Proxy Gateway Authentication for Compartment-Level Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems face challenges in securing data access due to the lack of additional security layers beyond initial authentication, allowing malicious entities to exploit authorized credentials and access restricted data, and lack of granular control over data access permissions.
Innovation Solution
Implementing a proxy layer with a gateway that uses secure context tokens to control access to database compartments, allowing additional authentication checks and generating tokens that can be extended beyond initial expiration times, providing granular access control based on compartment-specific permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a login protocol with authentication credentials is implemented at the application layer, then users can access the platform, but malicious entities can exploit authorized credentials to access restricted data
Solution Approach 1:
The patent segments the authentication process into multiple independent layers: application layer authentication (login credentials) and database layer authentication (row-level security tokens). Each layer operates autonomously with its own validation logic, so that compromise at one layer does not necessarily compromise the entire system. The gateway divides SQL statements into multiple parts, validating each against the token's permitted operations and target identifiers.
Solution Approach 2:
The patent introduces a gateway as an intermediary component between the application layer and database layer. This gateway acts as a mediator that receives authenticated requests from the application layer, generates and validates security tokens, and enforces row-level security policies before allowing database access. The gateway mediates all SQL operations, ensuring that even authorized users can only access data within their permission scope.
2Adaptability or versatility
If access permissions are granted to users at the application layer, then users can perform operations on data, but users can circumvent these measures to access restricted data
Solution Approach 1:
The patent implements preliminary action by pre-generating security tokens that encode specific permission scopes before database operations occur. The gateway creates tokens with predetermined valid target identifiers and permitted operations based on user roles and data classifications. These tokens are validated before each SQL operation, ensuring users can only execute pre-approved actions on pre-approved data sets, preventing circumvention of access controls.
Solution Approach 2:
The patent applies local quality by implementing granular, row-level security controls rather than uniform access policies. Each token is customized with specific target identifiers and operation types relevant to that user's needs. The gateway validates each SQL statement against the specific permissions encoded in the token, allowing different users to have different access scopes to different portions of the database, thereby enabling legitimate access while blocking unauthorized operations.
3Reliability
If multiple security layers are added to control data access, then data security is improved, but system complexity increases
Solution Approach 1:
The patent implements universality by designing the gateway to perform multiple security functions within a single component. The gateway simultaneously handles authentication token generation, SQL statement parsing and validation, row-level security enforcement, and permission verification. This multi-functional approach consolidates what could be separate security services into one unified gateway, reducing overall system complexity while maintaining multiple security layers.
Solution Approach 2:
The patent applies self-service by enabling the gateway to autonomously generate and validate security tokens without requiring external authentication services for each database operation. The gateway maintains its own validation logic and permission databases, allowing it to independently verify token authenticity and enforce security policies. This self-sufficient design reduces dependencies on additional external systems, simplifying the architecture while providing robust multi-layer security.
Data Source
AI summary
Presented herein are systems and methods of authenticating clients to access data via proxy layers. A gateway on a proxy layer may receive a request from a client to access data in a compartment on the database layer. The request may include a token based at least on an encryption of an identifier of the compartment responsive to successful authentication of the request at an application layer. The gateway may, responsive to identifying the identifier as referencing the compartment, determine that the client is authorized to access the data in the compartment on the database layer through the proxy layer. The gateway may select a permission for the client to access the compartment through the proxy layer based on the context of the request. The gateway may generate an indication that the client is authorized to access the data in accordance with the permission.