A method and apparatus for access control with separate permissions
By classifying and tagging the basic elements in the database management system, the problem of limited permission settings is solved, flexible access control policies are implemented, and system security and management efficiency are improved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- 上海沄熹科技有限公司
- Filing Date
- 2024-07-18
- Publication Date
- 2026-05-26
AI Technical Summary
Existing database management systems have simplistic permission settings, significant security vulnerabilities, and inflexible access control policies, making it impossible to implement finer-grained permission separation access control and failing to meet high-level access control requirements.
By creating basic elements (database subjects, objects, and labels) in the database management system, these elements are labeled and categorized, and access control policies are created based on the labels to match SQL commands to allow or deny operations.
It enables flexible separation of permissions and responsibilities, improves system security and management efficiency, and meets higher-level access control requirements.
Smart Images
Figure CN119128922B_ABST
Abstract
Description
Technical Field
[0001] This invention discloses a method and apparatus, relating to the field of database technology, specifically a permission-separated access control method and apparatus. Background Technology
[0002] Access control is the management of user permissions to access data resources by a database management system. It primarily verifies whether a user has the necessary permissions to access data resources, including both read and write access. If the access control system determines that a user has the appropriate access permissions, it allows the user to access the data resource; otherwise, it denies the user's access. Access control can effectively improve the security of data resources within the system.
[0003] However, in some database management systems, permission settings are relatively simple, which poses significant security risks and cannot be adjusted. The access control policies are not flexible enough and cannot achieve more granular permission separation access control, thus failing to meet higher-level access control needs that are more in line with customer requirements. Summary of the Invention
[0004] This invention addresses the problems of existing technologies by providing a method and apparatus for permission-separated access control, solving the problems of inflexible, error-prone, and difficult-to-expand database permission-separated management and responsibility-separated access control management.
[0005] The specific solution proposed in this invention is as follows:
[0006] This invention provides a permission-separated access control method, comprising:
[0007] Step 1: Create basic elements in the database management system. These basic elements include the database body, database objects, and database tags.
[0008] Step 2: Use database tags to label and categorize the database subject, database object, and database operation permissions respectively.
[0009] Step 3: Create and store access control policies based on the database subjects, database objects, and database operation permissions categorized using tags. Each access control policy defines the database subjects with corresponding tags, and the allowed operations on the database objects with corresponding tags.
[0010] Step 4: When the database management system receives an SQL command from the database principal, it obtains the database principal, database object, and database operation permissions based on the SQL command, and matches them with the access control policies within the database management system. If the match is successful, the execution of the SQL command is allowed; otherwise, the execution of the SQL command is prohibited.
[0011] Furthermore, in step 1 of the aforementioned permission-separated access control method, the database subject refers to the users and their sets managed by the database management system, as well as the various processes representing the users; the database object refers to the database object operated on by the database subject.
[0012] In step 2, database tags are used to label users with the same or similar attributes, database operation permissions, and operation behaviors as having the same tag.
[0013] Database tags are used to label data objects with the same or similar data sensitivity with the same label.
[0014] Database tags are used to mark database operation permissions that have the same or similar data processing methods on objects as the same tag.
[0015] Furthermore, in step 2 of the permission separation access control method, database subjects are categorized using database tags. When the database subject is a database administrator, the number of database tags for the database administrator is limited, and multiple permissions for the database administrator are separated according to the database operation permission configuration.
[0016] Furthermore, in step 2 of the permission-separated access control method, the basic elements can be marked using multiple database tags, and each database tag can mark multiple basic elements.
[0017] In step 3, database access control policies can be used to batch set the basic elements represented by database tags.
[0018] Furthermore, in step 4 of the aforementioned permission-separated access control method, the specific steps include:
[0019] Step 41: Receive SQL commands from the database principal through the database management system.
[0020] Step 42: Semantically analyze SQL commands through syntax analysis to obtain the database subject, database object, and database operation permissions.
[0021] Step 43: Match the database subject, database object, and database operation permissions of the SQL command with the access control policies in the database management system. If a match is found with an access control policy created using a database tag, the match is successful and the SQL command is allowed to continue execution; otherwise, the SQL command is prohibited from being executed.
[0022] The present invention also provides a permission-separated access control device, including an element management module, a tagging module, an access control policy management module, and an access control module.
