Managed Cluster Query Access Control for Fine-Grained Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud platforms used for large-scale data processing face challenges in enforcing fine-grained access control, leading to potential security violations due to coarse-grained storage level access control, which can result in unauthorized access or data modification/deletion.
Innovation Solution
Implementing a system that generates query plans with access control filters to enforce fine-grained access control policies, using a sidecar process with temporary credentials to access data and an executor process for processing, ensuring only authorized data subsets are accessed and processed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If coarse-grained storage level access control is used in cloud platforms, then ease of operation is improved, but data security and access control precision deteriorate
Solution Approach 1:
The patent segments access control into two layers: coarse-grained storage level access control for overall data protection, and fine-grained query level access control for precise data access. The query plan is divided into multiple operators with individual access control filters applied at each data access operator, enabling precise control over which specific data rows and columns can be accessed while maintaining ease of operation at the storage level.
Solution Approach 2:
The patent introduces an intermediary access control filter component that sits between the data access operator and the data processing operator. This filter acts as a mediator that receives the query plan, applies fine-grained access control policies to determine which specific data subsets can be accessed, and passes only authorized data to subsequent processing operators, thereby resolving the contradiction between operational simplicity and access control precision.
2Reliability
If fine-grained access control filters are applied at each data access operator, then data security is improved, but device complexity increases
Solution Approach 1:
The patent applies preliminary action by generating access control filters in advance during query plan compilation. The system analyzes the query plan before execution, identifies all data access operators, and pre-attaches the appropriate access control filters to each operator based on fine-grained access control policies. This preliminary preparation ensures data security is enforced without adding complexity during query execution, as the filters are already in place and simply executed during normal query processing.
3Productivity
If temporary credentials are provided to helper process, then productivity is improved, but security risk increases
Solution Approach 1:
The patent applies parameter changes by making credentials temporary and time-limited rather than permanent. The system generates temporary credentials specifically for the helper process to access data during query execution, and these credentials automatically expire after use. This parameter change from permanent to temporary credentials maintains productivity by enabling the helper process to access necessary data efficiently, while reducing security risk through automatic credential expiration and limited scope of access.
Data Source
AI summary
A system manages access control for database queries in accordance with access control policies. The techniques may be used for access control of managed clusters in cloud platforms used for data processing, for example, for MapReduce operations. According to an embodiment, the access control policies are fine grained access control policies that allow a user to access a subset of datasets including data of a dataset. The system receives and compiles a database query to generate a query plan for processing the database query. The query plan includes: one or more data access operators, one or more data processing operators, and one or more access control filters. The system executes the query plan using an executor process and a helper process. The helper process executes a data access operator and a corresponding data access filter and the executor process executes one or more data processing operators.