Database Driver Role-Based Access Control for Encrypted Fields
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current information handling systems lack effective methods for managing access to data stored in databases, particularly in ensuring secure and role-based access control, which can lead to unauthorized access and data breaches.
Innovation Solution
A method and system where a database server stores a database with encrypted fields, using an application encryption algorithm, and an access rights system provides user-specific data access roles and permissions, with a database driver validating user tokens to determine authorized access, allowing only authorized users to decrypt and access specific data subsets, and recording audit logs for access information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted in the database, then data security is improved, but data access and processing become more complex
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing encryption keys and access policies in the database metadata before data access requests occur. The database driver pre-establishes encryption contexts and prepares decryption capabilities in advance, so that when data access is requested, the encrypted data can be efficiently decrypted without ad-hoc computation overhead.
Solution Approach 2:
The patent introduces a database driver as an intermediary layer between the application and the encrypted database. This driver automatically handles encryption/decryption operations, key management, and access policy enforcement without requiring application developers to directly implement cryptographic operations. The driver translates high-level data access requests into encrypted/decrypted operations transparently.
2Reliability
If role-based access control is implemented, then unauthorized access is prevented, but system processing overhead increases
Solution Approach 1:
The patent applies preliminary action by pre-computing and caching access decisions based on user roles and data permissions before actual data access occurs. The system pre-evaluates which users have access to which encrypted data fields and stores these access policies in the database metadata. When a user requests data, the pre-computed access policies are quickly retrieved and applied, avoiding repeated authorization checks and reducing processing overhead during data access operations.
3Reliability
If all data fields are encrypted, then data protection is enhanced, but query performance and data retrieval speed decrease
Solution Approach 1:
The patent applies local quality by selectively encrypting only specific data fields that require protection rather than encrypting the entire database. The system identifies and encrypts only the sensitive columns (e.g., personally identifiable information, financial data) while leaving non-sensitive fields in plaintext. This selective approach maintains data protection for critical information while preserving fast query performance for non-sensitive data access operations.
Data Source
AI summary
Managing access to data, including storing a database that includes fields; encrypting data of all or some fields of the database using an application encryption algorithm; receiving data indicating user-specific data access roles and user-specific data permissions for each of the user-specific data access roles, each of the user-specific data permissions defining a subset of the data of the database that the corresponding user-specific data access role has authorization for decrypting the subset of the data; receiving a user token representing credentials and user-specific data access roles of an authorized user, wherein the user token is generated by the access rights system; receiving a query for requested data stored by the database; comparing the user-specific data access role of the user token with the user-specific data access roles of the access rights system to identify user-specific data permissions for the user-specific data access role of the user token.