ACL Change Message Replication for Distributed Database Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multimaster database systems employing asynchronous replication face complexity and concurrency conflicts when propagating changes across geographically distributed databases, especially in investigative analysis contexts where network connectivity is unreliable and access control lists need to be synchronized accurately.
Innovation Solution
The implementation of a software-implemented process involving an exporting nexus that sends ACL change messages to an importing nexus, using information to determine which secured components and change records to apply ACL changes to, ensuring consistent access control across databases without requiring corresponding identifiers, and maintaining historical records for revisioning databases.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If asynchronous replication is used to improve availability, then database availability is improved, but system complexity increases
Solution Approach 1:
The patent introduces ACL change messages as an intermediary mechanism to propagate access control list changes across distributed databases. These messages carry metadata including the exporting database identifier, change timestamp, and ACL modifications, enabling automatic synchronization without manual intervention or complex conflict resolution protocols.
Solution Approach 2:
The system creates and replicates ACL change messages across multiple databases in the distributed network. Each database receives copies of these messages and applies the ACL changes locally, ensuring consistency across the network without requiring centralized control or complex coordination.
2Stability of the object's composition
If ACL changes are propagated immediately to all databases, then data consistency is improved, but system availability deteriorates
Solution Approach 1:
The system performs preliminary actions by queuing ACL change messages locally at the exporting database before propagation. This allows the local database to accept and process changes immediately, maintaining availability, while the changes are subsequently propagated to other databases when network conditions permit.
Solution Approach 2:
The patent implements dynamic propagation behavior where the timing and method of ACL change propagation adapts based on network conditions and database availability. The system can operate in synchronous mode when all databases are available or switch to asynchronous mode with deferred propagation when databases are unavailable, optimizing both consistency and availability.
3Measurement precision
If version vectors are used to track causality relationships, then concurrency conflict detection is improved, but device complexity increases
Solution Approach 1:
The patent extracts the essential causality tracking information into a simplified metadata structure attached to each ACL change message. This metadata includes the exporting database identifier and change timestamp, which are the minimum necessary elements to detect and resolve concurrency conflicts without the overhead of full version vectors.
Solution Approach 2:
The system changes the parameters used for tracking changes from complex version vectors to simpler metadata fields including database identifier, timestamp, and change type. This parameter simplification reduces computational overhead and storage requirements while maintaining sufficient precision for conflict detection in the investigative analysis context.
4Manufacturing precision
If deconflicting mechanisms are implemented, then data accuracy is improved, but operation complexity increases
Solution Approach 1:
The patent implements self-service deconflicting where each database automatically processes incoming ACL change messages using the metadata contained within them. The messages include sufficient information (exporting database ID, timestamp, change details) for receiving databases to independently determine whether to apply changes or detect conflicts, eliminating the need for centralized conflict resolution or manual intervention.
Data Source
AI summary
Techniques for replicating changes to access control lists on investigative analysis data are disclosed. After a change is made in a database to an access control list (ACL) governing access to a secured component of a data object, an exporting nexus sends an ACL change network message to an importing nexus. The ACL change message includes information that importing nexus can use to apply the ACL change to the importing database. Applying the ACL change message includes using the information in the ACL change message to determine which change records for which secured components of the data object in the importing database the ACL change should be applied to. By doing so, user access to all change records in the importing database to which the ACL change is applied is governed by the new ACL, thereby preventing unauthorized access to the change records, including historical change records.