user's access control policy for database elements, for example, during the execution of a procedural language code block (step 404). Example P-DSTC specifies that the user can read every column of the employee table and update every column of the salary table. The user is denied read access to the salary column of the salary table.

[0064] The computer system determines whether the access control policy restricts user access to the restricted portion of the requested data element (step 406). For example, the control system executes a matching algorithm to check whether the user has permission to access the database element requested by the procedure code block. If the control system determines that the user does not have sufficient access rights, it refactors the procedure code block, such as... Figure 3 As shown. The refactored procedure code block generates a modified procedure code block that does not request access to database elements that the user does not have access to, as defined by the access control policy (step 408). The computer system submits the refactored procedure code block to the database to receive data elements that the user has access to (step 410).

[0065] For example, the control system will determine that the user does not have sufficient permissions to access the database element accessed by the example procedural language code block to update the employee's salary. Specifically, Figure 8 The user shown in the image does not have read permissions for the salary column in the salary table. Therefore, the system is refactored to create refactored database elements and procedure code blocks that conform to the user's access control policy at runtime. An example of the refactored procedure code block is shown in... Figure 6 As described in the text. Figure 4 As shown, the refactored system inserts pre-initialized salary variables into the database statement instead of reading them from the salary column. This conforms to the user's access control policy, which denies read access to the salary column of the salary table.

[0066] Figure 5 This is a sample procedure code block. Figure 5 This is the procedure code block used to update employee salaries. The PL / SQL block declares the salary, social security, and birthdate variables as floating-point, text, and date data types, respectively (lines 2-4). The procedure retrieves the salary from the payroll table, the social security number from the emp table, and the birthdate from the employee's employee table. These values ​​are stored in the salary, social security number, and birthdate variables, respectively (lines 6-8). The procedure prints the initial values ​​of the employee's salary, social security number, and birthdate (lines 9-11). The procedure checks the employee's salary value and updates it accordingly. If the salary value is less than zero, it is set to zero. If the employee's salary value is less than 5000, between 5000 and 10000, between 10000 and 20000, or higher, the salary is increased by 10%, 15%, 20%, and 25% of the initial value, respectively (lines 12-22). The process uses the calculated wage update to update the wage values ​​of the selected employees in the payroll table and returns the updated wage values ​​(lines 24-27).

[0067] Figure 5 The procedure code block shown is used for exporting Figure 8 The table shown specifies the read, write, and execute permissions (P-DSTC) of a procedure code block for database elements (e.g., databases, schemas, tables, and columns). Specific methods for deriving P-DSTCs from a procedure code block are described in [link to documentation]. Figure 8 A more detailed description is provided below.

[0068] Figure 6 This is an example of a refactored process code block. Figure 6 This is a sample refactored procedure code for updating employee salaries. The refactored procedure block declares salary, social security number, and birthdate variables as floating-point, text, and date data types, respectively (lines 2-4). The procedure stores the employee's salary, social security number, and birthdate. Figure 5 Unlike the example procedure block, the refactored procedure block does not access the salary column of the payroll table and initializes the salary variable to zero. Additionally, the social security number variable is coerced to a string. The birthdate value is retrieved from the "Salary" and "Employee" tables by specifying a common `employee_id` between the tables (lines 6-8). The refactored procedure block prints the initial values ​​of the employee's salary, social security number, and birthdate (lines 9-11). The procedure checks the salary range and updates the salary value accordingly. If the salary value is less than zero, it is set to zero. If the employee's salary value is less than 5000, between 5000 and 10000, between 10000 and 20000, or higher, the salary is increased by 10%, 15%, 20%, and 25% of the initial value, respectively (lines 12-22). The procedure uses the calculated salary update to update the salary value of the selected employee in the payroll table and returns the updated salary value (lines 24-27).

[0069] Figure 6 The refactored process code block shown is used to export Figure 9 The refactored table shown specifies read, write, and execute permissions for the database, schema, tables, and columns for the example refactored procedure code block. The procedure data access elements used in the example refactored procedure code block are... Figure 9 A more detailed description is provided below.

