Dynamic Row-Level Security via Expression Data Type
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional row-level security systems using static labels are limited in dynamically responding to changing situations and handling complex security considerations, as they require predefined relationships between users and data, leading to imperfect knowledge of security policies and difficulty in handling a wide spectrum of access policies.
Innovation Solution
The implementation of an expression data type in database systems, such as Oracle's EXPRESSION data type, allows for dynamic row-level access control through a conditional expression that evaluates user and environment attributes, enabling unique access policies for each row and supporting complex security by using SQL operators and user-defined functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static labels are used for row-level security, then security control is simplified and easier to implement, but the system cannot dynamically respond to changing situations and complex security considerations
Solution Approach 1:
The patent applies the Dynamics principle by transitioning from static labels to dynamic expressions for row-level security. Expressions can be evaluated at access time to determine security decisions, allowing the system to adapt to changing situations and complex security considerations while maintaining ease of implementation through the expression framework.
2Ease of manufacture
If predefined relationships between users and data are required, then security policy definition is simplified, but the system cannot handle a wide spectrum of access policies
Solution Approach 1:
The patent applies the Parameter changes principle by allowing expressions to reference multiple user attributes, data attributes, and environment attributes. This enables the system to handle a wide spectrum of access policies by changing the parameters being evaluated from fixed labels to flexible expression-based assessments of multiple attributes.
3Device complexity
If static labels are used to control row access, then security control is straightforward, but complex security considerations and changing situations cannot be addressed
Solution Approach 1:
The patent applies the Intermediary principle by introducing expressions as an intermediary layer between the database system and security policies. Expressions serve as a flexible mediator that can incorporate complex logic, multiple attributes, and dynamic evaluations while maintaining a relatively simple implementation framework through the expression evaluation mechanism.
Data Source
AI summary
Systems, methods, and other embodiments associated with row level security for a database table are described. One example method includes detecting an access statement seeking access to a row in a database table for which row level security is active. The method includes adding a predicate to the access statement. The predicate is based on an access control expression associated with the row. The access control expression depends on an instance of an expression data type associated with the row. The method includes populating an attribute of the predicate, and controlling access to the row based on a computed value for the predicate.