Governed Database Connectivity Layer for Bypassed Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data governance systems face challenges in ensuring data security and compliance when accessing data from registered sources, particularly when connections bypass the data catalog, as they lack effective mechanisms to enforce access privileges and mask unauthorized data.
Innovation Solution
Implementing a Governed Database Connectivity (GDBC) layer that compares access privilege levels with data protection rules, masks unauthorized data, and generates logs for compliance, while also synchronizing new data assets with the catalog.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If connections bypass the data catalog to access data sources, then data access speed and system performance are improved, but data security and compliance enforcement deteriorate
Solution Approach 1:
The patent introduces a governance manager as an intermediary component at the database connectivity layer. This mediator intercepts data access requests, retrieves governance artifacts from the data catalog, compares access credentials against defined policies, and enforces data protection rules without requiring applications to change their access patterns. The governance manager acts as a transparent security layer that maintains both fast access and reliable enforcement.
Solution Approach 2:
The system performs preliminary actions by pre-defining governance artifacts, data protection rules, and access policies in the data catalog before data access occurs. These governance configurations are prepared in advance, allowing the governance manager to quickly evaluate credentials against pre-established rules during actual data access operations, thereby maintaining high-speed access while ensuring compliance.
2Reliability
If data access requests are routed through the data catalog, then data governance and access control are improved, but system performance and access efficiency deteriorate
Solution Approach 1:
The patent segments the data access architecture into distinct functional layers: the data catalog layer for storing governance artifacts, the governance manager layer for policy enforcement, and the database connectivity layer for actual data access. This segmentation allows the governance manager to enforce access control independently without creating a single point of bottleneck, as it can evaluate credentials against pre-loaded governance rules cached locally.
Solution Approach 2:
The governance manager performs partial evaluation by selectively applying governance artifacts based on the specific data source and access credentials involved. Rather than routing all requests through the complete data catalog validation chain, it performs targeted credential verification against relevant governance rules, reducing unnecessary processing overhead while maintaining adequate control.
3Reliability
If governance rules are strictly enforced at the database connectivity layer, then data protection and compliance are improved, but system complexity increases
Solution Approach 1:
The governance manager implements self-service by autonomously retrieving governance artifacts from the data catalog, evaluating access credentials against defined policies, and enforcing data protection rules without requiring external intervention or complex coordination with other system components. This self-contained approach simplifies the overall system architecture by consolidating governance enforcement logic in a single manageable component.
Data Source
AI summary
An embodiment includes receiving, at database connectivity (DBC) layer, a request to access data of a data source, wherein the data source is registered with a data catalog that includes data governance artifacts, and wherein the request is made via a connection that bypasses the data catalog. The embodiment also includes comparing, by a governance manager at the DBC layer, an access privilege level for a credential associated with the request to access requirements of requested data included in data protection rules of the governance artifacts. The embodiment also includes masking, by the governance manager, a portion of the data provided in response to the request, wherein the portion of the data has an access requirement that is not met by the access privilege level for the credential associated with the request.