Database Query Authorization via Execution Plan Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In relational databases, determining whether a query would result in unauthorized access or modification is challenging due to complex queries and the need for detailed knowledge of query language, making it difficult to enforce security authorization effectively.
Innovation Solution
A method is implemented to produce an execution plan for user queries, comparing it with access rules to determine if the query is authorized, involving the generation of a database structure and access type, and performing actions based on matching rules to either allow or reject the query.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security authorization methods are used to check user access rights, then security control is maintained, but the complexity of parsing complex queries and determining unauthorized access increases significantly
Solution Approach 1:
The patent introduces an execution plan as an intermediary representation between the original SQL query and the security authorization check. The execution plan breaks down the complex query into structured operations (scan, join, filter, aggregate) that are easier to analyze for security purposes. This intermediary format simplifies the authorization checking process while maintaining accurate security control.
Solution Approach 2:
The patent segments the query analysis process into distinct phases: generating the execution plan from the SQL query, extracting access paths from the execution plan, and checking authorization against the access paths. This segmentation reduces the overall complexity by handling each phase separately rather than attempting to parse and analyze the entire complex query at once.
2Reliability
If detailed knowledge of query language is required to enforce security authorization, then accurate security control is achieved, but the difficulty and time required to enforce security increases
Solution Approach 1:
The patent performs preliminary action by generating the execution plan before the actual security authorization check. The execution plan is created once and can be reused for multiple authorization checks, avoiding the need to repeatedly parse the same complex query. This preliminary generation step reduces the time required for subsequent authorization validations.
Solution Approach 2:
The patent creates a copy of the query's logical structure in the form of an execution plan. This copy captures the essential access paths and operations without requiring detailed knowledge of the original query syntax. The execution plan serves as a simplified representation that can be efficiently analyzed for security purposes.
3Productivity
If the system rewrites or optimizes queries for performance, then query execution efficiency improves, but determining whether the optimized query results in unauthorized access becomes more difficult
Solution Approach 1:
The execution plan serves as an intermediary that preserves the semantic meaning of the original query while representing it in a form suitable for both optimization and security analysis. The access path extraction process works on this intermediary representation, enabling security checks without requiring reversal of the optimization process.
Data Source
AI summary
A method is provided to check user authorization to access a database, the method comprising: receiving a database query; producing an execution plan for the query; receiving an access rule applicable to a user associated with the query; determining whether the access rules permits processing of the query according to the plan; and rejecting the query in response to a determination that the access rule does not allow processing of the query according to the plan.