Database Security Label Propagation via Foreign Key Relationships
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database security systems face challenges in efficiently managing row-level security across multiple interrelated tables, particularly in propagating and updating security labels in response to changes in foreign key relationships, which can lead to complex calculations and increased maintenance costs.
Innovation Solution
A method is introduced to automatically determine and propagate security labels for records in a database by identifying related records through foreign key relationships, concatenating or prioritizing label components, and updating labels in response to trigger events, ensuring quick access control without real-time computations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security labels are propagated in real-time across interrelated tables through foreign key relationships, then access control reliability is improved, but computational overhead and system complexity increase
Solution Approach 1:
The patent applies preliminary action by pre-computing and caching security labels for records in the database before access requests occur. When records are inserted or updated, the system proactively determines and stores security labels based on foreign key relationships and security policies, so that access control decisions can be made quickly without real-time computation. This eliminates the need for complex real-time calculations while maintaining reliable access control.
2Measurement precision
If security labels are automatically propagated across multiple tables with foreign key relationships, then access control accuracy is improved, but device complexity increases
Solution Approach 1:
The patent segments the security label propagation process into distinct components: security policies are defined separately for different tables, foreign key relationships are identified and processed individually, and security labels are determined and cached for each record. This modular approach allows the system to maintain high access control accuracy by processing each table and relationship independently, while reducing overall system complexity through clear separation of concerns.
Solution Approach 2:
The patent introduces security labels as intermediary elements that mediate between foreign key relationships and access control decisions. Instead of directly computing access rights across complex table relationships, the system uses pre-determined security labels attached to individual records as intermediaries. These labels encapsulate the results of security policy evaluations and foreign key relationship analysis, simplifying the access control mechanism while maintaining accuracy.
3Speed
If security labels are pre-computed and stored for each record, then access control speed is improved, but maintenance effort increases
Solution Approach 1:
The patent implements self-service by designing the system to automatically maintain security labels through triggers and event-driven mechanisms. When records are inserted, updated, or deleted, the system automatically detects these events, re-evaluates security policies, and updates the corresponding security labels without manual intervention. This automation reduces maintenance effort while ensuring access control speed is maintained through up-to-date cached labels.
Solution Approach 2:
The patent incorporates feedback mechanisms where changes to records or foreign key relationships automatically trigger security label re-evaluation. The system monitors database events and provides feedback loops that update security labels when underlying data or relationships change. This feedback-driven approach maintains accurate security labels with minimal manual maintenance, as the system self-corrects and updates labels based on actual database state changes.
Data Source
AI summary
A method includes automatically determining a component of a security label for each first record in a first table of a database having multiple tables, including: identifying a second record related to the first record according to a foreign key relationship; identifying a component of the security label for the second record; and assigning a value for the component of the security label for the first record based on the identified component of the security label for the second record. The method includes storing the determined security label in the record.