Embedded Policy Enforcement for Secure Database Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional approaches to data access control in multidimensional databases lack a secure and efficient method for distributing executable policies, leading to potential compromises in database security due to network latency and tampering risks.
Innovation Solution
The implementation of an embedded policy system where declarative policies are compiled into executable code, securely distributed, and enforced locally at endpoints without network exchanges, using a library and API integrated with client applications to evaluate access requests based on granular considerations of actors, assets, and actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional network message exchange is used for policy enforcement, then centralized control is maintained, but network latency increases and security is compromised
Solution Approach 1:
The patent extracts the policy enforcement logic from the centralized server and embeds it as executable entities in client applications at distributed endpoints. This extraction eliminates the need for continuous network message exchanges during access control operations, thereby reducing network latency while maintaining centralized policy definition capabilities.
Solution Approach 2:
The patent segments the access control system into two parts: centralized policy definition (declarative policies) and distributed policy execution (embedded executable entities). This segmentation allows policies to be defined centrally while executed locally at multiple endpoints simultaneously, improving both security and performance.
2Productivity
If executable policies are distributed to endpoints, then network latency is reduced, but tampering risks increase
Solution Approach 1:
The patent applies preliminary anti-action by digitally signing executable entities before distribution to endpoints. This pre-emptive measure creates a security mechanism that prevents tampering during transmission and execution, countacting the harmful effects of potential manipulation before they can occur.
Solution Approach 2:
The patent introduces digital signatures as an intermediary mechanism between policy definition and execution. The signature acts as a mediator that verifies the integrity and authenticity of executable entities, ensuring they have not been tampered with during distribution or storage.
3Measurement precision
If declarative policies are compiled into executable code, then access control granularity is improved, but system complexity increases
Solution Approach 1:
The patent replaces manual policy management mechanisms with automated compilation and distribution systems. The compilation process automatically transforms declarative policies into executable entities, and the distribution system automatically manages deployment to endpoints, reducing operational complexity despite increased functional capabilities.
Data Source
AI summary
An embedded policy takes the form of an executable entity local to the endpoint or end application attempting to access target data. The executable entity is compiled from a declarative remote policy based on objects, subjects and actions, and includes a library and API (Application Programming Interface) in conjunction with a client application seeking access according to the policy. Evaluation of appropriate access is resolved with a local function call to the executable entity, rather than a network message exchange, thus providing data target access according to the policy without incurring network latency.