Database Access Control Synchronization for Mobile Data Revocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Inadequate access control strategies in database systems lead to unauthorized access and obsolete data on mobile devices due to changes in user access levels, allowing unauthorized access to data even after revocation.
Innovation Solution
A system that synchronizes data access control specifications between a source and target databases, ensuring that data objects stored on mobile devices are updated based on the latest access control changes by identifying and removing inaccessible data objects during reconnection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Duration of action of moving object
If data objects are stored locally on mobile devices for offline operation, then offline access capability is improved, but data security deteriorates because obsolete data remains accessible after access revocation
Solution Approach 1:
The system performs preliminary actions by establishing access control specifications and replicating data objects to mobile devices before access revocation occurs. When access is revoked, the system has already prepared the mechanism to identify and remove the revoked data objects during the next synchronization cycle, preventing unauthorized access while maintaining offline functionality.
Solution Approach 2:
The system implements feedback through periodic data synchronization between the server and mobile devices. When access control changes occur, the server detects this and sends notifications to mobile devices. During synchronization, the system compares access control specifications and identifies data objects that need to be removed, ensuring that revoked data is promptly removed from local storage while maintaining offline access to valid data.
2Reliability
If access control specifications are frequently updated to maintain data security, then data security is improved, but system complexity increases due to continuous synchronization requirements
Solution Approach 1:
The system extracts and separates access control specifications from data objects themselves. Instead of embedding access controls within each data object, the system maintains access control specifications as separate entities on the server. During synchronization, only access control specification changes are transmitted to mobile devices, reducing the complexity of data transmission and synchronization while maintaining security.
Solution Approach 2:
The system changes parameters by using version identifiers and timestamps for access control specifications. Instead of transmitting entire access control policies during every synchronization, the system transmits only parameter changes (version updates, timestamp modifications) and identifies affected data objects through these parameter changes, simplifying the synchronization mechanism.
3Duration of action of moving object
If all data objects are replicated to mobile devices for offline access, then offline access capability is improved, but data storage requirements increase on mobile devices
Solution Approach 1:
The system applies local quality by selectively replicating only those data objects that are relevant to each specific user and device based on access control specifications. Instead of uniformly replicating all data objects to all devices, the system tailors the replicated data set to each user's access rights, reducing storage requirements while maintaining offline access capability for authorized data.
Solution Approach 2:
The system uses partial action by replicating only a subset of data objects that are currently accessible to the user, rather than replicating the entire database. This partial replication approach reduces storage requirements on mobile devices while still providing sufficient offline access capability for the user's authorized data set.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system replicates data stored in a source database to target databases of systems such as mobile devices. The source database stores data objects, for example, documents, media objects, and so on. The source system ensures that the data objects stored in a target database correspond to a set of data objects that can be accessed by the user associated with the target database as determined by an access control specification of the user. Accordingly, if the access control specification of the user changes, the source system performs data synchronization to modify the set of data objects stored on the target database. If the access control specification is modified to revoke the user's access to a set of data objects, the source system performs data synchronization to send information identifying the set of data objects with a request to remove the data objects from the target database.