Database Cursor Authorization Context Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database access control models face challenges in efficiently managing authorization states for fine-grained access control, particularly in sharing cursors across multiple users and roles, due to the complexity of authorization contexts and the computational expense of hard parses.
Innovation Solution
Storing and comparing the entire authorization context of a database statement with a child cursor to determine sharing eligibility, using bit vectors for authorization results and applying normalizations to reduce the number of possible authorization contexts, and eliminating unnecessary privilege predicates to optimize cursor sharing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If fine-grained access control is implemented with extended authorization states, then security control precision is improved, but system complexity increases
Solution Approach 1:
The patent segments the complex authorization state into multiple independent authorization contexts, where each context corresponds to a specific data set. This allows the system to manage fine-grained access control by breaking down the overall authorization decision into smaller, manageable units that can be independently evaluated and stored in cursors.
Solution Approach 2:
The patent introduces a new dimension for managing authorization states by storing multiple authorization contexts within cursor structures. This dimensional expansion allows the system to track and enforce different authorization decisions for different data sets simultaneously, resolving the complexity of managing fine-grained access control across multiple users and roles.
2Adaptability or versatility
If authorization context is stored in cursors for sharing, then cursor sharing capability is improved, but memory usage increases
Solution Approach 1:
The patent merges the authorization context directly into the cursor structure, combining what were previously separate entities into a unified object. This allows authorization information to be shared along with the cursor itself, enabling cursor sharing across different users and roles while avoiding the need for separate authorization storage structures.
Solution Approach 2:
The patent uses copying of authorization contexts when cursors are shared. Instead of creating entirely new authorization structures for each cursor instance, the system copies the relevant authorization context from the parent cursor to child cursors, reducing memory overhead while maintaining the ability to enforce fine-grained access control.
3Measurement precision
If hard parse is performed for each SQL statement, then authorization accuracy is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary authorization analysis during the hard parse phase and stores the results in authorization contexts within cursors. This preliminary action allows subsequent soft parse operations to reuse these pre-computed authorization decisions, avoiding the need to perform complete hard parses for every SQL statement while maintaining authorization accuracy.
Solution Approach 2:
The patent implements a dynamic approach where the system automatically selects between hard parse and soft parse based on the specific query and authorization context. This dynamic switching allows the system to maintain high authorization accuracy when needed while reducing processing time by using softer, faster parsing methods when authorization contexts can be reused from existing cursors.
Data Source
AI summary
Techniques for efficient cursor sharing to enforce fine-grained access control are provided. In one technique, the authorization context of a database statement is stored in (or in association with) a corresponding cursor. The authorization context indicates multiple authorization results, each of which indicates whether a user (or role) associated with the database statement is allowed to access a different data set of multiple data sets that the database statement targets. An authorization context of an incoming database statement may be compared to the authorization context of a cursor in a single comparison to determine whether the authorization contexts match. If so, then the cursor may be shared. In another technique, one or more normalizations are applied to a cursor predicate that is generated based on the authorization context of a database statement. The one or more normalizations may result in removing one or more predicates from the cursor predicate.