[0023] The element management module creates basic elements in the database management system. These basic elements include the database subject, database object, and database tag.
[0024] The tagging module uses database tags to categorize and label database subjects, database objects, and database operation permissions.
[0025] The access control policy management module creates and stores access control policies based on database subjects, database objects, and database operation permissions categorized using tags. Each access control policy defines a database subject with a corresponding tag, and allows operations on database objects with the corresponding tags.
[0026] When the database management system receives an SQL command from the database subject, the access control module obtains the database subject, database object, and database operation permissions based on the SQL command, and matches them with the access control policies within the database management system. If the match is successful, the execution of the SQL command is allowed; otherwise, the execution of the SQL command is prohibited.
[0027] Furthermore, in the aforementioned permission-separated access control device, the database subject managed by the element management module refers to the users and their sets managed by the database management system, as well as the various processes representing the users; the database object refers to the database object operated on by the database subject.
[0028] The tagging module uses database tags to label users with the same or similar attributes, database operation permissions, and operation behaviors as the same tag.
[0029] Database tags are used to label data objects with the same or similar data sensitivity with the same label.
[0030] Database tags are used to mark database operation permissions that have the same or similar data processing methods on objects as the same tag.
[0031] Furthermore, the tagging module of the permission separation access control device classifies database subjects using database tags. When the database subject is a database administrator, the number of database tags for the database administrator is limited, and the database administrator's multiple permissions are separated according to the database operation permission configuration.
[0032] Furthermore, the tagging module of the permission-separated access control device can tag basic elements using multiple database tags, allowing each database tag to tag multiple basic elements.
[0033] The access control policy management module can set the basic elements represented by database tags in batches through database access control policies.
[0034] Furthermore, the access control module of the aforementioned permission-separated access control device receives SQL commands from the database principal through the database management system.
[0035] By parsing SQL commands through syntax analysis and semantic analysis, database subjects, database objects, and database operation permissions can be obtained.
[0036] The database subject, database object, and database operation permissions of the SQL command are matched with the access control policies within the database management system. If a match is found with an access control policy created using a database tag, the SQL command is allowed to continue execution; otherwise, the SQL command is prohibited from being executed.
[0037] The advantages of this invention are:
[0038] The method of this invention classifies the various elements involved in database access control by labeling them, then manages access control policies based on the labels, and performs access control based on the access control policies. This allows for the setting of administrator types as needed, as well as the flexible allocation of permissions to each type of administrator, thereby achieving separation of permissions and responsibilities, and improving security, flexibility, and management efficiency. Attached Figure Description
[0039] Figure 1 This is a schematic diagram of the application framework of the method of the present invention.
[0040] Figure 2 This is a schematic diagram of the method flow of the present invention.
[0041] Figure 3 This is a schematic diagram of the access control process executed by the present invention. Detailed Implementation
[0042] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments described are not intended to limit the present invention.
[0043] Example 1
[0044] This invention provides a permission-separated access control method, comprising:
[0045] Step 1: Create basic elements in the database management system, including database subjects, database objects, and database tags.
[0046] The database subject refers to the users and their collections managed by the database management system, as well as the various processes representing the users. The database object refers to the database objects operated on by the database subject, which may include, but are not limited to, databases, files, schemas, tables, views, sequences, stored procedures, functions, etc.
[0047] Database operations mainly refer to operations on database objects, including DCL operations related to management, DDL operations related to metadata management, DML operations for data record operations, and system management commands.
[0048] Database tags refer to the categories used to classify and categorize various entities in a database.
[0049] Step 2: Use database tags to label and classify the database subject, database object, and database operation permissions respectively.
[0050] Database tags are used to mark users with the same or similar attributes, database operation permissions, and operation behaviors as having the same tag. Users with the same tag can be considered as the same group of users, and the tag is marked as a tag. j If j > 0, the user can be represented as user. i If i > 0, then user i Tag j , represented as user i(j) .
[0051] Database labels are used to mark data objects with the same or similar data sensitivity as having the same label. Database objects with the same label can be regarded as the same group of objects, which can be represented as obj. k k > 0. Object obj k Tag j , represented as obj k(j) .
[0052] Database operation permissions with the same or similar data processing methods on objects are marked with the same label. Database operation permissions with the same label can be regarded as the same group of operations, which can be represented as op. m If m > 0, then object op m Tag j , represented as op m(j) .
