Object Access Service With Dynamic Predicates for Fine-Grained Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Database security administrators face challenges in managing complex role-based access control policies, leading to potential data leaks due to imprecise configurations, especially in modular application designs that attempt to provide limited data access to various users.
Innovation Solution
Implement an object access service that uses security assignments beyond role-based access controls, dynamically filling predicates to restrict data access based on security assignment fields and values, ensuring that only authorized data is accessible to users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If role-based access controls are used to manage database security, then data access can be controlled based on user roles, but the complexity of managing policies increases and imprecise configurations may lead to data leaks
Solution Approach 1:
The patent segments the monolithic role-based access control system into multiple independent components: role definitions, policy rules, and security assignments. Each component can be managed separately, reducing the complexity of the overall system while maintaining comprehensive security control.
Solution Approach 2:
The patent introduces security assignments as an intermediary layer between roles and database structures. This intermediary enables fine-grained control over which users can access specific data within a role's scope, preventing data leaks without requiring complex role configurations.
2Adaptability or versatility
If role-based access controls are configured to allow broad access for application functionality, then modular application designs can work more easily, but the risk of unauthorized data access increases
Solution Approach 1:
The patent applies local quality by allowing different security assignments for different database structures within the same role. This enables broad access where needed for application functionality while restricting access to sensitive data locally, thus balancing versatility with security.
Solution Approach 2:
The patent introduces dynamic security assignments that can be adjusted per user and per database structure. This dynamic approach allows the system to adapt to different application functionality requirements while maintaining security controls, rather than using static broad or narrow access rules.
3Measurement precision
If security assignments are added beyond role-based access controls, then fine-grained data access control is achieved, but the system complexity increases
Solution Approach 1:
The patent segments security control into two distinct layers: role-based access control for broad data structure access and security assignments for fine-grained record-level control. This segmentation achieves precise data access control while keeping each layer relatively simple and manageable.
Data Source
AI summary
An object access service is implemented on a computer system for configuring and enforcing multi-dimensional data security using security assignments beyond role-based access controls. The computer system accesses a request submitted on behalf of a user for access to database structure(s). The computer system requests predicate(s) mapped to role(s) assigned to the user and stored in association with the database structure(s). Predicate(s) submitted to the database may be dynamically filled in by the database pursuant to retrieving data from the database structure(s) to reference security assignment field(s) and security assignment value(s) of the security assignment. The predicate(s) are used to retrieve a security assignment that restricts access to the database structure(s) beyond the role(s) assigned to the user. The security assignment is used to restrict data accessible from the database structure(s) to generate a result set, which is transmitted to a client consumer system for consumption via a consumer interface.