[0070] Figure 7 This is an example user data access element. ACL-DSTC specifies read, write, and execute permissions for anonymous users on database elements, such as databases, schemas, tables, and columns (DSTC). For example, a request to execute... Figure 5An anonymous user in the example procedure block can read from the "Employees" table, update the "Salary" table, but cannot read the "Salary" column of the "Salary" table. The ACL-DSTC can be stored as a flat data structure. A user's ACL-DSTC can be predetermined or determined during the execution of the procedure block. Access control policies for users can be determined in various ways. For example, in one embodiment, a user can belong to one or more groups, and each group can specify one or more users. A group can have specific permissions for users to perform jobs or roles. Therefore, a user's permissions can be set to the permissions of that group by default. If a user belongs to one or more groups, the user's permissions can be assigned the highest or lowest permissions. In another embodiment, a user's access control policy can be updated incrementally based on the procedures the user wishes to execute. For example, if a user does not have permissions to access any database tables, but the procedure the user is executing requires access to two of those tables, the ACL-DSTC for the user can be updated to allow the user access to the two tables accessed by the procedure block.

[0071] Figure 8 This is an example procedure data access element. The code block analyzer generates a table specifying the database, schema, tables, and columns (P-DSTC) accessed by the procedure. The P-DSTC specifies the read, write, and execute permissions of the procedure code block to access database elements. The P-DSTC can be stored as a flat data structure. The access control policy for the procedure code block can be determined in various ways. For example, in one embodiment, the procedure can be cross-referenced against a list of keywords. Keywords can include database elements such as tables, columns, databases, and schemas. Database operators (e.g., SQL operators) of the procedure code block can correspond to permissions. For example, a SELECT statement can represent a procedure requiring read access, while an UPDATE statement can represent a procedure requiring execute or write permissions. Alternatively, in another embodiment, natural language processing can be used to extract the appropriate permissions of the procedure for database elements. Figure 8 It shows Figure 5 The example procedure has read access to all columns in the "Employees" table. The procedure has update access to every column in the "Salaries" table, except for the "Wages" column, which is denied read access.

[0072] Figure 9 These are sample data access elements after the refactoring process. The refactored process has read access to every column in the "Employees" table, except for the hidden Social Security Number column. The refactored process also has update access to every column in the "Salaries" table, except for the "Wages" column, which is denied read access.

[0073] II. Example Implementations of Mobile and Fixed Equipment

[0074] The term "data processing apparatus" encompasses all kinds of devices, apparatuses, and machines used for processing data, including, for example, programmable processors, computers, or multiple processors or computers. The apparatus may include dedicated logic circuit systems, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits). In addition to hardware, the apparatus may also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, protocol stacks, database management systems, operating systems, or combinations thereof.

[0075] A computer program (also referred to or described as a program, software, software application, module, software module, script, or code) can be written in any form of programming language, including compiled or interpreted languages, or declarative or procedural languages, and can be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for a computing environment. A computer program may, but does not necessarily, correspond to a file in a file system. A program can be stored as a part of a file containing other programs or data, for example, as a markup language document, a single file dedicated to the program in question, or one or more scripts within multiple harmonizing files (e.g., a file storing one or more code modules, subroutines, or portions). A computer program can be deployed to be executed on a single computer or on multiple computers located at a site or distributed across multiple sites and interconnected via a communication network.

[0076] As used in this specification, "engine" or "software engine" refers to a software-implemented input / output system that provides outputs different from the inputs. An engine can be a coded functional block, such as a library, platform, software development kit ("SDK"), or object. Each engine can be implemented on any suitable type of computing device including one or more processors and computer-readable media, such as a server, mobile phone, tablet, laptop, music player, e-book reader, laptop or desktop computer, PDA, smartphone, or other fixed or portable device. Furthermore, two or more engines can be implemented on the same computing device or on different computing devices.

[0077] The processes and logic flows described in this specification can be executed by one or more programmable computers, which execute one or more computer programs to perform functions by manipulating input data and generating output. The processes and logic flows can also be executed by a dedicated logic circuit system, and the device can be implemented as a dedicated logic circuit system, such as an FPGA (Field-Programmable Gate Array) or an ASIC (Application-Specific Integrated Circuit).

