Database Access Control via Processing Mode Rules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional database systems rely solely on access rights for accounts, making it difficult to restrict access independently of the access mode, which limits the ability to prevent abnormal access such as bulk data retrieval.
Innovation Solution
Implementing a database management system with an object storing section, a processing executing section, a rule storing section, and a rule applying section that determines and applies access rules based on processing modes, allowing for conditional changes to processing content and results, regardless of account rights.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control is implemented solely based on account rights, then the system is simple to operate, but it cannot restrict abnormal access such as bulk data retrieval
Solution Approach 1:
The patent segments access control into two independent layers: account-based access rights (traditional) and processing-mode-based access rules (new). The processing executing section is divided into a rule applying section that intercepts and evaluates processing requests against predefined rules before execution. This segmentation allows the system to maintain simple account management while adding sophisticated control mechanisms that specifically target abnormal access patterns like bulk data retrieval without requiring complete system redesign
Solution Approach 2:
The patent implements preliminary action by establishing access rules and application conditions in advance before any data access occurs. The rule storing section holds predefined rules that specify processing modes (e.g., bulk retrieval, frequency thresholds) and corresponding application conditions. When a processing request arrives, the rule applying section immediately evaluates it against these pre-established rules, enabling proactive prevention of abnormal access rather than reactive response. This allows the system to block potentially harmful operations before they execute, enhancing security without adding complex real-time analysis
2Reliability
If access rules are applied based on processing modes, then abnormal access can be prevented, but the system complexity increases
Solution Approach 1:
The patent introduces an intermediary component called the rule applying section that acts as a mediator between the processing executing section and the database. This intermediary intercepts processing requests, evaluates them against application conditions stored in the rule storing section, and determines whether to allow, modify, or block execution. By placing this intermediary layer, the system achieves sophisticated security control without requiring fundamental changes to the core database engine or account management system, thus limiting the increase in overall system complexity
Solution Approach 2:
The rule applying section is designed with multi-functionality to handle various types of access control scenarios through a single unified mechanism. It can evaluate different processing modes (bulk retrieval, frequent access, unauthorized operations), apply different application conditions (time-based, frequency-based, volume-based), and enforce different rules simultaneously. This universal approach consolidates multiple security functions into one component, avoiding the need for separate specialized systems for each type of access control, thereby limiting complexity growth
3Ease of operation
If conventional access rights are used, then the system is easy to operate, but it cannot independently restrict access based on processing mode
Solution Approach 1:
The patent segments the access control system into two independent but complementary parts: account-based access rights (maintaining ease of operation) and processing-mode-based access rules (providing adaptability). Account administrators continue to manage simple user credentials and basic permissions without dealing with complex rule configurations. Meanwhile, the rule storing section independently holds processing-mode-specific rules that automatically apply to relevant operations. This segmentation allows each subsystem to maintain its operational simplicity while the combination provides enhanced versatility
Solution Approach 2:
The patent introduces dynamics by making access control adaptable to different processing modes rather than static account-based permissions alone. The rule applying section dynamically evaluates each processing request against stored application conditions, adapting the level of control based on the specific operation being performed. For example, bulk retrieval operations trigger different rules compared to individual record access, and frequent access patterns can be dynamically detected and restricted. This dynamic behavior provides versatility without requiring complex manual reconfiguration of account rights
Data Source
AI summary
Database management includes processing a database object in accordance with a processing request, determining a mode of processing from the processing request, and, responsive to determining that the mode of processing satisfies an application condition, changing content of the processing in accordance with a rule associated with the application condition using a processor.