[0053] Step 3: Create and store access control policies based on the categorized database subjects, database objects, and database operation permissions using tags.
[0054] Each access control policy defines a database subject with a corresponding label, and allows operations on database objects with the corresponding labels. An access control policy is represented as `policy(user)`. i(i′) obj k(k′) ,op m(m′) ,>.
[0055] Step 4: When the database management system receives an SQL command from the database principal, it retrieves the database principal, database object, and operation based on the SQL command and matches them with the access control policy within the database management system. If the match is successful, the execution of the SQL command is allowed; otherwise, the execution of the SQL command is prohibited.
[0056] The specific steps include:
[0057] Step 41: Receive SQL commands from the database principal through the database management system.
[0058] Step 42: Parse the SQL command through syntax analysis and semantic parsing to obtain the "user v object - operation" combination, which can be represented as union(user i″ obj k″ ,op m″ >,
[0059] Step 43: Combine the database body, database object, and database operation permissions of the SQL command using unio. <user i″ obj k″ ,op m″ The system matches the database management system's access control policies. If a match is found with an access control policy created using database tags (i.e., the user in the access control policy obtained through SQL command parsing), the match is successful. i″ User tags that are the same as this strategy i′ The marked object obj k″ The same object tag as this strategy k The marked database operation permissions (op) m″ The same operation permission tag as this policy m′ Marked,
[0060] If the match is successful, the SQL command can continue to be executed; otherwise, the SQL command cannot continue to be executed.
[0061] Example 2
[0062] Based on Embodiment 1, in step 2 of the method of the present invention, the basic elements can be marked using multiple database tags, and each database tag can mark multiple basic elements.
[0063] In step 3, database access control policies can be used to batch set the basic elements represented by database tags.
[0064] Furthermore, in step 2, database subjects can be categorized using database tags. When the database subject is a database administrator, the number of database tags for the database administrator is limited, and multiple permissions for the database administrator are separated according to the database operation permission configuration. That is, the permissions possessed by various database administrators can also be managed through access control policies created using administrator user tags, object tags, and operation permission tags.
[0065] By following the steps and methods above, flexible management of database access control policies can be achieved, thereby enabling flexible database access control, flexible configuration of permission separation and responsibility separation, improving access control policy management efficiency, and reducing costs.
[0066] Example 3
[0067] The present invention also provides a permission-separated access control device, including an element management module, a tagging module, an access control policy management module, and an access control module.
[0068] The element management module creates basic elements in the database management system. These basic elements include the database subject, database object, and database tag.
[0069] The tagging module uses database tags to categorize and label database subjects, database objects, and database operation permissions.
[0070] The access control policy management module creates and stores access control policies based on database subjects, database objects, and database operation permissions categorized using tags. Each access control policy defines a database subject with a corresponding tag, and allows operations on database objects with the corresponding tags.
[0071] When the database management system receives an SQL command from the database subject, the access control module obtains the database subject, database object, and database operation permissions based on the SQL command, and matches them with the access control policies within the database management system. If the match is successful, the execution of the SQL command is allowed; otherwise, the execution of the SQL command is prohibited.
[0072] The information interaction and execution of readable programs between the modules in the above-mentioned device are based on the same concept as the method embodiments of the present invention, and the specific details can be found in the descriptions in the method embodiments of the present invention, and will not be repeated here.
[0073] Similarly, the device of the present invention classifies the various participating elements of database access control by labeling them, then manages access control policies based on the labels, and performs access control based on the access control policies. This allows for setting the types of administrators as needed, and also enables the autonomous and flexible allocation of permissions to each type of administrator, thereby achieving separation of permissions and responsibilities, and improving security, flexibility and management efficiency.
[0074] It should be noted that not all steps and modules in the above processes and device structures are mandatory; some steps or modules can be omitted as needed. The execution order of each step is not fixed and can be adjusted as required. The system structure described in the above embodiments can be a physical structure or a logical structure. That is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or they may be jointly implemented by certain components in multiple independent devices.
[0075] The above-described embodiments are merely preferred embodiments provided to fully illustrate the present invention, and the scope of protection of the present invention is not limited thereto. Equivalent substitutions or modifications made by those skilled in the art based on the present invention are all within the scope of protection of the present invention. The scope of protection of the present invention is defined by the claims.
