Procedural Database Code Reconstruction for Fine-Grained Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control for procedural language blocks in databases is binary, leading to entire queries failing if a user lacks permission to access even a single database element, resulting in incomplete query execution.
Innovation Solution
Reconstruct procedural language blocks to comply with access control policies by modifying them to exclude restricted data elements, allowing partial execution and providing permitted data to users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If binary access control is used for procedural language blocks, then access control simplicity is maintained, but query completeness deteriorates (entire queries fail when any data element is restricted)
Solution Approach 1:
The patent segments the procedural language block into multiple discrete data access operations, each subject to independent access control evaluation. This allows the system to identify and execute only the permitted operations rather than rejecting the entire block, thereby maintaining query completeness while preserving access control simplicity.
Solution Approach 2:
The system applies partial execution by allowing only the permitted portions of the procedural language block to execute while denying access to restricted data elements. This partial action approach enables query completion for authorized operations without compromising security for restricted operations.
2Reliability
If access control policies are enforced strictly, then data security is improved, but query execution completeness deteriorates (users cannot access any data if restricted)
Solution Approach 1:
The patent segments the query into distinct data access operations, enabling the access control system to evaluate and permit specific operations while blocking others. This segmentation allows users to access permitted data elements even when restricted from other elements, maintaining both security and query execution completeness.
Solution Approach 2:
The system introduces an intermediary access control engine that intercepts and processes data access requests within procedural language blocks. This intermediary evaluates each access operation against security policies and selectively permits or blocks operations, enabling users to retrieve permitted data while preventing access to restricted data.
3Device complexity
If entire procedural blocks are rejected for security reasons, then access control enforcement is simplified, but information loss increases (users receive incomplete data)
Solution Approach 1:
The patent segments the procedural language block into individual data access operations that can be independently evaluated and executed. This segmentation enables the access control system to enforce security policies at the operation level rather than blocking entire blocks, thereby reducing information loss while maintaining enforcement simplicity.
Solution Approach 2:
The system implements partial execution by allowing only the permitted portions of the procedural block to execute. This approach provides users with the information they are authorized to access without forcing complete rejection, thereby reducing information loss while maintaining security enforcement.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, apparatuses, and computer program products are provided for controlling access to a database. A data processing application may receive, from a user, a request that includes a procedural language code block to access data elements stored in a distributed database. A procedural language code block analyzer may obtain an access control policy that indicates permissions to access the data elements. A control system may determine, based on the access control policy, that access to a restricted portion of the data elements is denied. A reconstruction system may generate a reconstructed code block that allows the user to access data elements that are not restricted, such as by modifying the request to remove the portion that seeks access to the restricted data elements. The reconstruction system may then provide the modified request to the distributed database to receive the data elements to which the user is permitted to access.