Relational Security Service for Fine-Grained Data Lake Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data lakes lack sufficient relational security policies, leading to inadequate control granularity and exposing relational data to unauthorized access.
Innovation Solution
Implement a data lake security service that authorizes access based on relational database metadata and security policies, providing pre-authenticated uniform resource locators (PARs) to ensure secure data access without additional policy evaluations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional data lakes use primitive access controls, then ease of operation is improved, but security reliability deteriorates
Solution Approach 1:
The patent introduces a security service as an intermediary layer between the data lake storage and access points. This service intercepts file system calls, evaluates security policies, and manages pre-authenticated URLs, thereby enhancing security without requiring changes to the underlying storage system or user operations.
Solution Approach 2:
The system performs preliminary security evaluations by creating pre-authenticated URLs that embed security credentials before data access. These pre-authenticated URLs are generated in advance based on security policy evaluations, allowing authorized access without real-time policy checking during data retrieval operations.
2Reliability
If real-time security policy evaluation is performed for each access request, then security reliability is improved, but processing speed deteriorates
Solution Approach 1:
Security policy evaluations are performed in advance when pre-authenticated URLs are generated. The security service evaluates policies against user credentials and data sensitivity before issuing access URLs, so that subsequent data access operations can proceed without real-time policy checking, thus maintaining security while improving access speed.
Solution Approach 2:
The system creates copies of security credentials embedded within pre-authenticated URLs. Instead of repeatedly evaluating policies during each access operation, the security evaluation results are copied into the URL structure itself, allowing fast access while preserving security enforcement.
3Reliability
If fine-grained relational security policies are implemented, then security reliability is improved, but device complexity deteriorates
Solution Approach 1:
The security service acts as an intermediary that manages the complexity of fine-grained relational security policies. It translates high-level security requirements into specific access control decisions, handling the complexity of policy evaluation, credential verification, and pre-authenticated URL generation while presenting a simple interface to users and applications.
Data Source
AI summary
Systems, devices, and methods are disclosed for enforcing relational database security policies with respect to database components stored in a data lake. The techniques may include receiving, by a data lake security service associated with a data lake, a file system call comprising a uniform resource identifier and a credential. The service may obtain relational database metadata and identify, from the metadata, a relational database component corresponding to the uniform resource identifier of the file system call. A relational security policy corresponding to that component may be obtained and access to a storage location at which the data associated with the relational database component may be authorized (e.g., based on the credential received).