Database Replication ACL Rule Generation for Secure Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In back-end database systems like ERP or CRM, data replication to specialized systems for faster access often neglects authorization transfer, leading to unauthorized access due to the lack of access control mechanisms in the new database systems.
Innovation Solution
A method is implemented to replicate data from a first database system to a second, generating ACL rules based on the access context hierarchy of groups in an entity, which determines user access permissions by comparing the user's role access context with the ACL rule access context to allow or deny access to the replicated data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If data is replicated to a specialized database system for faster access, then access speed is improved, but security is worsened due to lack of authorization transfer
Solution Approach 1:
The system performs preliminary action by generating ACL rules and transferring authorization information from the source database to the target database system during the data replication process. This ensures that security controls are established before unauthorized access can occur, resolving the contradiction by proactively addressing the security gap that would otherwise exist in the replicated system
Solution Approach 2:
The patent introduces an intermediary mechanism (ACL rule generation and authorization transfer process) that bridges the source database and target database system. This intermediary transfers the necessary authorization information during replication, allowing the target system to maintain security controls without compromising the performance benefits of specialized database systems
2Reliability
If ACL rules are generated and transferred during data replication, then security is improved, but processing complexity is worsened
Solution Approach 1:
The patent merges the ACL rule generation and authorization transfer process with the existing data replication workflow. By combining these security functions into the replication process itself, the system avoids creating separate complex security management systems while still achieving comprehensive authorization transfer, thus improving security without proportionally increasing complexity
3Reliability
If access control mechanisms are implemented in the replicated database system, then security is improved, but access efficiency is worsened due to additional verification steps
Solution Approach 1:
The system creates a copy of the authorization structure (ACL rules) from the source database and applies it to the target database system. This copied authorization framework enables efficient access control decisions at the database level without requiring complex application-layer verification, thus maintaining both security and access efficiency in the replicated system
Data Source
AI summary
In one embodiment, a method replicates data from a first database system to a second database system and determines a modeling of a first access context for a table in the replicated data. An ACL rule based on the first access context is generated to restrict access to the replicated data in the second database system to users associated with the first access context. The method receives a request to access the replicated data from a user and determines a second access context for the user. The first access context for the ACL rule and the second access context for the user are compared to determine whether the user is allowed to access the replicated data. Access to the replicated data is allowed when the second access context and the first access context indicate the user is allowed to access the replicated data.