Field-Level Database Access Control for Privileged Account Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection technologies suffer from coarse granularity and potential security risks, particularly in the case of privileged accounts, which are vulnerable to unauthorized access and data breaches.
Innovation Solution
A data access method and device that perform field-level data protection operations by parsing access requests to obtain controlled field lists, applying data protection rules based on access parameters and request types, and synthesizing new access requests to ensure secure database interactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If transparent encryption and permission are used to protect sensitive information, then data security is improved, but privileged accounts can still access all data without restrictions leading to coarse granularity of protection
Solution Approach 1:
The patent segments data protection from table-level to field-level granularity. It introduces a field encryption mechanism where each sensitive field can be independently encrypted and accessed. The system divides the data access control into multiple layers: database-level permissions, table-level permissions, and field-level permissions. This segmentation allows privileged accounts to be restricted at the field level rather than having unrestricted access to all data.
Solution Approach 2:
The patent applies different protection qualities to different fields within the same table. Sensitive fields such as personal identifiers, financial information, and health data can be marked with different encryption levels and access control policies. This allows the system to apply stringent protection to specific fields while allowing broader access to non-sensitive fields, achieving fine-grained protection without uniformly complicating the entire system.
2Ease of operation
If permission-based access control is used, then ease of operation is improved, but security risks increase due to privileged accounts being able to access any application data
Solution Approach 1:
The patent implements preliminary field-level encryption and access control policy definition before data access operations. The system pre-identifies sensitive fields, applies encryption to them, and defines access control policies that specify which user roles can access which fields. When privileged accounts attempt to access data, the pre-defined field-level permissions are enforced, automatically blocking unauthorized access to sensitive fields even if the account has broad database permissions.
Solution Approach 2:
The patent introduces a field-level access control intermediary layer between the user application and the database. This intermediary intercepts data access requests, checks field-level permissions for the requesting user, and either allows or blocks access to specific fields. For privileged accounts, this intermediary ensures that even though they have high-level permissions, they must still satisfy field-specific access controls, thereby mitigating security risks while maintaining ease of operation for authorized access.
3Reliability
If field-level data protection is implemented, then data security is improved, but system complexity increases due to additional access control mechanisms
Solution Approach 1:
The patent designs a universal field-level access control framework that can be applied across different database systems and applications. The field encryption and access control mechanisms are implemented as reusable components that work consistently regardless of the specific data type, table structure, or user role. This universality allows the system to manage field-level protection complexity through standardized procedures and policies rather than requiring custom solutions for each scenario.
Solution Approach 2:
The patent manages complexity by parameterizing access control policies rather than hardcoding them. Field-level permissions are defined through configurable parameters such as user roles, sensitivity levels, and access conditions. These parameters can be adjusted without modifying the underlying system structure. When new security requirements arise, administrators can simply change policy parameters rather than redesigning the access control mechanism, thereby managing complexity through flexible parameter configuration.
Data Source
AI summary
Provided are a data access method and device, a storage medium and an electronic device. The method includes: a first access request used for requesting access to data in a database is received; the first access request is parsed to obtain the following data corresponding to the first access request: a first access parameter, a first request type, and a first controlled field list; a first data protection operation is performed on the first controlled field list based on the first access parameter and the first request type to obtain a target result; and a second access request is synthesized based on the target result, and the data in the database is accessed based on the second access request, so as to obtain an access result.