Database Predicate Access Enforcement for Fast Secure Queries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional database systems face performance bottlenecks and security vulnerabilities in managing access control due to inefficient permission checks and rigid policy management, which can lead to unauthorized access and performance degradation, especially in high-traffic environments.
Innovation Solution
A system that modifies user queries to embed access security functionality, using relational database predicates to enforce granular access permissions, allowing only authorized data access without additional permission checks by the database.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional database systems use separate permission check mechanisms, then access control can be enforced, but query performance degrades due to additional processing overhead
Solution Approach 1:
The patent merges access control enforcement with query execution by embedding security predicates directly into the SQL query structure. The access control engine translates permission policies into database predicates that are integrated with the original query, allowing the database engine to execute both data retrieval and access control filtering in a single optimized operation, eliminating separate permission check overhead
Solution Approach 2:
The patent introduces a query translator as an intermediary component that sits between the application layer and the database engine. This translator converts access control policies into database-specific predicates and modifies the query plan, enabling the database to enforce security without requiring additional processing steps during query execution
2Reliability
If database systems implement comprehensive access control policies, then security improves, but system complexity increases due to rigid policy management
Solution Approach 1:
The patent changes the representation of access control policies from rigid, complex rule sets to flexible database predicates that can be dynamically generated. By translating policies into parameterized SQL conditions, the system can adapt to different users and data without requiring complex policy configuration, reducing management complexity while maintaining comprehensive security
Solution Approach 2:
The patent makes access control policies dynamic by allowing the query translator to generate different predicates based on user permissions and data characteristics. Rather than using static, pre-defined access control rules, the system dynamically constructs security filters that adapt to individual user requirements, making policy management more flexible and less complex
Data Source
AI summary
A system, method, and device for enforcing access security for queries to data stored at a data source are provided. The method generates a modified query that has security enforcement functionality embedded into the modified query. The method includes (i) receiving from a user a user query for data at a data source, (ii) determining a set of permissions for the user to access data at the data source, wherein the user is associated with the user query, (iii) generating a modified query to enforce access permissions to the data at the data source, (iv) providing the modified query to the data source, and (v) obtaining the data responsive to the user query for which the user has the requisite permissions. The modified query is generated based at least in part on the user query and the set of permissions for the user.