Database Query Security Semantics Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ensuring compliance with security policies in large database systems is computationally expensive and inefficient, particularly when dealing with complex data types and frequent policy changes.
Innovation Solution
Injecting database native security syntax into queries to enhance compliance and security, by generating an access plan that matches security syntax and executing queries while filtering or transforming data to adhere to privacy policies, thereby reducing computational resources and exposure of sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security policy compliance methods are used in large database systems, then data security and policy enforcement are maintained, but query processing efficiency deteriorates and computational costs increase
Solution Approach 1:
The patent applies preliminary action by pre-compiling security policies into native database security syntax (access control lists, views, roles) during system setup or policy definition. This allows the database engine to enforce security policies using optimized native operations rather than evaluating complex application-layer policies during query execution, thereby maintaining security compliance while significantly improving query processing efficiency
Solution Approach 2:
The patent introduces an intermediary layer that translates application-layer security policies into database-native security syntax. This intermediary translation layer acts as a mediator between the application's security requirements and the database engine's native security mechanisms, enabling efficient enforcement of security policies through the database's optimized security subsystem rather than through computationally expensive application-layer checks
2Reliability
If complex data types and frequent policy changes are handled using traditional methods, then comprehensive security coverage is achieved, but computational resources are excessively consumed
Solution Approach 1:
The patent applies parameter changes by transforming security policy parameters from application-layer representations into database-native security syntax parameters. This transformation enables the database engine to utilize its optimized execution plans and security enforcement mechanisms, reducing computational resource consumption while maintaining comprehensive security coverage for complex data types and frequent policy changes
3Adaptability or versatility
If application-layer security enforcement is used, then flexible policy implementation is achieved, but query execution time increases
Solution Approach 1:
The patent applies preliminary action by pre-translating flexible application-layer security policies into database-native security syntax during policy definition or compilation time. This allows the database engine to enforce these policies using optimized native operations during query execution, thereby maintaining policy flexibility while significantly reducing query execution time compared to runtime policy evaluation
Data Source
AI summary
A computer-implemented method to inject security semantics into database queries. The method includes receiving, by a database system, a query, wherein the query is received from a host and the query is generated by a first user account. The method also includes, generating an access plan for the query. The method further includes, determining a first portion of the access plan matches a first security syntax. The method includes, injecting, in response to determining the first portion of the access plan matches the first security syntax, the first security syntax into the access plan. The method further includes, executing the query. The method includes, returning a set of results of the query to the host.