Database Access Control via Dynamic SQL Modification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current database access control methods fail to effectively limit user operations on sensitive data, posing a significant information security risk, especially in industries like high technology and finance, as users can access and manipulate sensitive columns or rows without proper permission.
Innovation Solution
A data access control method and apparatus that modify SQL statements based on pre-stored permission settings, adding execution conditions to restrict user access, ensuring that sensitive columns or rows are protected by limiting operations to allowed ranges or values, thereby preventing unauthorized data access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a database administrator sets permission to forbid a user from accessing a specific table, then the user cannot access that table, but the user can still view all other data in the database which creates information security risk
Solution Approach 1:
The patent segments data access permissions into three levels: table-level (traditional), row-level (new), and column-level (new). This segmentation allows the database administrator to grant or revoke access to specific portions of data without affecting other areas, thus improving security while maintaining operational flexibility. For example, a user can be granted access to a table but restricted from viewing sensitive columns or specific rows.
Solution Approach 2:
The patent implements local quality by allowing different permission settings for different parts of the same data structure. Within a single table, certain rows or columns can have restricted access while other rows or columns remain accessible. This enables精细化 control where security restrictions are applied locally to specific data elements rather than uniformly across the entire table.
2Productivity
If the database administrator grants broad access permissions to users for operational efficiency, then data access flexibility improves, but information security risk increases due to potential unauthorized access to sensitive data
Solution Approach 1:
The patent applies preliminary action by pre-defining permission settings for rows and columns before users attempt to access data. The database system automatically evaluates these pre-set permissions against user requests and enforces restrictions proactively. This prevents information leakage before it can occur, while still allowing efficient access to authorized data without requiring constant security checks during operations.
Solution Approach 2:
The patent introduces an intermediary permission control mechanism between the user and the data. The row-level and column-level permission system acts as a mediator that intercepts data access requests, evaluates them against predefined security rules, and either grants or denies access accordingly. This intermediary layer enables broad operational efficiency while maintaining strict security controls.
Data Source
AI summary
A data access control method and a database access apparatus. The method includes: obtaining a first data operation instruction, where the instruction is triggered by a first user; querying permission setting information based on the identifier of the target data body, and determining permission of the first user to operate the target data body, where the permission setting information includes an identifier of at least one data body and permission of at least one user to operate the at least one data body; generating a second data operation instruction based on the permission of the first user to operate the target data body and the first data operation instruction; and executing the second data operation instruction to operate data in the target data body within a target range, where the target range is a range allowed by the permission of the first user to operate the target data body.