[0078] For example, a computer suitable for executing computer programs includes a central processing unit (CPU) that may be based on a general-purpose or special-purpose microprocessor, or both, or any other type. Typically, the CPU receives instructions and data from read-only memory or random access memory, or both. The basic components of a computer are the CPU for executing or implementing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include one or more mass storage devices for storing data, such as disks, magneto-optical disks, or optical disks, or operatively coupled to receive data from or transfer data to one or more mass storage devices, or both. However, a computer does not need to have such devices. Furthermore, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device, such as a universal serial bus (USB) flash drive, to name a few.

[0079] Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, such as semiconductor memory devices like EPROM, EEPROM, and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. Processors and memory may be supplemented or incorporated therein by dedicated logic circuitry systems.

[0080] To provide interaction with the user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device for displaying information to the user, such as a CRT (cathode ray tube) monitor, an LCD (liquid crystal display) monitor, or an OLED monitor, and an input device for providing input to the computer, such as a keyboard, a mouse, or a presence-sensitive display or other surface. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including sound, speech, or tactile input. Furthermore, the computer can interact with the user by sending resources to and receiving resources from the device used by the user; for example, by sending a webpage to a web browser on the user's client device in response to a request received from a web browser.

[0081] Embodiments of the subject matter described in this specification can be implemented in a computing system that includes backend components, such as a data server, or middleware components, such as an application server, or frontend components, such as a client computer with a graphical user interface or a web browser through which a user can interact with the implementation of the subject matter described in this specification, or any combination of one or more such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or media, such as a communication network. Examples of communication networks include local area networks (“LANs”) and wide area networks (“WANs”), such as the Internet.

[0082] A computing system may include clients and servers. Clients and servers are typically geographically separated and usually interact through a communication network. The client-server relationship is established by computer programs running on the respective computers and having a client-server relationship with each other.

[0083] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of this disclosure or the content that may be claimed, but rather as descriptions of features that may be specific to the particular exemplary embodiments described herein. Some features described in this specification within the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments. Furthermore, although features may be described above as functioning in certain combinations and even initially claimed in this way, in some cases, one or more features from the claimed combination may be removed from the combination, and the claimed combination may be for sub-combinations or variations thereof.

[0084] Similarly, although operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring such operations to be performed in the indicated specific order or sequentially, or to perform all indicated operations to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system modules and components in the above embodiments should not be construed as requiring such separation in all embodiments. It should be understood that the described program components and systems can generally be integrated into a single software product or packaged into multiple software products.

[0085] Specific embodiments of this subject matter have been described. Other embodiments are within the scope of the appended claims. For example, the actions recited in the claims may be performed in a different order, but the desired result may still be achieved. As an example, the processes depicted in the drawings do not necessarily require the specific order or sequence shown to achieve the desired result. In some implementations, multitasking and parallel processing may be advantageous.

[0086] III. Example Implementation

[0087] This document discloses a computer-implemented method for controlling access to a database. The computer-implemented method includes: receiving from a user a request by a computer system to access one or more data elements stored in a distributed database, the request including a procedural language code block (PLCB); obtaining an access control policy by the computer system, the access control policy indicating at least one permission required to access the one or more data elements; determining, based on the access control policy, that access to a restricted portion of the one or more data elements is denied by the computer system; modifying the request by the computer system by refactoring the PLCB to remove the request to access the restricted portion of the one or more data elements; and submitting the modified request to the distributed database to receive a second portion of the one or more data elements that the user is allowed to access.

[0088] In one implementation of the aforementioned method, obtaining the access control policy includes: determining one or more database elements specified by the PLCB, each of the one or more database elements indicating the location where the corresponding requested data element is stored in the distributed database; comparing the one or more database elements with a first data structure that includes general access permissions to all users of the distributed database; and determining that the one or more database elements match a first group of database elements in the first data structure, wherein the permissions associated with the first group of database elements stored in the first data structure are obtained as the access control policy.

[0089] In another implementation of the aforementioned method, the method further includes: determining an access control policy that denies access to at least one of the requested one or more data elements; submitting the user's user identifier to a policy engine that stores multiple policies associated with the user in the distributed database; and receiving one or more user access policies from the policy engine, each of the one or more user access policies being associated with a corresponding database element in one or more database elements and indicating the user's permissions to access the corresponding database element, wherein the request is based on one or more user access policies being modified to remove the request to access data elements in one or more data elements that the user does not have access to.

