Database Proxy Authentication Using Federated Identity Providers

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional security models for databases accessed via web browsers and identity providers are vulnerable to unauthorized data access and lack effective mechanisms for tokenization and federated identity management, making them susceptible to attacks and complex to administer.

Innovation Solution

Implement a system with a data agnostic sidecar that intercepts communications between clients and databases, using a dispatcher for transport layer functions and services for security and management, including authentication, tokenization, and federated identity management, without requiring changes to existing database code.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional security models with secure perimeters are used to protect database systems, then data security is improved, but administration complexity and cost increase

Engineering Contradiction:

Improvedata securityVSAvoidadministration complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a sidecar component as an intermediary between the database and clients. This sidecar handles security functions including authentication, authorization, and encryption/decryption operations. By placing this intermediary layer, the system achieves enhanced security without requiring complex changes to the existing database administration, as the sidecar manages security policies centrally.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The security functionality is segmented into a separate sidecar component rather than being integrated into the database core. This segmentation allows the database to remain unchanged while security functions are independently managed by the sidecar, reducing administration complexity while maintaining security.

Inventive Principle:

Principle #1Segmentation

2Ease of operation

If web browser access with third-party identity providers is implemented, then accessibility is improved, but security policy enforcement becomes more challenging

Engineering Contradiction:

ImproveaccessibilityVSAvoidsecurity policy enforcement

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The sidecar acts as an intermediary that receives authentication tokens from third-party identity providers and enforces security policies before allowing database access. This mediator approach maintains the ease of web browser access while centralizing security policy enforcement in the sidecar, making it more manageable.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces traditional mechanical authentication mechanisms (username/password directly to database) with token-based authentication through identity providers. The sidecar validates these tokens and enforces policies, substituting the old authentication mechanics with a more flexible token-based system that simplifies policy enforcement.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Reliability

If tokenization and federated identity management are added to conventional databases, then security functionality is improved, but system complexity increases

Engineering Contradiction:

Improvesecurity functionalityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

Tokenization and federated identity management functions are segmented into the sidecar component rather than being integrated into the database core. This allows these advanced security features to be added without increasing database system complexity, as the sidecar independently handles token validation and identity federation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The sidecar is designed as a universal component that handles multiple security functions including authentication, authorization, tokenization, and federated identity management. By consolidating these functions in a single multi-functional component, the system avoids the complexity of implementing each function separately in the database.

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Reliability

If a proxy is inserted into the data flow between client and database, then security control is improved, but data flow complexity increases

Engineering Contradiction:

Improvesecurity controlVSAvoiddata flow complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The sidecar functions as a proxy intermediary in the data flow between clients and the database. It intercepts queries, performs security checks including authentication and authorization, and forwards validated queries to the database. This intermediary approach improves security control while keeping the data flow relatively simple by handling complexity within the proxy itself.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12531859B2Security for database systems using identity providers for authentication

Publication Date: 2026.01.20 CYRAL INC

AI summary

A system including a processor and a memory is described. The memory is coupled to the processor and configured to provide the processor with instructions. The processor is configured to receive from an identity provider a validation indication for a user as a proxy. The validation indication is for a database, the identity provider, and the user. The processor is also configured to configure a data flow between the database and a client corresponding to the user through the proxy using the validation indication.