Two-Person Rule Enforcement for Backup Database Configuration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data management systems face challenges in preventing unauthorized users from making sensitive changes, as access schemes can be bypassed by creating fraudulent accounts or accessing compromised accounts, leading to potential data loss or corruption.
Innovation Solution
Implementing a two-person rule (TPR) enforcement layer that combines role-based access control (RBAC) with a separate user hierarchy, where sensitive actions require approval from a second user group, preventing unauthorized changes and ensuring independent management hierarchies for the first and second user groups.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If role-based access control (RBAC) schemes are used to control user permissions, then access security is improved, but users can bypass these schemes by creating fraudulent accounts or accessing compromised accounts
Solution Approach 1:
The patent divides the user hierarchy into two independent segments: a first user hierarchy with RBAC permissions and a second user hierarchy with TPR approval authority. This segmentation prevents a single compromised account from bypassing security, as both hierarchies must be compromised simultaneously for unauthorized access to occur.
Solution Approach 2:
The patent introduces a two-person rule (TPR) approval mechanism as an intermediary layer between the user's RBAC permissions and the execution of sensitive actions. This intermediary requires a second user's approval, creating an additional security checkpoint that prevents unauthorized actions even if the first user's account is compromised.
2Reliability
If a two-person rule (TPR) enforcement layer is implemented combining RBAC with a separate user hierarchy, then security against unauthorized changes is improved, but system complexity increases
Solution Approach 1:
The patent segments the access control system into two independent user hierarchies with distinct roles and permissions. The first hierarchy handles routine operations while the second hierarchy provides oversight for sensitive actions. This segmentation manages complexity by creating clear, separate authorization paths rather than a single complex permission matrix.
Solution Approach 2:
The patent adds a second dimension to the access control system by introducing a vertical approval hierarchy that operates independently from the horizontal RBAC permission structure. This dimensional addition transforms the security model from flat permissions to a multi-layered authorization framework, managing complexity through structured layers.
Data Source
AI summary
A method for updating configuration settings of a backup database supported by a data management system is described. The method may include receiving, from a first user in a first user group, a request to update configuration settings of the backup database. The method may further include determining that the first user is authorized to update the configuration settings of the backup database based on a set of permissions associated with the first user. The method may further include identifying a second user in a second user group that is authorized to approve the request from the first user. The method may further include transmitting an indication of the request to the second user and receiving a notification that the second user has approved the request from the first user. The method may further include updating the configuration settings of the backup database in response to the notification.