Predicate Catalog Control for Privacy-Preserving Database Columns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack effective methods for managing fine-grained privacy-preserving columns, allowing unauthorized access and inadequate control over predicate access to sensitive data.
Innovation Solution
Implementing a hardware-encrypted relational database with a predicate catalog table that manages ownership and access control for fine-grained privacy-preserving columns, using DCL operations to grant, revoke, and manage predicate access through a trust execution environment (TEE)-based virtual machine.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted to protect sensitive information, then data security is improved, but access control complexity increases
Solution Approach 1:
The patent segments access control into multiple levels: table-level access control and column-level predicate access control. The predicate catalog table divides fine-grained columns into privacy-preserving columns with separate access management. This segmentation allows encrypted data to be accessed through structured predicate operations rather than requiring decryption, reducing access control complexity while maintaining security.
Solution Approach 2:
The patent introduces a predicate catalog table as an intermediary between users and encrypted sensitive data. This catalog stores predicate information and access permissions without exposing the actual encrypted data. The predicate catalog acts as a mediator that enables controlled access to encrypted columns through predicate operations, simplifying the access control mechanism while preserving data encryption and security.
2Reliability
If fine-grained access control is implemented on privacy-preserving columns, then data privacy is improved, but system complexity increases
Solution Approach 1:
The patent segments the database schema into regular columns and privacy-preserving fine-grained columns. The predicate catalog table is segmented to store specific predicate information for each privacy-preserving column. This segmentation enables fine-grained access control on sensitive columns without applying complex control mechanisms to the entire system, reducing overall system complexity while improving data privacy for critical columns.
Solution Approach 2:
The patent applies different access control qualities to different columns: privacy-preserving columns receive enhanced predicate access control with owner permissions and predicate catalogs, while regular columns use standard access control. This local differentiation of quality allows fine-grained control where needed without imposing system-wide complexity, balancing data privacy improvement with manageable system complexity.
3Ease of operation
If predicate access control is granted to users on encrypted columns, then data accessibility is improved, but security risks increase
Solution Approach 1:
The predicate catalog table serves as an intermediary that stores predicate information and access permissions for encrypted columns without exposing the actual data. Users can perform predicate operations on privacy-preserving columns through this catalog, which verifies permissions and executes operations securely. This intermediary mechanism improves data accessibility through structured predicate access while maintaining security by never exposing encrypted data and enforcing permission checks through the catalog.
Solution Approach 2:
The patent implements preliminary action by requiring owners to pre-define predicate information and access permissions in the predicate catalog table before users can access encrypted columns. The owner specifies which predicates are allowed and grants permission to specific users in advance. This preliminary configuration enables secure predicate access control, improving accessibility while mitigating security risks by establishing permission boundaries before any data access occurs.
Data Source
AI summary
The present disclosure describes techniques for implementing multiple security levels of control over predicate access to fine-grained privacy-preserving columns. A predicate catalog table is configured. The predicate table is configured for controlling predicate survivor users to access the fine-grained privacy-preserving columns. A first instruction of granting a user predicate access to one of the fine-grained privacy-preserving columns is received from an owner of the one of the fine-grained privacy-preserving columns. It is determined if there is a match based on comparing identification information and operator information in the predicate catalog table with information indicated by the first instruction. In response to determining that there is no match, a new row is created in the predicate catalog table based on the first instruction. The new row is configured to control the user's predicate access to the one of the fine-grained privacy-preserving columns.