[0090] In another implementation of the aforementioned method, the method further includes: determining a pre-refactoring process language code block (pre-PLCB) associated with a data element in one or more data elements with access permissions, wherein the request is modified by replacing the PLCB with the pre-PLCB.

[0091] In another implementation of the aforementioned method, the pre-PLCB is a refactored PLCB generated in response to a data request previously submitted to the distributed database.

[0092] In another implementation of the aforementioned method, each database element includes an identifier for the database, schema, table, and column of the corresponding requested data element in one or more data elements in the distributed database.

[0093] In another implementation of the aforementioned method, the permissions stored in the first data structure are generated based on the access permissions granted to data requests previously submitted to the distributed database by one or more users.

[0094] In another implementation of the aforementioned method, the access control policy includes a control flow pattern-based access policy, and the modification of the request by the computer system by refactoring the PLCB to remove the restricted portion of access to one or more data elements includes refactoring the PLCB based at least on the access pattern stored in the control flow pattern-based access policy.

[0095] In another implementation of the aforementioned method, the method further includes: identifying a second portion of one or more data elements that the user is allowed to access in a log that includes the history of the accessed data elements.

[0096] This document discloses a system. The system includes one or more processors; and one or more memory devices storing program code configured to be executed by the one or more processors, the program code including: a data processing application configured to receive from a user a request to access one or more data elements stored in a distributed database, the request including a Procedural Language Code Block (PLCB); a Procedural Language (PL) Code Block parser configured to obtain an access control policy indicating at least one permission required to access the one or more data elements; a control system configured to determine, based on the access control policy, that access to a restricted portion of the one or more data elements is denied; and a system refactoring configuration configured to: modify the request by refactoring the PLCB to remove the request to access the restricted portion of the one or more data elements; and provide the modified request to the distributed database to receive a second portion of the one or more data elements that the user is allowed to access.

[0097] In one implementation of the aforementioned system, the PL code block analyzer is configured to: determine one or more database elements specified by the PLCB, each of the one or more database elements indicating the location where the corresponding requested data element is stored in the distributed database; and the control system is configured to: compare the one or more database elements with a first data structure that includes general access permissions to all users of the distributed database; and determine that the one or more database elements match a first group of database elements in the first data structure, wherein access control policy identifiers are stored in the first data structure and associated with the first group of database elements.

[0098] In another implementation of the aforementioned system, the control system is further configured to: determine an access control policy that denies access to at least one of the requested one or more data elements; and wherein the PL block analyzer is configured to: submit a user's user identifier to a policy engine that stores multiple policies associated with the user in the distributed database; and receive one or more user access policies from the policy engine, each of the one or more user access policies being associated with a corresponding database element in one or more database elements and indicating the user's permissions to access the corresponding database element, wherein the request is modified based on one or more user access policies to remove the request to access data elements in one or more data elements that the user does not have access to.

[0099] In another implementation of the aforementioned system, the control system is further configured to: determine a previously stored process language code block (pre-PLCB) associated with a data element among one or more data elements to which the user has access rights, wherein the request is modified by replacing the PLCB with the pre-PLCB.

[0100] In another implementation of the aforementioned system, the pre-PLCB is a refactored PLCB generated in response to a data request previously submitted to the distributed database.

[0101] In another implementation of the aforementioned system, each database element includes an identifier for the database, schema, table, and column of the corresponding requested data element in one or more data elements in a distributed database.

[0102] In another implementation of the aforementioned system, the permissions stored in the first data structure are generated based on the access permissions granted to data requests previously submitted to the distributed database by one or more users.

[0103] In another implementation of the aforementioned system, the access control policy includes a control flow pattern-based access policy; and the system includes a pattern-based control system configured to reconstruct the PLCB based at least on the access patterns stored in the control flow pattern-based access policy.

[0104] In another implementation of the aforementioned system, the system further includes: a log containing the history of accessed data elements, the log identifying at least the second portion of one or more data elements from which the user is permitted to access.

[0105] This document discloses a computer-readable storage medium. The computer-readable storage medium has computer program code recorded thereon, which, when executed by at least one processor, causes at least one processor to perform a method comprising: receiving from a user a request by a computer system to access one or more data elements stored in a distributed database, the request including a procedural language code block (PLCB); obtaining an access control policy by the computer system indicating at least one permission required to access the one or more data elements; determining, based on the access control policy, that access to a restricted portion of the one or more data elements is denied by the computer system; modifying the request by the computer system by refactoring the PLCB to remove the request to access the restricted portion of the one or more data elements; and submitting the modified request to the distributed database by the computer system to receive a second portion of the one or more data elements, to which the user is permitted access.

