Database Security Descriptors for Field-Level Query Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Big data processing systems face bottlenecks in security evaluation due to high transaction volumes, leading to inefficient processing and reliance on resource-intensive security enforcement at query and security layers, which also limits user access to specific dataset fields.
Innovation Solution
A system that enforces security at the database layer by using security descriptors associated with indexed fields to filter results based on user privileges, reducing the need for extensive data transmission and enabling field-specific security configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security evaluation is performed at query and security layers, then security enforcement is achieved, but processing efficiency deteriorates and resource consumption increases
Solution Approach 1:
The patent applies preliminary action by pre-configuring security descriptors at the database layer before queries are executed. Security policies are defined and associated with specific data fields in advance, allowing the database engine to automatically enforce security during query execution without requiring post-query security evaluation at higher layers. This shifts security enforcement to occur earlier in the processing pipeline, improving efficiency while maintaining security.
Solution Approach 2:
The patent extracts security enforcement functionality from the query and security layers and relocates it to the database layer. By separating security descriptor configuration from query processing logic, the system enables the database engine to handle security independently, removing the bottleneck of layer-by-layer security evaluation and allowing parallel query processing with integrated security checks.
2Reliability
If security evaluation is performed at query and security layers, then security enforcement is achieved, but resource consumption increases
Solution Approach 1:
Security descriptors are pre-configured and cached at the database layer before query execution. This preliminary setup eliminates the need for repeated security policy interpretation during each query, reducing computational overhead and resource consumption while maintaining secure access control.
Solution Approach 2:
The database engine autonomously enforces security by automatically evaluating security descriptors against user privileges during query execution. This self-service mechanism eliminates the need for external security evaluation processes, reducing inter-layer communication overhead and resource consumption associated with coordinated security enforcement.
3Ease of operation
If field-specific security configurations are implemented, then user access control is improved, but system complexity increases
Solution Approach 1:
The patent implements local quality by allowing security descriptors to be configured independently for each data field in the database. Each field can have its own security policy, data types, and access control rules defined locally without affecting other fields. This granular approach enables precise user access control tailored to specific data sensitivity requirements while maintaining overall system manageability through localized configuration.
Data Source
AI summary
The present application discloses a method, system, and computer system for enforcing security with respect to a database. The system includes a database configured to receive a query, wherein the query is modified to comprise one or more security predicates; determine data to return in response to the query by examining the one or more security predicates with respect to security for a field; and return the determined data in response to the query.