Session Manager for Transparent Database Security Context Integration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to transparently, securely, and efficiently integrate a user's security context from a middle-tier application to a database system, leading to security vulnerabilities and inefficiencies due to lack of direct integration and secure storage of security credentials.
Innovation Solution
Implementing a session manager that securely propagates and synchronizes a user's security context from the middle tier to the database system, using lightweight sessions and piggybacking mechanisms to enforce application-defined security policies without explicit API calls, thereby ensuring transparent and secure data access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a mid-tier application uses ad hoc API calls to create and manage application sessions in the database, then security context integration is achieved, but the system complexity increases and transparency is lost
Solution Approach 1:
The patent introduces a session manager as an intermediary component between the mid-tier application and the database system. This session manager handles all session creation, management, and synchronization operations, shielding the application from complex API calls. The session manager translates application-level security context into database-compatible session formats automatically, reducing system complexity while maintaining reliable security context integration.
Solution Approach 2:
The session manager implements self-service mechanisms by automatically synchronizing security context changes between the mid-tier application and the database system without requiring explicit API calls from the application. When security context changes occur in the application, the session manager detects and propagates these changes to the database automatically, eliminating the need for manual session management and reducing operational complexity.
2Ease of manufacture
If a mid-tier application treats security context the same as normal application data, then storage simplicity is achieved, but security vulnerabilities increase
Solution Approach 1:
The patent applies local quality by creating distinct storage mechanisms for security context data versus normal application data. The session manager implements specialized data structures and storage paths for security context, separating it from general application data. This separation ensures that security context receives enhanced protection and validation while maintaining simple storage for regular data, thus eliminating security vulnerabilities without compromising storage simplicity for non-sensitive data.
Solution Approach 2:
The session manager implements beforehand cushioning by establishing secure storage and validation mechanisms for security context data before any processing occurs. Security context is encrypted and validated upon creation, and the session manager maintains integrity checks throughout the data lifecycle. This proactive security approach prevents vulnerabilities before they can be exploited while keeping the storage mechanism simple for the application layer.
3Productivity
If an application uses privileged connections to access the database, then access efficiency is improved, but security enforcement is weakened
Solution Approach 1:
The patent applies segmentation by dividing the database connection model into two distinct types: privileged connections for system operations and unprivileged user-specific connections for application data access. The session manager automatically creates and manages user-specific database sessions that inherit appropriate privileges based on the user's security context. This segmentation maintains high access efficiency for authorized operations while enforcing security policies at the connection level, preventing unauthorized access without impacting legitimate data access performance.
4Measurement precision
If explicit API calls are used to manage security context synchronization, then control precision is improved, but API call overhead increases
Solution Approach 1:
The session manager implements continuity of useful action by establishing event-driven synchronization mechanisms that continuously monitor and propagate security context changes without requiring periodic API calls. When security context changes occur in the mid-tier application, the session manager detects these changes through event notifications and automatically synchronizes them to the database in real-time. This approach maintains precise control over security context synchronization while eliminating the time overhead associated with explicit periodic API calls, as synchronization occurs only when necessary.
Data Source
AI summary
Techniques are provided for integrating application-level user security context with a database. A session manager, in a middle tier that includes an application, obtains the security context of a user and establishes, in the database, a light-weight session (LWS) that reflects the security context. The security context is synchronized between the middle tier and database before application code execution. The database maintains an isolated copy of the LWS for the unit of application code executed as the security context. The database sends to the session manager the identifier of the copy of LWS. Before allowing a request from an application to be sent to the database, the session manager, transparent to the application, inserts an identifier that identifies the LWS. In this way, the database processes an application request in the context of the corresponding user's security context that is the same as the security context in the middle tier.