Dynamic Query Constraints via External Security Policies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security policies for accessing computer resources are inflexible and inefficient, particularly when changes are needed, and they do not allow for conditional permissions or effective constraint of database queries, leading to performance and security issues.
Innovation Solution
Implementing dynamic and conditional constraints on queries based on an external security policy by reading condition clauses from grant statements, such as JAAS or SQL WHERE clauses, to modify queries and ensure only authorized data is accessed, thereby reducing network overhead and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hard-coded security policies are used in applications, then access control can be effectively enforced, but the system becomes inflexible and requires recoding and recompiling when policy changes are needed
Solution Approach 1:
The patent implements dynamic security policies by separating policy definitions from application code. The system uses a policy engine that can load and execute different security policies at runtime, allowing policies to be changed without modifying or recompiling application source code. This resolves the contradiction by making the access control mechanism adaptable while maintaining enforcement effectiveness.
Solution Approach 2:
The patent introduces a policy engine as an intermediary component between the application and the security policy. This mediator reads policy definitions from external sources (such as configuration files or databases) and translates them into executable access control logic, enabling flexible policy changes without affecting the application code itself.
2Adaptability or versatility
If external configuration files are used for security policies (e.g., JAAS), then policy changes can be made without modifying application code, but conditional definitions in the security policy are not allowed
Solution Approach 1:
The patent extends the policy definition capability by introducing conditional parameters and attributes that can be dynamically evaluated. Instead of static grant statements, the system allows policies to include conditions based on user attributes, resource characteristics, and environmental factors. This enables complex conditional permissions while maintaining external configurability.
Solution Approach 2:
The patent creates a universal policy language that can express both simple permission grants and complex conditional logic within a single framework. The policy engine can interpret multiple types of conditions and attributes, making the system capable of handling diverse security scenarios without requiring separate mechanisms for each type of policy definition.
3Quantity of substance
If all data sets are retrieved from backend repository and then checked for permission, then complete data retrieval is achieved, but network overhead increases and performance degrades due to numerous checkPermission method calls
Solution Approach 1:
The patent applies preliminary action by evaluating security policies and determining authorized data sets before the actual data retrieval operation. The system pre-calculates which records the user is entitled to access based on their attributes and the policy conditions, then retrieves only those predetermined records. This eliminates the need to fetch all data and then perform permission checks, significantly reducing network overhead and improving performance.
Solution Approach 2:
The patent replaces the mechanical approach of retrieving all data and then filtering through permission checks with a more efficient system that uses attribute-based policy evaluation. Instead of mechanically checking each record's permission status after retrieval, the system substitutes this with a proactive policy evaluation mechanism that determines access rights before data transfer, reducing the computational and network burden.
4Duration of action of moving object
If all data sets are retrieved and cached, then data availability is improved, but security concerns arise as cached data sets need protection from malicious attacks
Solution Approach 1:
The patent applies preliminary action by determining and filtering authorized data sets before they are retrieved and cached. The system pre-evaluates policy conditions and identifies which records the user is entitled to access in advance, then retrieves only those records for caching. This eliminates the security risk of caching unauthorized data while maintaining data availability for legitimate users.
Solution Approach 2:
The patent extracts the security evaluation function from the data retrieval process and integrates it into the policy determination phase. By extracting and applying policy constraints before data is fetched, the system separates the security function from the caching mechanism, allowing caching to proceed safely for authorized data without exposing the system to security vulnerabilities.
Data Source
AI summary
Systems, methods, and machine-readable media are disclosed for providing dynamic and/or conditional constraints on queries based on an external security policy. In one embodiment, a method is provided which comprises receiving from a user a request to access a resource. A condition clause can be read from a grant statement defined in the security policy. The grant statement can define permission for the user to access the requested resource. In some cases, the grant statement can comprise a Java Authentication and Authorization Service (JAAS) grant statement. A query associated with the requested access can be modified based on the permission granted to the user. The modified query can then be made to perform the requested access.