US 2017/0323029 A1 · FINE-GRAINED DATABASE ACCESS-CONTROL POLICY ENFORCEMENT USING REVERSE QUERIES

Abstract

A method of providing access control to a database accessible from a user interface is implemented at a policy enforcement point, which is located between the database and the user interface and includes the steps of: (i) intercepting a database query; (ii) assigning attribute values on the basis of a target table or target column in the query, a construct type in the query, or the user or environment; (iii) partially evaluating an access-control policy defined in terms of said attributes, by constructing a partial policy decision request containing the attribute values assigned in step ii) and evaluating the access-control policy for this, whereby a simplified policy is obtained; (iv) deriving an access condition, for which the simplified policy permits access; and (v) amending the database query by imposing said access condition and transmitting the amended query to the database.

Claims20

Dependent claims

A method of providing access control (AC) in respect of a database storing information where the database is configured to accept a database query and return information extracted from the database,

the method being implemented at least in part at a policy enforcement point (PEP), which is located between the database and a database client, and comprising:
i) intercepting, at the PEP, a database query;
ii) assigning attribute values by performing at least one of the following:
ii-a) assigning a resource attribute value based on at least one target table or target column appearing in the query;
ii-b) assigning an action attribute value based on a construct type appearing in the query;
and
ii-c) assigning a subject and/or environment attribute value based on an identity of the user or on environment data;
iii) providing an attributed-based AC policy defined in terms of said attributes;
iv) deriving an access condition, for which the AC policy, when evaluated for the attribute value(s) assigned in step ii), evaluates to permit access;
and
v) amending the database query by imposing said access condition and
vi) transmitting the amended query to the database.

9 more elements

An access-controlled database system comprising a policy enforcement point (PEP), for providing access control (AC) in respect of a database storing information,

the PEP being adapted to be located between the database and a database client-where the database is configured to accept a database query and return information extracted from the database, and
the PEP comprising the following communicatively connected sections:
a communication interface for intercepting a database query;
and
attribute evaluating means for assigning attribute values by performing one of the following:
a) assigning a resource attribute value based on at least one target table or target column appearing in the query;
b) assigning an action attribute value based on a construct type appearing in the query;
and
c) assigning a subject and/or environment attribute value based on at least an identity of the user or on environment data,
wherein the communication interface is further adapted to transmit an amended query, resulting from imposing an access condition derived from an attribute-based AC policy on the basis of attribute values provided by the attribute evaluating means, to the database.

7 more elements

Dependencies are inferred from the claim text.

Fine-grained database access-control policy enforcement using reverse queries

Life of this patent

Fine-grained database access-control policy enforcement using reverse queries

Life of this patent

Abstract

Claims20