Repository-Based Security Manager for Database Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Relational database systems primarily provide security at the object/operation level, lacking effective control at the row and column levels, requiring user configuration within the database, physical access to security stores, and degrading performance due to authentication and role membership resolution.
Innovation Solution
A repository-based system that decouples object and row-level security by intercepting user queries, resolving group memberships, and modifying queries to filter out unauthorized data using SQL where clauses, allowing control at both row and column levels, and enabling dynamic security adjustments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If database systems provide security at object/operation level using traditional methods, then security control is implemented, but performance degrades due to authentication and role membership resolution
Solution Approach 1:
The patent extracts the security control functionality from the database system core by implementing an external security manager that handles authentication and authorization independently. This allows the database to process queries without being burdened by security resolution overhead, thus maintaining performance while ensuring security control.
Solution Approach 2:
The patent introduces a security manager as an intermediary layer between users and the database system. This mediator handles all security-related operations including authentication, authorization, and role membership resolution, preventing these operations from directly impacting database performance while maintaining comprehensive security control.
2Reliability
If users are configured within the database system for security purposes, then access control is enabled, but device complexity increases
Solution Approach 1:
The patent extracts user and role configuration from the database system by implementing external security stores and a separate security manager. This separation reduces the complexity within the database system while maintaining comprehensive access control capabilities through externalized security management.
Solution Approach 2:
The security manager acts as an intermediary that manages user configurations, roles, and permissions externally. This mediator layer handles the complexity of access control policies without requiring the database system itself to become more complex, thus enabling access control while managing system complexity.
3Reliability
If physical access to security stores is required for role membership resolution, then security information can be retrieved, but loss of time occurs
Solution Approach 1:
The patent implements preliminary action by pre-establishing security contexts and caching security information before queries are executed. The security manager resolves role memberships and retrieves security information in advance, reducing the time required during actual query processing while ensuring accurate security information access.
Solution Approach 2:
The patent maintains continuity of useful action by implementing connection pooling and caching mechanisms that keep security contexts active and readily accessible. This eliminates repeated physical access to security stores for each query, reducing resolution time while maintaining continuous access to security information.
4Reliability
If authentication of every user is performed in the database server, then security is enforced, but productivity decreases due to prevention of connection pools
Solution Approach 1:
The patent extracts authentication functionality from the database server by implementing a separate security manager that handles user authentication independently. This allows the database server to enforce security policies without performing authentication operations, enabling connection pooling and improving overall connection efficiency while maintaining security enforcement.
Solution Approach 2:
The security manager serves as an intermediary that handles authentication operations externally to the database server. This mediator layer verifies user credentials and manages authentication states without preventing connection pooling, thus maintaining security enforcement while improving connection efficiency and productivity.
Data Source
AI summary
A computer method, system and apparatus control access to secured data in a plurality of databases. A repository is coupled to the databases and has a security runtime subsystem. The repository intercepts a user query of a subject database in the plurality. The security runtime subsystem determines from the intercepted query a user and corresponding user role. Based on user role, the security runtime subsystem automatically modifies the user query to filter out secure data for which the identified user is unauthorized to access but are part of the user query.