Database Row Level Security Optimization via Bitmap ACL Caching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems experience performance degradation due to the linear increase in query time caused by the evaluation of Access Control Lists (ACLs) and predicates for each database row, leading to inefficient row-level security implementations.
Innovation Solution
A system that evaluates ACLs once and stores the results in a bitmap, allowing for the efficient determination of access privileges by applying the ACL results to database objects without repeated evaluation, thereby optimizing row-level security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ACLs and predicates are evaluated for each database row to ensure row-level security, then security accuracy is improved, but query time increases linearly with the number of rows
Solution Approach 1:
The patent pre-evaluates ACLs and predicates before executing the main query to generate a security filter. This preliminary action creates a bitmap representation of access rights that can be efficiently applied during query execution, avoiding repeated ACL evaluations for each row while maintaining security accuracy
Solution Approach 2:
The patent creates a bitmap copy of ACL evaluation results that can be rapidly applied to multiple rows. Instead of evaluating complex ACL rules for each row, the system uses a compact bitmap representation that encodes access decisions, enabling fast comparison and filtering operations during query execution
2Reliability
If ACLs are evaluated repeatedly for each database object to determine access privileges, then security enforcement is improved, but system performance deteriorates
Solution Approach 1:
The patent merges multiple ACL evaluations into a single comprehensive security filter. By combining the results of ACL and predicate evaluations into a unified bitmap structure, the system enforces security for multiple objects in one operation rather than performing separate evaluations for each object
Solution Approach 2:
The patent transforms ACL evaluation results into a different parameter representation (bitmap format). This parameter change converts complex ACL rule sets into compact binary representations that can be efficiently processed and compared during query execution, significantly improving system performance while maintaining security enforcement
Data Source
AI summary
One embodiment of the present invention provides a system that implements a security policy in a database. During operation, the system receives a request associated with a set of objects in the database. Next, the system obtains a set of access control lists (ACLs) associated with the database, wherein a respective ACL specifies one or more access privileges associated with a user or user group, and wherein a respective ACLs is not specific to a particular object in the database. The system then evaluates the ACLs to obtain a set of ACL results associated with the request and processes the request by applying the set of ACL results to the objects without evaluating the ACLs repeatedly for each of the objects.