Attribute-Aware Access Control in Relational Databases
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing relational databases lack the capability for attribute-based, relationship-aware access control on both row and field levels, failing to grant access based on attributes related to the user but not present in the immediate record, especially in multi-tenant computing environments.
Innovation Solution
Implementing a method that considers attributes of related records when processing queries, allowing system administrators to define relationship formulas that span beyond the immediate record, using extra relational joins and filters to enforce access control rules at both row and field levels, thereby determining access based on established relationships between records and users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If attribute-based access control is implemented using only immediate record attributes, then access control can be enforced at the record level, but access control based on related record attributes cannot be achieved
Solution Approach 1:
The patent extends access control from a single-record dimension to a multi-record relationship dimension by incorporating foreign key relationships. The system now evaluates attributes across multiple related records (parent and child records) rather than isolating access control to the immediate record level, enabling relationship-aware access decisions.
Solution Approach 2:
The patent introduces relationship formulas as intermediaries that connect user attributes to record attributes through foreign key relationships. These formulas act as mediators that evaluate whether a user has access to a record based on attributes of related records, bridging the gap between user context and record context.
2Adaptability or versatility
If access control rules are extended to consider related record attributes, then relationship-aware access control is achieved, but query processing complexity increases
Solution Approach 1:
The patent pre-compiles relationship formulas and stores them in the database schema, so that during query processing, the system can directly apply these pre-defined rules rather than evaluating complex relationship logic in real-time. This preliminary preparation reduces the computational burden during actual access control enforcement.
Solution Approach 2:
The patent separates access control logic into distinct components: relationship formulas stored in the schema, access control rules defined by administrators, and the query processing engine that applies these rules. This segmentation allows each component to be optimized independently and simplifies the overall query processing architecture.
3Adaptability or versatility
If field-level access control is implemented with relationship awareness, then granular access control is achieved, but implementation complexity increases
Solution Approach 1:
The patent enables different access control rules to be applied to different fields within the same record based on relationship criteria. Each field can have its own access control configuration that specifies which relationship formulas and rules apply, allowing fine-grained control where each field's access rights are tailored to its specific security requirements.
Data Source
AI summary
Systems and methods are described for implementing attribute aware, relationship-based access control by receiving a query to access a relational database from a user, determining if a rule of the relational database is applicable to the query, determining one or more relationships associated with the query based at least in part on the rule, and modifying the query by adding an extra join operation to the query based at least in part on the rule and the one or more relationships. Further, when a type of the rule is row level, a where clause filter is added to the modified query to enforce a condition of the rule, and when the type of the rule is field level, a case column is added to the modified query and a select clause is added to the modified query to wrap the query. The modified query is processed to produce a result.