Query Predicate Control for Fine-Grained Privacy-Preserving Columns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems lack effective mechanisms for managing access to sensitive or confidential data, particularly in ensuring fine-grained privacy preservation and controlling predicate operations on privacy-preserving columns, which are vulnerable to unauthorized access and data leaks.
Innovation Solution
Implementing a hardware-encrypted relational database with a privacy-preserving column feature, utilizing a predicate catalog table to manage access and operations through DCL commands, and a trust execution environment (TEE)-based virtual machine to ensure secure and controlled access to sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted to protect sensitive information, then data confidentiality is improved, but access control complexity increases
Solution Approach 1:
The patent segments access control into multiple levels: table-level access control and fine-grained column-level access control. The predicate catalog table divides access policies into discrete predicate entries that can be independently managed. This segmentation allows encrypted data to be accessed with controlled granularity without requiring complex centralized access control logic.
Solution Approach 2:
The predicate catalog table serves as an intermediary between the encrypted data and query operations. It stores predicate information that mediates access decisions, allowing the system to control access to encrypted columns through predefined predicates without requiring complex real-time access control logic for each query.
2Reliability
If fine-grained access control is implemented on encrypted columns, then data privacy is improved, but query processing complexity increases
Solution Approach 1:
Access control policies are established in advance through DCL operations that populate the predicate catalog table with predefined predicates. This preliminary action allows the system to enforce fine-grained access control on encrypted columns without requiring complex runtime decision-making, as the access rules are predetermined and stored in the catalog.
Solution Approach 2:
The predicate catalog table automatically manages access control information, storing and retrieving predicate data without requiring external intervention for each query. The system self-services by checking the catalog against query predicates, reducing the need for complex external access control logic while maintaining data privacy.
3Object-affected harmful factors
If predicate access control is enforced on secret columns, then unauthorized access prevention is improved, but system operation complexity increases
Solution Approach 1:
The predicate catalog table serves multiple functions: it stores access control policies, manages predicate information, and enables both fine-grained column-level access control and table-level access control through a single unified structure. This multi-functionality reduces system operation complexity by consolidating access control mechanisms that would otherwise require separate systems.
Data Source
AI summary
The present disclosure describes techniques for processing query predicates involving fine-grained privacy-preserving columns. A query predicate is received. It is determined whether there is a first match between identification information and operator information in a first row of a predicate catalog table and information associated with the query predicate. It is determined whether a value of a quantity limit in the first row is greater than zero in response to determining that there is the first match between the identification information and the operator information in the first row and the information associated with the query predicate. The query predicate is executed in response to determining that the value of the quantity limit in the first row is greater than zero. The value of the quantity limit in the first row is automatically reduced by one and the predicate catalog table is automatically updated.