[0106] In one implementation of the aforementioned computer-readable storage, obtaining an access control policy includes: determining one or more database elements specified by the PLCB, each of the one or more database elements indicating the location where the corresponding requested data element is stored in the distributed database; comparing the one or more database elements with a first data structure that includes general access rights to all users of the distributed database; and determining that the one or more database elements match a first set of database elements in the first data structure, wherein the permissions associated with the first set of database elements stored in the first data structure are obtained as an access control policy.

[0107] IV. Conclusion

[0108] While various embodiments of this disclosure have been described above, it should be understood that they are presented by way of example only and not as limiting. Those skilled in the art will understand that various changes in form and detail may be made therein without departing from the spirit and scope of this disclosure as defined in the appended claims. Therefore, the breadth and scope of this disclosure should not be limited to any of the exemplary embodiments described above, but should be defined solely by the appended claims and their equivalents.

Claims

1. A computer-implemented method for controlling access to a database, the method comprising: A computer system receives a request from a user to access one or more data elements stored in a distributed database, the request including a procedural language code block (PLCB). The computer system obtains an access control policy, which indicates at least one permission required to access the one or more data elements, the obtaining including: Determine one or more database elements specified by the PLCB, each of the one or more database elements indicating the location where the corresponding requested data element is stored in the distributed database; Compare the one or more database elements with a first data structure, the first data structure including general access permissions for all users of the distributed database; and Determine that the one or more database elements match the first group of database elements in the first data structure. The permissions associated with the first group of database elements and stored in the first data structure are obtained as the access control policy; The computer system determines, based on the access control policy, that access to the restricted portion of the one or more data elements is denied; The request is modified by the computer system by reconstructing the PLCB based on the PL code block description P-DSTC for the PLCB to remove the request to access the restricted portion of the one or more data elements, wherein the P-DSTC indicates that a second portion of the one or more data elements is accessible to the PLCB while the restricted portion is inaccessible to the PLCB; and The computer system submits a modified request to the distributed database to receive the second portion of the one or more data elements that the user is allowed to access, wherein the restricted portion of the one or more data elements is rewritten to include pre-initialized variables.

2. The method according to claim 1, further comprising: The access control policy is determined to deny access to at least one of the requested data elements. The user's user identifier is submitted to the policy engine, which stores multiple policies associated with the user in the distributed database; as well as The policy engine receives one or more user access policies, each of which is associated with a corresponding database element in the one or more database elements and indicates the user permissions to access the corresponding database element. The request is modified based on one or more user access policies to remove requests for access to data elements in one or more data elements that the user does not have access to.

3. The method according to claim 2, further comprising: Identify the pre-reconstructed procedural language code block (pre-PLCB) associated with the data element that the user has access to, from among the one or more data elements. The request is modified by replacing the PLCB with the pre-PLCB.

4. The method of claim 3, wherein the pre-PLCB is a reconstructed PLCB generated in response to a data request previously submitted to the distributed database.

5. The method of claim 1, wherein each database element includes an identifier of the database, schema, table, and column of the corresponding requested data element among the one or more data elements in the distributed database.

6. The method of claim 1, wherein the permissions stored in the first data structure are generated based on access permissions granted to data requests previously submitted to the distributed database by one or more users.

7. The method of claim 1, wherein the access control policy includes an access policy based on control flow patterns, and The modification of the request by the computer system by reconstructing the PLCB to remove the request for access to the restricted portion of the one or more data elements includes reconstructing the PLCB based at least on the access pattern stored in the control flow pattern-based access policy.

8. The method according to claim 1, further comprising: The second part of the log, which includes the history of the accessed data elements, identifies the one or more data elements that the user is allowed to access.

