Optimistic Authorization for Database Transaction Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Database security checks incur significant overhead, reducing performance and forcing a trade-off between security and efficiency, especially when involving remote services and auxiliary operations like logging or auditing.
Innovation Solution
A method where a database sends an authorization request to an authorization module and continues executing the operation without waiting for the response, committing or rolling back the operation based on the response received, allowing for simultaneous execution and authorization of multiple database commands.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security checks are performed before database operations, then security is maintained, but performance deteriorates due to significant overhead
Solution Approach 1:
The system performs authorization requests in advance before the database operation executes, obtaining authorization tokens or cached authorization results beforehand. This preliminary authorization action allows the database operation to proceed without waiting for real-time security checks, thus maintaining security while improving performance.
Solution Approach 2:
An authorization module is introduced as an intermediary between the database system and security verification. This module handles authorization requests, caches authorization results, and manages security policies, allowing the database to continue executing operations while the authorization module processes security checks in parallel or asynchronously.
2Reliability
If security checks involve remote services, then comprehensive security verification is achieved, but overhead increases significantly
Solution Approach 1:
The system performs remote authorization requests in advance and caches the authorization results locally. When database operations need security verification, the system uses the cached results instead of contacting remote services in real-time, thus maintaining comprehensive security verification while dramatically reducing the time overhead.
Solution Approach 2:
The system implements a hybrid authorization approach where frequently accessed or pre-verified authorization rules are stored locally in the authorization module, while only complex or infrequently accessed rules require remote verification. This local caching strategy reduces dependency on remote services and minimizes overhead.
3Reliability
If auxiliary operations like logging or auditing are performed during security checks, then security compliance is improved, but overhead increases even more
Solution Approach 1:
The system performs logging and auditing operations in advance or in parallel with the authorization process. Authorization actions and their results are pre-logged or buffered, allowing security compliance requirements to be met without adding sequential overhead to the critical authorization path.
Solution Approach 2:
The authorization module serves as an intermediary that consolidates all security-related operations including authorization verification, logging, and auditing. By centralizing these functions in one module, the system reduces the complexity overhead in the database layer and enables optimized processing of security compliance requirements.
Data Source
AI summary
A method, computer-readable storage medium, and an apparatus are provided to facilitate authorizing a user during a database transaction. The method starts by receiving a request at the database to perform a database operation. Upon receiving the request, the database sends an authorization request to an authorization module to determine if the user has authorization to perform the database operation. In addition, the database continues executing the database operation without waiting for completion of the authorization request. Next, the database receives a response from the authorization module. The database then checks the response to determine if the user has authorization to perform the database operation. If so, the database commits the database operation, and if not, the database rolls back the database operation.