Incremental Column Access Control for Evolving Database Schemas
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database security systems face challenges when new columns are added to tables, as these columns are not accessible to applications since they were not part of the learning phase, leading to potential security vulnerabilities.
Innovation Solution
Implementing incremental security protection by adding an incremental column to a table with an initial set of columns, transitioning its status from a learning phase to an enforcement phase based on a switch factor, and updating an allowlist with predicates during the learning phase.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a new column is added to a database table after the learning phase, then the table structure is updated, but the application cannot access the new column because it was not part of the learning phase data
Solution Approach 1:
The system performs preliminary actions by automatically adding the new column to the allowlist during the learning phase before enforcement begins. When a new column is detected, the system adds it to the allowlist with a status indicating learning phase, enabling the column to be accessible once the enforcement phase starts without requiring manual intervention or retraining the application.
2Adaptability or versatility
If the system maintains a learning phase for all columns, then access controls can be adapted to new schemas, but computational resources are consumed continuously during learning
Solution Approach 1:
The system dynamically transitions columns from learning phase to enforcement phase based on their usage. Columns that are accessed by applications remain in the learning phase and continue to be monitored, while columns that are not accessed transition to enforcement phase, reducing computational resources spent on monitoring inactive columns while maintaining adaptability for actively used columns.
3Reliability
If the system transitions all columns to enforcement phase immediately, then security is enforced consistently, but new columns added during operation cannot be accessed by applications
Solution Approach 1:
The system segments columns into different phases: learning phase for new columns that need to be discovered and monitored, and enforcement phase for established columns with known access patterns. This segmentation allows the system to maintain consistent security enforcement for known columns while providing flexible access for new columns during their learning period, resolving the contradiction between security consistency and operational ease.
Data Source
AI summary
A method implements incremental security protection generation. The method includes adding an incremental column to a table including an initial set of columns to form an updated set of columns. The initial set of columns include a status for at least one column of the initial set of columns. The method further includes adding a predicate to an allowlist for the incremental column. The method further includes transitioning the status of the incremental column from corresponding to a learning phase to corresponding to an enforcement phase responsive to a switch factor of the incremental column. The method further includes sending an access query including an access command, to access the incremental column, to a database in response to checking the access command against the allowlist with the status of the incremental column corresponding to the enforcement phase.