On-demand Database Access Control for Third-Party Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional database systems lack robust security measures for allowing access to data by third-party applications, leading to potential undesired access and data security risks.
Innovation Solution
Implement mechanisms for conditionally allowing an application of one entity to access data of another entity in an on-demand database service, including authorization checks and data access limitations, to provide controlled and secure data sharing among subscribers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If third-party applications are allowed broad access to data in database systems, then data sharing capability is improved, but security risk increases due to potential undesired access
Solution Approach 1:
The patent segments data access permissions into fine-grained categories including object-level access control (specific tables, views, or data sets), column-level access control (specific fields within tables), and row-level access control (specific records within tables). This segmentation allows third-party applications to access only the specific data elements they need while preventing access to other data, thereby improving data sharing capability while reducing security risks through precise access limitations.
2Ease of operation
If conventional authorization measures are used for third-party application access, then ease of operation is improved, but reliability deteriorates due to limited security measures
Solution Approach 1:
The patent introduces an intermediary authorization mechanism that acts as a mediator between third-party applications and the database system. This intermediary layer implements fine-grained access control policies, audit logging, and conditional access rules without requiring complex configuration by application developers. The intermediary translates high-level authorization intentions into precise database access controls, thereby maintaining ease of operation while significantly improving security assurance through multiple layers of protection including access validation, monitoring, and enforcement.
Data Source
AI summary
In accordance with embodiments, there are provided mechanisms and methods for conditionally allowing an application of an entity access to data of another entity in an on-demand database service. These mechanisms and methods for conditionally allowing an application of an entity access to data of another entity in an on-demand database service can enable embodiments to limit such access to the data, as desired. Furthermore, embodiments of such mechanisms and methods may provide additional security when sharing data among different subscribers to an on-demand database service.