Shared Database Authorization Delegation Via Data Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Clients of computing service providers face challenges in managing access control and data integrity for shared databases, particularly in ensuring that data producers cannot arbitrarily add or remove data consumers, and preventing destructive operations on shared data without authorization.
Innovation Solution
Implementing a data exchange service to manage consumer access, allowing data producers to delegate authorization management, ensuring data integrity by preventing destructive operations, and maintaining a list of consumers unmodifiable by the data share service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the client maintains the authentication system directly, then access control can be managed, but the system complexity and maintenance burden increase for the client
Solution Approach 1:
The patent introduces an authentication service as an intermediary component that handles authorization management. The client application delegates consumer access management to this service, which maintains the authentication system separately. This resolves the contradiction by allowing the client to manage access control without directly maintaining the authentication system, thus reducing client complexity while preserving ease of operation through the mediating service.
2Adaptability or versatility
If the client allows direct access management, then flexibility is improved, but data integrity and security control worsen
Solution Approach 1:
The authentication service acts as a mediator between the client application and consumers, enforcing authorization rules and preventing unauthorized access. This maintains data integrity by controlling access through a dedicated security layer, while still providing flexibility as the client can define access policies without directly managing consumer connections. The service validates all access requests, ensuring security control is maintained.
Solution Approach 2:
The system segments authorization management from the client application by creating a separate authentication service. This separation allows the client to focus on business logic with flexible access policy definition, while the authentication service handles security enforcement and data integrity protection independently, resolving the contradiction between flexibility and reliability.
3Productivity
If consumers can directly communicate with the producer database engine, then access efficiency is improved, but fault tolerance and stability worsen
Solution Approach 1:
The authentication service serves as an intermediary layer between consumers and the producer database engine. Consumers communicate through this service rather than directly with the database engine, which maintains security control while enabling efficient data access. The service handles authentication and authorization checks, allowing productive data operations while protecting system stability through controlled access points.
4Ease of manufacture
If the authentication system is integrated with the client application, then ease of deployment is improved, but maintenance burden and system complexity increase
Solution Approach 1:
The authentication service is deployed as a separate intermediary component that the client application utilizes. This separation simplifies client deployment as the authentication logic is externalized, while the service itself can be maintained and updated independently. The client application integrates with the service through standardized interfaces, maintaining deployment simplicity while reducing the client's maintenance burden for the authentication system.
Data Source
AI summary
A system for delegation of authorization management of a shared database of a database service is described. The database service includes a control plane and a producer database engine. The producer database engine receives a creation request to create a datashare for a database. The creation request delegates, to a data exchange service, authorization management to access the datashare. The control plane is configured to update permission data for the datashare to indicate that authorization to the datashare is managed by the data exchange service. The producer database engine is further configured to receive a request, from a consumer database engine, to obtain metadata used to perform a query to the database of the datashare, determine that the data exchange service authorized the consumer database engine to access the datashare based on the permission data for the datashare, and return the metadata to the consumer database engine.