9. A system comprising: One or more processors; as well as One or more memory devices storing program code configured to be executed by the one or more processors, the program code including: A data processing application is configured to receive requests from users to access one or more data elements stored in a distributed database, the requests including procedural language code blocks (PLCBs). The Procedural Language (PL) code block analyzer is configured as follows: Obtain an access control policy that indicates at least one permission required to access the one or more data elements; and Determine one or more database elements specified by the PLCB, each of the one or more database elements indicating the location where the corresponding requested data element is stored in the distributed database; The control system is configured as follows: The one or more database elements are compared with a first data structure, which includes general access permissions for all users of the distributed database. Determining that one or more database elements match a first group of database elements in the first data structure, wherein the access control policy identifies permissions associated with the first group of database elements and stored in the first data structure; and Based on the access control policy, access to the restricted portions of the one or more data elements is denied; and The system was reconfigured and configured as follows: The request is modified by reconstructing the PLCB based on the PL code block description P-DSTC for the PLCB to remove the request for access to the restricted portion of the one or more data elements, wherein the P-DSTC indicates that a second portion of the one or more data elements is accessible to the PLCB while the restricted portion is inaccessible to the PLCB; and The modified request is provided to the distributed database to receive the second portion of the one or more data elements that the user is allowed to access, wherein the restricted portion of the one or more data elements is rewritten to include pre-initialized variables.

10. The system of claim 9, wherein the control system is further configured to: Determine that the access control policy denies access to at least one of the requested data elements; and The PL code block analyzer is configured as follows: The user's identifier is submitted to the policy engine, which stores multiple policies associated with the user in the distributed database; and The policy engine receives one or more user access policies, each of which is associated with a corresponding database element in the one or more database elements and indicates the user permissions to access the corresponding database element. The request is modified based on the one or more user access policies to remove requests for access to data elements in the one or more data elements that the user does not have access to.

11. The system of claim 10, wherein the control system is further configured to: Identify the previously stored procedural language code block (pre-PLCB) associated with the data element among the one or more data elements that the user has access to. The request is modified by replacing the PLCB with the pre-PLCB.

12. The system of claim 11, wherein the pre-PLCB is a reconstructed PLCB generated in response to a data request previously submitted to the distributed database.

13. The system of claim 9, wherein each database element includes an identifier of the database, schema, table, and column of the corresponding requested data element among the one or more data elements in the distributed database.

14. The system of claim 9, wherein the permissions stored in the first data structure are generated based on access permissions granted to data requests previously submitted to the distributed database by one or more users.

15. The system of claim 9, wherein the access control policy includes an access policy based on control flow patterns, and The system includes a pattern-based system configured to reconstruct the PLCB based at least on access patterns stored in the control flow pattern-based access policy.

16. The system according to claim 9, further comprising: The log includes a history of accessed data elements, the log identifying at least the second portion of one or more data elements from which the user is allowed to access.

17. A memory device having computer program code stored thereon, the code causing the at least one processor to perform a method when executed by at least one processor, the method comprising: A computer system receives a request from a user to access one or more data elements stored in a distributed database, the request including a procedural language code block (PLCB). The computer system obtains an access control policy, which indicates at least one permission required to access the one or more data elements; The computer system determines, based on the access control policy, that access to the restricted portion of the one or more data elements is denied; Identify a pre-reconstructed procedural language code block (pre-PLCB) associated with a second portion of one or more data elements that the user is allowed to access; The computer system modifies the request by replacing the PLCB with the pre-PLCB, wherein the pre-PLCB removes the request to access the restricted portion of the one or more data elements; as well as The computer system submits a modified request to the distributed database to receive a second portion of the one or more data elements that the user is allowed to access, wherein the restricted portion of the one or more data elements is rewritten to include pre-initialized variables.

18. The memory device of claim 17, wherein obtaining the access control policy comprises: Determine one or more database elements specified by the PLCB, each of the one or more database elements indicating the location where the corresponding requested data element is stored in the distributed database; The one or more database elements are compared with a first data structure, which includes general access permissions for all users of the distributed database. as well as Determine that the one or more database elements match the first group of database elements in the first data structure. The permissions associated with the first group of database elements and stored in the first data structure are obtained as the access control policy.

19. The memory device of claim 18, wherein the permissions stored in the first data structure are generated based on access permissions granted to data requests previously submitted to the distributed database by one or more users.

20. The memory device of claim 17, wherein the pre-PLCB is a reconstructed PLCB generated in response to a data request previously submitted to the distributed database.

Images