Unified Access Control for Federated Database Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional federated database systems lack fine-grained access control, providing uniform access rights to all users and are not suitable for big data systems, requiring individual configuration in each database and lacking built-in access control mechanisms.
Innovation Solution
A unified access control system for federated databases, comprising a query parser, planner, central access controller, physical query generator, and executor, which parses and verifies queries against central authorization metadata to enforce table, column, and row-level access controls, allowing different users to have varying access rights and applying filters or restrictions as needed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional federated database systems use uniform access control for all users, then implementation is simple, but fine-grained access control capability is lacking
Solution Approach 1:
The patent segments access control into multiple levels: database level, schema level, table level, column level, and row level. Each level has its own authorization metadata and control policies, allowing fine-grained control while maintaining systematic organization. The segmentation enables different granularities of access control without requiring complete redesign of the access control mechanism.
Solution Approach 2:
The patent introduces a new dimension of access control by adding authorization metadata tables that store access rights information separately from the physical database structure. This dimensional addition allows access control policies to be defined and enforced independently, enabling fine-grained control without affecting the underlying database architecture.
2Adaptability or versatility
If access control is configured in each respective database individually, then each database can have customized control, but system complexity increases
Solution Approach 1:
The patent creates a universal access control mechanism that works across multiple heterogeneous databases through the federated database system. The centralized authorization metadata and unified access control logic provide multi-functional capability, serving different database types with a single system rather than requiring separate configuration for each database.
Solution Approach 2:
The federated database system acts as an intermediary between users and underlying physical databases. It maintains centralized authorization metadata and enforcement logic, mediating all access requests before they reach the physical databases. This intermediary role simplifies configuration by centralizing access control management while still enabling customized control policies for different databases.
3Ease of manufacture
If conventional federated databases lack built-in access control mechanisms, then underlying databases can be accessed directly, but security and governance are compromised
Solution Approach 1:
The patent implements preliminary action by establishing access control policies and authorization metadata before any data access occurs. The system pre-defines access rights at multiple levels (database, schema, table, column, row) and enforces these policies before queries are executed on physical databases, ensuring security and governance are built-in rather than added afterward.
Solution Approach 2:
The federated database system serves as an intermediary layer between users and physical databases, implementing built-in access control mechanisms. It maintains authorization metadata and enforcement logic, intercepting and filtering access requests before they reach the underlying databases. This intermediary mechanism provides security and governance without preventing direct access to the databases when properly authorized.
Data Source
Figure 1(a)
Figure 1(b)
Figure 2
AI summary
A system, a method, and a device for unified access control on federated database are disclosed. A federated system(1300) to provide a unified access control for the data stored in federated databases is disclosed. The federated system(1300) comprises at least one central access controller(1312) configured to receive at least one query plan generated; verify the query plan generated against at least one user right pre-stored in at least one central authorization metadata table, a table and an associated column name from the query plan are verified; update, if the user right pre-stored allow access to the query plan verified, the query plan generated; convert the query plan updated to at least one physical query for execution by at least one database; and execute the physical query to return at least one result for the federated query received.