Database Access Control via External Security Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Database systems face a trade-off between security and performance, where high security often compromises operational efficiency, and existing solutions fail to provide both high security and performance simultaneously, especially when applied to existing commercial databases.
Innovation Solution
A method and system that integrates an external security system with the database to validate user and data access based on encrypted validation fields, allowing for row-level security while maintaining native database performance through partial validation within the database and verification by the external security system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full encryption and external security system are used to achieve high security, then security level is improved, but operation performance is greatly reduced (performance rate lowered by 100 times or more)
Solution Approach 1:
The security validation process is segmented into two parts: partial validation performed within the database system and verification performed by the external security system. This segmentation allows the database to handle routine access requests efficiently while the external system provides security oversight, resolving the contradiction between high security and high performance.
Solution Approach 2:
Instead of performing complete validation for every access request (which would severely impact performance), the system performs partial validation within the database and only requires verification from the external security system when necessary. This partial action approach maintains high operation performance while still ensuring high security levels.
2Productivity
If native database operation procedures are used to achieve high operation performance, then productivity is improved, but security level is lowered and can be easily manipulated
Solution Approach 1:
An external security system acts as an intermediary between users and the database. This intermediary validates access requests and enforces security policies without preventing the use of native database operation procedures. The external security system mediates between the need for high performance (native procedures) and high security (validation), allowing both requirements to be met simultaneously.
3Reliability
If external security system is used to provide uniform security level across different database systems, then reliability is improved, but operation performance is greatly reduced
Solution Approach 1:
The validation process is segmented so that routine checks are performed within the database system using native procedures, while the external security system performs verification only when needed. This segmentation maintains uniform security levels across different database systems while avoiding the performance penalty of having the external system handle every access request.
4Reliability
If row-level security is implemented to provide high security enforcement, then security level is improved, but device complexity increases
Solution Approach 1:
The database system performs partial validation of access requests using its own native procedures and capabilities. This self-service approach allows the database to handle routine security checks without requiring complex external validation for every request, thereby implementing row-level security with reduced system complexity.
Data Source
AI summary
A method for controlling access to a database is disclosed, as well as a corresponding database system. The method comprises: receiving, from a user, a request for a data post in said database; determining that said user should be allowed access to said requested data post based on a security context associated with said data post and said user; providing said user with access to said data post; and validating, by an external security system, at least one of the user and the data post, said validation being based on a validation field, controlled by the external security system and being associated with said user and/or data post. Hereby, the database can be operated with its native operational procedures, thereby enabling a very fast and efficient performance. At the same time, the validation by the external security system provides a high degree of security.