Credential-less External Stage Objects for Secure Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network-based database systems face challenges in securely accessing and managing external data stored in different table formats, leading to security vulnerabilities and data exfiltration risks.
Innovation Solution
The implementation of credential-less external stage objects that allow data loading and unloading from external cloud storage without exchanging security credentials, using integration objects and cloud identity objects to manage access permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If security credentials are shared for accessing external data, then data access functionality is enabled, but security vulnerabilities and data exfiltration risks increase
Solution Approach 1:
The patent introduces an intermediary credential management system that acts as a mediator between the database system and external cloud storage. Instead of sharing secret credentials directly, the system uses integration objects with embedded credentials that are managed and validated by an intermediary component, thereby enabling data access while mitigating security risks through controlled credential exposure.
Solution Approach 2:
The patent extracts security credentials from the traditional shared secret model and embeds them within integration objects that are stored and managed separately in the metadata database. This extraction separates the credential management from direct data access operations, allowing credentials to be secured in a centralized location while still enabling authenticated access when needed.
2Device complexity
If credentials are stored and managed centrally, then access control is simplified, but security risks from credential exposure increase
Solution Approach 1:
The patent implements integration objects that function as disposable, single-use credentials. Each integration object contains embedded credentials that are valid for a specific purpose and can be revoked or replaced independently. This approach allows centralized management for simplicity while limiting the impact of credential exposure since compromised integration objects can be individually invalidated without affecting the entire credential system.
Solution Approach 2:
The patent segments the credential management system into multiple independent components: integration objects, external stage objects, and metadata database entries. Each segment handles a specific aspect of access control, allowing fine-grained management where credentials are divided into discrete, independently controllable units rather than a monolithic credential store.
3Productivity
If integration objects with embedded credentials are used, then data loading and unloading functionality is enhanced, but system complexity increases
Solution Approach 1:
The patent merges multiple functions into the integration object: authentication credentials, data location information, and access permissions are all combined in a single integrated structure. This consolidation simplifies the overall system architecture by replacing multiple separate credential and configuration files with unified integration objects, thereby enhancing productivity without proportionally increasing complexity.
Solution Approach 2:
The integration objects serve multiple functions: they act as authentication credentials, store data location metadata, define access permissions, and enable both data loading and unloading operations. This multi-functionality reduces the need for separate specialized components, improving productivity while keeping the system architecture relatively simple through versatile, polymorphic objects.
Data Source
AI summary
The subject technology provides techniques for enabling hidden database objects, which in an example are utilized for testing and verifying new database objects against existing workloads. Hidden database objects are a mechanism for bridging that gap by running user workloads on user data in advance of exposing the feature to users. This mechanism allows placing a database object as a hidden object nested beneath a user's visible object (e.g., table, column, view, and the like). Hidden database objects can be used to verify the functionality, parity, performance, and correctness of new unreleased features.