Proxy-Based Cloud Database Access Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based database access poses security risks due to public communication networks, and direct two-tier approaches lack intermediary application servers to manage authentication and authorization, making it difficult for analytical client tools to securely connect to cloud databases without replicating users or modifying existing database tools.
Innovation Solution
Implementing a proxy-based access method between an analytical client tool and a cloud database using client and server proxies that establish a tunnel for secure communication, where the server proxy initiates authentication with an Identity Provider using SAML and replaces end-user credentials with technical user credentials, allowing secure and transparent access without an intervening application server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If direct two-tier access is used between analytical client tools and cloud database, then access simplicity and performance are improved, but security risks increase due to public communication networks and lack of authentication management
Solution Approach 1:
The patent introduces an application server as an intermediary component between the analytical client tool and the cloud database. This application server establishes a secure tunnel connection to the database and manages authentication/authorization credentials, allowing the client tool to access the database through a controlled interface without direct exposure to security risks of public networks while maintaining access simplicity.
2Object-affected harmful factors
If an application server is introduced to manage authentication and authorization, then security is improved, but system complexity increases
Solution Approach 1:
The application server is configured to automatically establish tunnel connections to the database and self-manage authentication/authorization credentials without requiring manual intervention or complex configuration. The server handles security protocols and credential management autonomously, reducing operational complexity while maintaining security improvements.
3Adaptability or versatility
If credentials are replaced with technical user credentials, then authentication compatibility with database is improved, but transparency of access is reduced
Solution Approach 1:
The application server acts as a transparent mediator that automatically performs credential translation between the client tool's credentials and the database's technical user credentials. This translation happens seamlessly in the background without requiring the user to manually manage multiple credential sets or understand the authentication complexity, maintaining operational transparency while achieving authentication compatibility.
Data Source
AI summary
Proxy-based access occurs between a cloud database and analytical client tool, without requiring a separate intervening application server. A client proxy (tool side) communicates exclusively with a server proxy (database side). In response to a connect request in a database protocol (e.g., Structured Query Language—SQL) received from the tool by the client proxy, the server proxy is caused to initiate an authentication process (e.g., using Security Assertion Markup Language—SAML) with an Identity Provider (IdP). The client proxy intercepts and extracts a security token from the IdP in order to establish a tunnel with the server proxy. Upon ultimately receiving the connect command through the tunnel, the server proxy replaces an end-user credential (recognized by the tool but meaningless to the database) with the security token in order to establish a technical user and a query session context that can be recognized by the database.