Database Client Interface Policy Enforcement for Data Leak Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software security models for database access are unreliable and scattered, leading to inconsistent enforcement of data access policies and vulnerability to unauthorized data access due to coding errors and lack of contextual awareness.
Innovation Solution
Implementing a three-layer security model with a data protection component between the application and database components to enforce data access policies, managed by data security specialists, which intercepts and alters database queries to ensure consistent policy enforcement across software stacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security logic is implemented in the application component or database component, then data protection is provided, but the security model becomes unreliable and scattered due to lack of contextual information and coding errors
Solution Approach 1:
A data protection component is introduced as an intermediary layer between the application component and database component. This mediator intercepts database queries, evaluates them against security policies using collected contextual information, and enforces access controls centrally. This resolves the contradiction by providing reliable security enforcement through centralized policy evaluation while maintaining manageable complexity through a dedicated security layer rather than scattered security logic throughout the application and database components
2Reliability
If a three-layer security model with data protection component is implemented, then consistent policy enforcement and broader contextual awareness are achieved, but the system complexity increases
Solution Approach 1:
The security architecture is segmented into three distinct layers: the application component, the data protection component, and the database component. Each layer has a specific responsibility - the application component handles business logic, the data protection component handles security policy enforcement and contextual information collection, and the database component handles data storage and retrieval. This segmentation enables consistent policy enforcement through centralized security logic while managing complexity by clearly defining the boundaries and responsibilities of each layer
3Ease of manufacture
If security logic is scattered in application and database components, then implementation is simpler, but coding errors may expose data to unauthorized users and testing may not catch all errors
Solution Approach 1:
The data protection component serves as an intermediary that centralizes security logic, making it easier to implement and maintain reliable security. Instead of scattering security logic throughout the application and database components where it can be easily overlooked or implemented incorrectly, the intermediary component dedicated to security ensures that all database queries are consistently evaluated against security policies. This centralized approach improves reliability while maintaining ease of implementation through a focused security module
Data Source
AI summary
A method and system of masking, redacting, filtering, and encrypting data retrieved from or stored into a database using policies in an information management system. The system comprises application, data protection, and database components. A data protection component is placed between an application component and a database component to provide protection to data in a database by applying data access policies to requests sent from the application component to the database component.