Generic Database Security Using Virtual Private Database Policy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database security methods, such as application-based security policies and virtual private databases, face challenges in providing fine-grained access control and scalability, particularly when dealing with large numbers of users, as they require extensive modifications and maintenance, and can be bypassed by users with sufficient database access.
Innovation Solution
Implementing a generic database security application using virtual private database (VPD) functionality with a common security policy function, which generates predicates to restrict access based on user IDs and database objects, stored in user security and object context tables, to enforce security policies dynamically and transparently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If application-based security policies are used to restrict data access, then fine-grained access control at the user level is achieved, but users with database query or reporting tool access can bypass the security mechanisms
Solution Approach 1:
The patent introduces a database view as an intermediary layer between users and the underlying database tables. This view acts as a mediator that enforces security policies at the database level, preventing users with query or reporting tool access from bypassing security mechanisms. The view translates user queries into controlled access patterns that automatically apply security rules without requiring application-level enforcement.
2Reliability
If views are used to partition database tables into virtual tables for security, then data access can be restricted to subsets of rows and columns, but the approach becomes impractical when a large number of views are necessary for many users
Solution Approach 1:
The patent creates a universal view template that can serve multiple users with different access requirements. Instead of creating individual views for each user, the system defines a single view structure with parameterized security policies that automatically adapt to different user contexts. This multi-functional approach allows one view to replace thousands of individual views while maintaining fine-grained access control.
Solution Approach 2:
The patent implements dynamic view generation where view definitions are not static but are automatically created and configured based on user attributes and security policies. The system dynamically determines which rows and columns to expose to each user based on their identity, role, and other contextual factors, eliminating the need for pre-defined views for every possible user scenario.
3Reliability
If multiple individual views are created to secure access for each user, then fine-grained access control is achieved, but the design, testing, implementation, and maintenance of numerous separate views becomes extremely time-consuming and expensive
Solution Approach 1:
The patent merges the security enforcement logic from multiple individual views into a single centralized view definition with parameterized access control rules. Instead of maintaining separate view definitions for each user, the system combines all security policies into one universal view structure that automatically applies appropriate filters and projections based on user context, dramatically reducing design and maintenance efforts.
Solution Approach 2:
The patent uses parameterized view definitions where security attributes such as accessible rows, columns, and user permissions are defined as parameters rather than hard-coded values. This allows the same view definition to serve multiple users with different access requirements by simply changing the parameter values based on user identity, eliminating the need to create and maintain separate views for each user scenario.
4Adaptability or versatility
If users are given sufficient database access to underlying tables for query and reporting tools, then reporting flexibility is improved, but users can bypass views and the security policies implemented therein
Solution Approach 1:
The patent adds a new dimension to security enforcement by implementing database-level triggers and policies that operate independently of the application layer. This additional dimension of control ensures that security rules are enforced at the database engine level, making it impossible for users to bypass security even when they have direct table access for reporting purposes. The security enforcement occurs in a different dimensional layer than traditional application-based controls.
Data Source
AI summary
Methods for providing a generic database security application using virtual private database (VPD) functionality are provided. The methods may include inserting rows into a user security table in a database providing VPD functionality, each row comprising a user ID for which database access is to be controlled, the name of a database object to be secured, and a predicate; and defining a security policy function common to all secured database objects, said security policy function generating a second predicate to be appended by the database's VPD functionality to queries made on a queried secured database object by a querying user, said second predicate based on at least one predicate in at least one row in the user security table, the at least one row referencing the name of the queried secured database object and the user ID of the querying user. Related systems and computer program products are also provided.