Embedded Next Generation Access Control System for Fine-Grained Database Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional access control systems face challenges in scalability, managing access policies, and providing fine-grained control, as they often rely on decentralized servers and do not allow granular access to individual rows or columns within data sets.
Innovation Solution
An embedded next-generation access control system that centralizes access control within a resource database, using a mediator and adjudicator to enforce fine-grained access policies, allowing users to access specific rows or columns based on dynamic access control lists and attribute-based access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional decentralized access control systems are used, then system simplicity is maintained, but fine-grained access control capability deteriorates
Solution Approach 1:
The patent embeds the access control system within the database management system, nesting the mediator and adjudicator components inside the database architecture. This allows fine-grained access control to be implemented without requiring a separate decentralized system, thus improving control capability while avoiding the complexity of external systems.
Solution Approach 2:
The patent introduces a mediator component that sits between users and the database, and an adjudicator that evaluates access requests against policies. These intermediary components enable fine-grained access control by intercepting and evaluating queries, while being integrated into the database system to avoid external complexity.
2Adaptability or versatility
If centralized access control is implemented, then fine-grained control capability is improved, but scalability deteriorates
Solution Approach 1:
The patent segments the access control system into modular components: a mediator that handles query interception, an adjudicator that evaluates policies, and a policy database that stores access rules. This segmentation allows each component to be independently optimized and scaled, improving overall system scalability while maintaining fine-grained control capability.
Solution Approach 2:
The patent pre-compiles access policies into structured formats and pre-establishes the mediator-adjudicator architecture before deployment. This preliminary setup enables the system to handle access control decisions efficiently at runtime without requiring complex real-time computations, thus improving scalability.
3Reliability
If access control policies are strictly enforced, then data security is improved, but ease of operation deteriorates
Solution Approach 1:
The patent implements automatic policy evaluation and enforcement by the mediator and adjudicator components, which automatically intercept and evaluate user queries against access policies without requiring manual intervention. This self-service approach maintains strict security enforcement while improving ease of operation by eliminating the need for users to manually manage access control.
Solution Approach 2:
The patent implements a feedback mechanism where the adjudicator evaluates access requests and provides decisions back to the mediator, which then responds to users. This automated feedback loop ensures security policies are consistently enforced while users experience seamless access control without manual intervention.
4Measurement precision
If fine-grained access control is implemented, then access control precision is improved, but computational overhead deteriorates
Solution Approach 1:
The patent pre-structures access policies into optimized formats and pre-compiles access control rules during system setup. This preliminary preparation enables the adjudicator to quickly evaluate fine-grained access requests without performing complex computations at runtime, thus reducing computational overhead while maintaining high access control granularity.
Solution Approach 2:
The patent segments access control decisions into discrete evaluations by the adjudicator, processing only the specific rows and columns requested by users rather than evaluating entire datasets. This segmentation reduces computational overhead by limiting the scope of policy evaluations to only what is necessary for each specific access request.
Data Source
AI summary
An embedded next generation access control system imposes fine-grained access control on data in a resource database and includes a resource database, NGAC database, administrator, and mediator. The resource database includes controlled resource data and a mediator. The NGAC database includes an adjudicator and access control policy data. The administrator communicates access control policy input to the NGAC database upon which access control policy data is made in the NGAC database. The controlled resource data is access controlled by access control policy data via calls of an adjudicator API, which implements Next Generation Access Control standard by NIST, by the resource database to obtain access decisions. The adjudicator determines which controlled resource data are accessed by a user and provides an access control list for each user and user attribute. The adjudicator also provides a prohibited access control list for a user and user attributes in the access control policy data if there are any.