Reverse Proxy Data Access Policy Enforcement With Context-Aware Mediation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing software systems for data protection in database access are unreliable due to scattered security logic, lack of user context awareness, and vulnerability to coding errors, leading to unauthorized data access and leaks.

Innovation Solution

Implementing a three-layer security model with a data protection component between the application and database components to enforce data access policies, managed by data security specialists, which intercepts and alters database queries based on contextual information.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If security logic is implemented in the application component or database component, then data protection is provided, but the security model becomes unreliable and limiting due to scattered security logic and lack of contextual information

Engineering Contradiction:

Improvesecurity model reliabilityVSAvoidsecurity logic distribution

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

A data protection component is introduced as an intermediary layer between the application component and database component. This component receives database queries from the application, evaluates them against data access policies using contextual information (user identity, application identity, device identity), and returns modified queries or results. This intermediary structure centralizes security logic while maintaining the functional separation of the application and database components, thereby improving reliability without excessive complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If a data protection component is added between application and database components, then data security is enhanced, but system complexity increases

Engineering Contradiction:

Improvedata securityVSAvoidsoftware stack layers

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The data protection component is designed to perform multiple functions within a single layer: it intercepts database queries, collects contextual information from multiple sources (application, user, device), evaluates data access policies, modifies queries or results, and returns responses to the application. By consolidating these diverse security functions into one universal component, the system enhances data security while avoiding the proliferation of separate security modules that would increase complexity.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If security logic is embedded in the application component, then user-specific data protection is possible, but coding errors may expose data to unauthorized users

Engineering Contradiction:

Improveuser-specific data protectionVSAvoidcoding errors exposing data

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The data protection component serves as a mediator that receives contextual information from the application component (including user identity) and independently evaluates data access policies. This separation means that even if the application component contains coding errors, the data protection component maintains independent security evaluation logic that can catch and correct errors, preventing unauthorized data exposure while still providing user-specific protection.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Reliability

If database component implements security logic, then data access control is provided, but the database component cannot limit data retrieved by specific users due to lack of user context awareness

Engineering Contradiction:

Improvedata access controlVSAvoiduser context awareness

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The data protection component acts as an intermediary that collects contextual information from multiple sources including user identity, application identity, and device identity. This component makes contextual information available to the security evaluation process, enabling the system to provide data access control based on user context. The database component itself does not need to be modified, as the intermediary handles all context-aware security decisions before queries reach the database.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12531736B2Enforcing data access policies in a reverse proxy

Publication Date: 2026.01.20 NEXTLABS INC

AI summary

A method and system of masking, redacting, filtering, and encrypting data retrieved from or stored into a database using policies in an information management system. The system comprises application, data protection, and database components. A data protection component is placed between an application component and a database component to provide protection to data in a database by applying data access policies to requests sent from the application component to the database component.