Claims
1. A permission-separated access control method, characterized in that: include: Step 1: Create basic elements in the database management system. These basic elements include the database body, database objects, and database tags. Step 2: Classify and label database subjects, database objects, and database operation permissions using database tags. When classifying database subjects using database tags, if the database subject is a database administrator, limit the number of database tags the administrator can use, and implement multi-level permission separation for the database administrator based on the configured database operation permissions. Step 3: Create and store access control policies based on the database subjects, database objects, and database operation permissions categorized using tags. Each access control policy defines the database subjects with corresponding tags, and the allowed operations on the database objects with corresponding tags. Step 4: When the database management system receives an SQL command from the database principal, it obtains the database principal, database object, and database operation permissions based on the SQL command, and matches them with the access control policies within the database management system. If the match is successful, the execution of the SQL command is allowed; otherwise, the execution of the SQL command is prohibited.
2. The access control method with separate permissions according to claim 1, characterized in that: In step 1, the database subject refers to the users and their collections managed by the database management system, as well as the various processes representing the users. The database object refers to the database object operated on by the database subject. In step 2, database tags are used to label users with the same or similar attributes, database operation permissions, and operation behaviors as having the same tag. Database tags are used to label data objects with the same or similar data sensitivity with the same label. Database tags are used to mark database operation permissions that have the same or similar data processing methods on objects as the same tag.
3. The access control method with separate permissions according to claim 1, characterized in that: In step 2, the basic elements are marked using multiple database tags, with each database tag marking multiple basic elements. In step 3, the basic elements represented by the database tags are set in batches using database access control policies.
4. The access control method with separate permissions according to claim 1, characterized in that: Step 4 includes the following specific steps: Step 41: Receive SQL commands from the database principal through the database management system. Step 42: Semantically analyze SQL commands through syntax analysis to obtain the database subject, database object, and database operation permissions. Step 43: Match the database subject, database object, and database operation permissions of the SQL command with the access control policies within the database management system. If a match is found with an access control policy created using a database tag, the match is successful, and the SQL command is allowed to continue execution; otherwise, the SQL command is prohibited from being executed.
5. A permission-separated access control device, characterized in that: It includes an element management module, a tagging module, an access control policy management module, and an access control module. The element management module creates basic elements in the database management system. These basic elements include the database subject, database object, and database tag. The tagging module uses database tags to categorize database subjects, database objects, and database operation permissions. When tagging database subjects, if the database subject is a database administrator, the module limits the number of database tags the administrator can use and implements a multi-level permission system for the database administrator based on the configured database operation permissions. The access control policy management module creates and stores access control policies based on database subjects, database objects, and database operation permissions categorized using tags. Each access control policy defines a database subject with a corresponding tag, and allows operations on database objects with the corresponding tags. When the database management system receives an SQL command from the database subject, the access control module obtains the database subject, database object, and database operation permissions based on the SQL command, and matches them with the access control policies within the database management system. If the match is successful, the execution of the SQL command is allowed; otherwise, the execution of the SQL command is prohibited.
6. The access control device with separate permissions according to claim 5, characterized in that: The database subject managed by the element management module refers to the users and their collections managed by the database management system, as well as the various processes representing the users. The database object refers to the database object operated on by the database subject. The tagging module uses database tags to label users with the same or similar attributes, database operation permissions, and operation behaviors as the same tag. Database tags are used to label data objects with the same or similar data sensitivity with the same label. Database tags are used to mark database operation permissions that have the same or similar data processing methods on objects as the same tag.
7. The access control device with separate permissions according to claim 5, characterized in that: The tagging module uses multiple database tags to mark basic elements, allowing each database tag to mark multiple basic elements. The access control policy management module sets the basic elements represented by database tags in batches through database access control policies.
8. The access control device with separate permissions according to claim 5, characterized in that: The access control module receives SQL commands from the database principal through the database management system. By parsing SQL commands through syntax analysis and semantic analysis, database subjects, database objects, and database operation permissions can be obtained. The database subject, database object, and database operation permissions of the SQL command are matched with the access control policies within the database management system. If a match is found with an access control policy created using a database tag, the SQL command is allowed to continue execution; otherwise, the SQL command is prohibited from being executed.