Column-Level Access Control for Database Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mechanisms for controlling access to database tables are inadequate, as they do not provide sufficient protection for data at a column level, leading to either overly broad access or restrictive analytic privileges.
Innovation Solution
Implementing column-level access control methods that allow users to designate protected columns and specify access mechanisms, with dual control over access based on user privileges and access mechanisms, including encryption and protection configurations, to restrict access to specific columns in a database table.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If SQL object privileges are used to control access to database tables, then access control is simplified, but the protection scope is insufficient as users can access all data in a table through permitted SQL operations
Solution Approach 1:
The patent segments the database table into multiple columns and applies different access control policies to each column. Instead of treating the entire table as a single unit with uniform access rights, the system divides the data structure into column-level units that can be independently protected. This allows fine-grained control where specific columns can be designated as protected while others remain accessible, resolving the contradiction between operational simplicity and protection scope.
Solution Approach 2:
The patent applies local quality by enabling different access control characteristics for different parts (columns) of the database table. Each column can have its own protection status and access requirements, allowing the system to provide strong protection for sensitive columns while maintaining easy access for non-sensitive columns. This localized approach to security resolves the contradiction by applying appropriate protection levels to specific data regions rather than uniformly across the entire table.
2Reliability
If analytic privileges are imposed to restrict read access to specific subsets of data, then data protection is improved, but access flexibility is reduced for certain users and applications
Solution Approach 1:
The patent implements dynamic access control where the system can adapt access permissions based on the specific column being accessed and the user's role. Rather than imposing static analytic privileges that restrict all users from accessing certain data subsets, the system dynamically evaluates each access request against column-level protection settings. This allows the system to maintain high protection levels for sensitive columns while automatically granting appropriate access flexibility to users who need it, resolving the contradiction between protection and adaptability.
3Reliability
If column-level protection is implemented with dual control mechanisms, then security against internal and external threats is enhanced, but system complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-designating certain columns as protected during database schema definition or through administrative configuration. The system establishes column-level protection markers and access control metadata in advance, before actual data access operations occur. This preliminary setup allows the dual control mechanism to operate more efficiently during runtime, as the system can quickly check pre-established protection flags rather than performing complex evaluations for every access request, thereby reducing operational complexity while maintaining high security.
Data Source
AI summary
Methods, systems, and apparatus, including computer program products, are provided for configuring access controls to a database. In one aspect there is provided a method. The method may include receiving, from a first user, a table declaration for creating a database table in a database; generating, based on the table declaration, the database table; receiving, from the first user, a specification of one or more access mechanisms that have a privilege to access the database table; receiving a designation of at least one column in the database table as a protected column and one or more users who have a privilege to access the content of the protected column; and providing control over access to the content of the protected column based at least in part on the specification of the one or more access mechanisms and the designation of the at least one column and the second user.