NGAC Engine for Fine-Grained Database Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Relational database management systems (RDBMS) lack effective access control mechanisms at the column and row levels, leading to potential unauthorized access to sensitive data, as conventional access control typically only extends to table-level privileges.
Innovation Solution
The implementation of a next-generation access control (NGAC) system that translates queries into NGAC inputs, processes them using access control data, and generates authorization responses to enforce fine-grained access control at the column and row levels within relational databases, allowing for precise management of user permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional table-level access control is used in RDBMS, then system simplicity is maintained, but fine-grained access control at column and row levels cannot be effectively implemented
Solution Approach 1:
The patent segments access control into multiple hierarchical levels: database level, table level, column level, and row level. This segmentation allows fine-grained control at each level while maintaining overall system simplicity through the structured hierarchy of the NGAC model.
Solution Approach 2:
The patent introduces an NGAC engine as an intermediary component between the RDBMS and users. This engine translates conventional table-level access control requests into fine-grained column and row level authorization decisions, enabling enhanced control without modifying the core RDBMS architecture.
2Reliability
If fine-grained access control is implemented at column and row levels, then unauthorized access prevention is improved, but system complexity increases
Solution Approach 1:
The NGAC engine serves multiple functions: it acts as an access control policy manager, an authorization decision maker, and a translator between conventional and fine-grained access control models. This multi-functionality reduces the need for separate specialized components, managing system complexity while providing comprehensive fine-grained control.
Solution Approach 2:
The patent changes the parameters of access control from coarse-grained table-level permissions to fine-grained column and row level permissions. By modifying the granularity parameter and introducing policy-based control parameters, the system achieves better security without proportionally increasing complexity.
3Measurement precision
If NGAC translation and processing is added, then authorization precision is improved, but processing time increases
Solution Approach 1:
The NGAC engine performs preliminary processing by pre-evaluating access control policies and translating authorization rules before actual data queries are executed. This preliminary action prepares authorization contexts in advance, reducing the time penalty during actual query processing.
Solution Approach 2:
The system implements self-service mechanisms where the NGAC engine automatically translates and evaluates access control requests without requiring manual intervention. The engine services its own translation and authorization needs, streamlining the process and minimizing additional processing time.
Data Source
AI summary
A computer-implemented method included: receiving, by an access manager, a query from a source; communicating the query from the access manager to a translator; translating the query into a next generation access control (NGAC) input; communicating the NGAC input to an NGAC engine, the NGAC engine including access control data; receiving the NGAC input; determining an authorization response; communicating the authorization response to the translator; translating the authorization response into a response statement; communicating the response statement to the access manager; communicating, if the response statement comprises a permitted statement: a permitted query to a database from the access manager, the permitted query comprising a data operation; and performing the data operation on data in the database; and blocking access by the source to data in the database if the response statement comprises a deny statement.