Centralized Access Control for Cloud Database Policy Drift
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional relational database management systems face challenges in scalability and efficiency when managing access control for cloud-based resources, particularly in managing clusters of database servers, where current solutions require cumbersome and error-prone processes for setting permissions, lack granular permission control, and suffer from policy drift issues.
Innovation Solution
Implementing a centralized access control system that uses external policy storage to manage access policies across multiple database servers, allowing for granular permissions from subscription to column level, and enabling administrators to create, update, and apply policies without logging into each server, using a hierarchical data structure for policy evaluation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional server-specific tools and individual permission management are used for each database server, then access control can be implemented at the server level, but the complexity of managing permissions across multiple servers increases significantly and policy drift occurs
Solution Approach 1:
The patent introduces a centralized access control system that acts as an intermediary between users and multiple database servers. This central system manages all access policies uniformly across the cluster, eliminating the need to manually configure permissions on each individual server and preventing policy drift through centralized enforcement.
Solution Approach 2:
The centralized access control system provides universal permission management that works across all database servers in the cluster through a single interface. Instead of requiring separate management tools for each server, one universal system handles access control for the entire distributed database environment.
2Adaptability or versatility
If permissions are managed individually on each database server, then server-specific access control is possible, but scalability to manage clusters of database servers becomes cumbersome and error-prone
Solution Approach 1:
The centralized access control system serves as an intermediary that abstracts away the complexity of managing multiple servers. Administrators interact with a single centralized interface rather than individually configuring each server, making the system scalable to large clusters while maintaining ease of operation.
Solution Approach 2:
The system segments the management of access control from the individual database servers. While the database servers continue to process data, the management of permissions is separated into a distinct centralized system that can scale independently and manage any number of servers without increasing operational complexity.
3Manufacturing precision
If traditional local permission storage is used in each database, then access control decisions can be made locally at the database server, but granular permission control from subscription level down to column level becomes difficult to implement consistently
Solution Approach 1:
The centralized access control system acts as an intermediary that enforces granular permission policies uniformly across all databases. It translates high-level subscription-level permissions down to specific column-level access controls, ensuring consistent precision throughout the system without requiring complex local configuration at each database server.
Data Source
AI summary
Methods for centralized access control for cloud relational database management system resources are performed by systems and devices. The methods utilize a central policy storage, managed externally to database servers, which stores external policies for access to internal database resources at up to fine granularity. Database servers in the processing system each receive external access policies that correspond to users of the system by push or pull operations from the central policy storage, and store the external access policies in a cache of the database servers for databases. For resource access, access conditions are determined via policy engines of database servers based on an external access policy in the cache that corresponds to a user, responsive to a resource access request from a device of the user specifying the internal resource. Data associated with the resource is provided to the user based on the access condition being met.