First-Class Database Applications Within the Security Boundary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for building web applications over data platforms require data to leave the database security boundary, necessitating additional operations and resources for managing middle tier application servers, and existing alternatives either complicate middle tier management or lack support for UI applications.
Innovation Solution
A framework that enables users to build applications by tying the security boundary of the application UI to the data security boundary, using User Defined Function (UDF) server objects within the database, which run in the same security context as stored procedures, allowing secure communication through a proxy server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data leaves the database security boundary to enable web applications, then application functionality is improved, but security is worsened and additional middle tier management resources are required
Solution Approach 1:
The patent merges the application execution environment with the database security boundary by implementing web applications as stored procedures within the database management system. This eliminates the need for data to leave the security boundary while maintaining full application functionality, as the applications execute natively within the database engine using its existing security context and authentication mechanisms.
Solution Approach 2:
The database management system is extended to perform multiple functions: it simultaneously serves as a data storage system, an application execution platform, and a security enforcement boundary. The stored procedure mechanism provides universal functionality for both traditional database operations and web application execution without requiring separate middle tier infrastructure.
2Adaptability or versatility
If traditional middle tier application servers are used, then application functionality is improved, but device complexity and operational costs increase
Solution Approach 1:
The patent combines the middle tier application server functionality directly into the database management system by implementing applications as stored procedures. This eliminates the separate middle tier layer, reducing device complexity while maintaining application functionality through the database's native execution environment and security context.
Solution Approach 2:
The database management system is extended to perform multiple functions: it simultaneously serves as a data storage system, an application execution platform, and a security enforcement boundary. The stored procedure mechanism provides universal functionality for both traditional database operations and web application execution without requiring separate middle tier infrastructure.
3Device complexity
If simple middle tier is used, then device complexity is reduced, but ease of operation worsens due to difficult management
Solution Approach 1:
The patent combines the middle tier application server functionality directly into the database management system by implementing applications as stored procedures. This eliminates the separate middle tier layer, reducing device complexity while maintaining application functionality through the database's native execution environment and security context.
4Reliability
If data remains within database security boundary, then security is improved, but application functionality worsens due to lack of UI support
Solution Approach 1:
The patent merges the application execution environment with the database security boundary by implementing web applications as stored procedures within the database management system. This eliminates the need for data to leave the security boundary while maintaining full application functionality, as the applications execute natively within the database engine using its existing security context and authentication mechanisms.
Solution Approach 2:
The stored procedure acts as an intermediary that enables UI applications to execute within the database security boundary. The procedure receives web requests, processes them using the database's security context, and returns responses without requiring data to cross the security boundary, thus maintaining both security and application functionality.
Data Source
AI summary
A data platform for managing an application as a first-class database object. The data platform includes at least one processor and a memory storing instructions that cause the at least one processor to perform operations including detecting a data request from a browser for a data object located on the data platform, executing a stored procedure, the stored procedure containing instructions that cause the at least one processor to perform additional operations including instantiating a User Defined Function (UDF) server, an application engine, and the application within a security context of the data platform based on a security policy determined by an owner of the data object. The data platform then communicates with the browser using the application engine as a proxy server.