Subfield Access Control via Intermediary Policy Layer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional database access control methods lack granularity and portability, often requiring in-database programming or application logic to manage access to compound structures, which can be non-transparent and inflexible.
Innovation Solution
A policy system that generates access control metadata from database schemas, intercepts queries, and modifies them to enforce rules on subfields, providing a modular and portable way to manage access control without changing database or application code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If conventional database access control methods are used at the data column level, then implementation is simple, but access control granularity is coarse and cannot protect individual subfields
Solution Approach 1:
The patent segments the data column into multiple subfields and creates separate access control rules for each subfield. The schema analyzer divides the compound data structure into atomic subfields, and the policy enforcer applies granular access control to each subfield independently, enabling fine-grained control without requiring complex in-database programming.
Solution Approach 2:
The patent introduces a policy system as an intermediary layer between the application and the database. This middle layer includes a schema analyzer, policy compiler, and policy enforcer that handle access control logic externally, avoiding the need for complex in-database triggers or stored procedures while achieving fine-grained subfield-level control.
2Manufacturing precision
If database triggers or application logic are used for fine-grained access control on subfields, then access control granularity is improved, but portability decreases and code becomes non-portable
Solution Approach 1:
The policy system acts as a portable intermediary that can be deployed with the database schema without modifying the database structure or application code. Access control policies are defined in a declarative format that can be migrated across different database systems, ensuring portability while maintaining fine-grained control capability.
Solution Approach 2:
The patent copies the access control logic from the application layer to an independent policy layer. Instead of embedding access control logic in application code or database triggers, the system uses external policy definitions that can be replicated and applied across different environments, improving portability and maintainability.
3Reliability
If in-database programming is used for access control, then access control can be enforced, but the system becomes less flexible and harder to maintain
Solution Approach 1:
The policy enforcer serves as an intermediary that translates high-level policy definitions into database-specific operations. This separation allows policies to be maintained independently from database implementation details, improving maintainability while ensuring reliable enforcement through the intermediate translation layer.
Solution Approach 2:
The schema analyzer automatically analyzes the database schema and generates the necessary access control metadata and policy implementations. This automation reduces manual configuration effort and ensures consistency between schema changes and access control policies, improving both reliability and ease of maintenance.
4Reliability
If application logic is used to enforce access control, then access control can be implemented, but data access control policies become coupled with application logic
Solution Approach 1:
The policy system introduces a dedicated intermediary layer that handles access control enforcement separately from application logic. The policy enforcer intercepts and modifies queries before they reach the database, ensuring that access control policies are enforced independently while maintaining clean separation between application functionality and security policies.
Data Source
AI summary
Systems, computer program products and methods implementing access control for compound structures including subfields are described. A policy system receives a database schema and a data access policy. The database schema defines multiple subfields of a data column. The policy includes one or more rules limiting access to the subfields. A policy analyzer of the policy system creates an access control metadata that stores correspondence between the subfields and the rules. The policy analyzer represents the subfields in the access control metadata using relations between subfields and other components of the database. The policy analyzer provides the access control metadata to a policy enforcer for enforcing the policy on the subfields.