Semantic Query Rewriting for Decoupled Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database management systems face challenges in implementing information access policies that are tightly coupled to the storage structure of sensitive data, making it difficult to change policies when the structure changes, and requiring complex hand-coded policy functions that are hard to update and comply with regulations.
Innovation Solution
A method and apparatus for proactive information security management using semantic models and access constraints, where match pattern and apply pattern data are used to rewrite queries and control access to sensitive information, allowing for loose coupling with storage structure and easy updates to information access policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If information access policies are tightly coupled to storage structure, then policy enforcement is straightforward, but it becomes difficult to change policies when storage structure changes
Solution Approach 1:
The patent segments the information access policy into two independent components: a semantic model that defines the meaning and relationships of data elements, and access constraints that define security rules. This separation allows the semantic model to remain stable while access constraints can be modified independently without affecting storage structure coupling.
Solution Approach 2:
The patent introduces a semantic model as an intermediary layer between the storage structure and access policies. This semantic model acts as a mediator that translates storage structure changes without requiring policy changes, thereby maintaining policy enforcement reliability while adapting to structural changes.
2Adaptability or versatility
If hand-coded policy functions are used, then complex policies can be implemented, but they are hard to update and comply with regulations
Solution Approach 1:
The patent uses graph pattern templates that can be copied and reused across multiple policies. Instead of hand-coding unique policy functions for each scenario, standardized graph patterns serve as reusable templates that can be instantiated multiple times with different parameters, making updates easier and ensuring consistency across policies.
Solution Approach 2:
The patent enables policy updates through parameter changes in graph patterns rather than structural code modifications. By defining policies as parameterized graph patterns, the system allows administrators to update policies by changing parameters (such as data element identifiers, access rights) without rewriting the underlying policy logic, significantly improving ease of updates and regulatory compliance.
Data Source
AI summary
A method and apparatus for proactive information security management is described. In one embodiment, for example, a computer-implemented method for controlling access to sensitive information, the method comprising: maintaining access constraint data that can be used to control access to the sensitive information, wherein the access constraint data includes match pattern data and apply pattern data; receiving a semantic query from a querier requesting access to the sensitive information; based on the match pattern data, determining whether the semantic query should be constrained according to the apply pattern data; where said semantic query should be constrained according to the apply pattern data, rewriting the semantic query according to the apply pattern data to produce a rewritten query; executing the rewritten query against a database that contains the sensitive information; and returning any results of executing the rewritten query.