Fine-grained SQL Authorizations via Privilege Sets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SQL database management systems face security vulnerabilities and increased management overhead due to coarse-grained access control mechanisms, which can lead to unauthorized access and data leaks, especially in scenarios with multiple stored procedures requiring different privilege levels.
Innovation Solution
Implementing fine-grained SQL authorizations by specifying privilege sets through a privilege clause, allowing for precise control over access to specific schemas and tables for each operation within a stored procedure, reducing the need for multiple technical users and roles, and streamlining permission management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If coarse-grained access control roles are used to simplify privilege management, then management overhead is reduced, but security vulnerabilities increase due to excessive privileges being granted
Solution Approach 1:
The patent segments privileges from roles and introduces privilege sets that can be dynamically assigned to stored procedures. Instead of granting all privileges through a role, the system divides privileges into granular sets that are specifically allocated to each procedure's needs, thereby maintaining security while simplifying management.
Solution Approach 2:
The patent applies local quality by allowing different privilege sets to be assigned to different stored procedures based on their specific requirements. Each procedure receives only the privileges necessary for its function, rather than applying a uniform role-based privilege structure across all procedures.
2Adaptability or versatility
If definer privileges are used to ensure sufficient access for stored procedures, then operational capability is improved, but attack surface increases due to excessive privileges
Solution Approach 1:
The patent implements partial action by granting only the specific privileges needed for each stored procedure to function, rather than providing excessive definer privileges. This ensures operational capability while minimizing the attack surface by limiting privilege exposure to only what is necessary.
3Measurement precision
If multiple technical users with different roles are created to satisfy diverse privilege requirements, then access control precision is improved, but system complexity increases
Solution Approach 1:
The patent introduces a universal privilege set mechanism that can be applied across multiple stored procedures without requiring separate technical users. A single privilege set can serve multiple procedures, and procedures can inherit or combine privilege sets, reducing system complexity while maintaining precise access control.
Solution Approach 2:
The patent changes the parameter of privilege assignment from user-based to procedure-based. Instead of creating multiple users with different roles, the system allows privilege sets to be dynamically assigned to procedures, changing how access control is parameterized and reducing the number of entities to manage.
4Ease of operation
If clustered privileges in one role are used for multiple stored procedures, then ease of management is improved, but security confinement deteriorates
Solution Approach 1:
The patent segments the clustered privileges into separate privilege sets that can be selectively assigned to different stored procedures. This maintains the ease of managing privilege sets while improving security confinement by ensuring each procedure receives only the specific privileges it needs, not all clustered privileges.
Data Source
AI summary
Disclosed herein are system, method, and computer program product (computer-readable device) embodiments for implementing fine-grained SQL authorizations. An embodiment operates by determining, via a database query execution engine, that a database program unit may include a plurality of operations. Moreover, at least one first operation of the operations may correspond to a first privilege requirement, at least one second operation of the operations may correspond to a second privilege requirement, and the first privilege requirement may differ in scope from the second privilege requirement. Via the database query execution engine, the plurality of operations may be executed in accordance with each corresponding privilege requirement of each operation.