Centralized access control for cloud relational database management system resources

Patent metadata

Field	Value
Publication number	US-11934548-B2
Application number	US-202117401165-A
Country	US
Kind code	B2
Filing date	Aug 12, 2021
Priority date	May 27, 2021
Publication date	Mar 19, 2024
Grant date	Mar 19, 2024

Abstract

Methods for centralized access control for cloud relational database management system resources are performed by systems and devices. The methods utilize a central policy storage, managed externally to database servers, which stores external policies for access to internal database resources at up to fine granularity. Database servers in the processing system each receive external access policies that correspond to users of the system by push or pull operations from the central policy storage, and store the external access policies in a cache of the database servers for databases. For resource access, access conditions are determined via policy engines of database servers based on an external access policy in the cache that corresponds to a user, responsive to a resource access request from a device of the user specifying the internal resource. Data associated with the resource is provided to the user based on the access condition being met.

First claim

What is claimed is:

1. A system that comprises:
a memory that stores program instructions; and
a processing system, comprising at least one processor, configured to execute the program instructions that, when executed, cause the processing system to:
receive at each of a plurality of database servers in the system, from a central policy storage managed externally to the plurality of database servers, a plurality of external access policies that correspond to users;
in response to receiving the plurality of external access policies, store at each of the plurality of database servers, in a cache of a respective database, the plurality of external access policies that are received;
responsive to a resource access request received from a device of a user that specifies a resource internal to the database server, determine an access condition via a policy engine of one of the database servers, based at least on one of the plurality of external access policies and one of a plurality of internal access policies;
determine that both the one of the plurality of external access policies and the one of the plurality of internal access policies indicate a grant of access; and
provide data associated with the resource to the device of the user based at least on the access condition being met to access the resource.

2. The system of claim 1 , wherein the plurality of internal access policies and the plurality of external access policies are stored in a hierarchical data structure in the cache.

3. The system of claim 2 ,
wherein the program instructions, when executed, cause the processing system to:
responsive to another resource access request received from another device of another user that specifies the resource or another resource internal to the database server, determine another access condition via the policy engine of one of the database servers, based at least on another one of the plurality of external access policies and another one of the plurality of internal access policies; and
deny access of the other device of the other user to the data associated with the resource or to other data associated with the other resource based at least on the access condition being unmet by at least the other one of the plurality of internal access policies or the other one of the plurality of external access policies.

4. The system of claim 1 , wherein the program instructions, when executed, cause the processing system to:
provide, over a network from the one of the database servers, a policy pull request to the central policy storage based on one or more of:
a starting or restarting of the one of the database servers;
a periodicity condition; or
a failover condition;

wherein the policy pull request specifies provision of the plurality of external access policies to the one of the database servers.

5. A system that comprises:
a memory that stores program instructions;
a central policy storage; and
a processing system, comprising at least one processor, configured to execute the program instructions that, when executed, cause the processing system to:
receive at each of a plurality of database servers in the system, from the central policy storage managed externally to the plurality of database servers, external access policies that correspond to users, wherein the users comprise a directory of the system;
store at each of the plurality of database servers, in a cache of a respective database, the access policies that are received;
determine an access condition via a policy engine of one of the database servers, based at least on one of the external access policies, stored in the cache, which corresponds to a user, responsive to a resource access request received from a device of the user that specifies a resource internal to the database server;
provide data associated with the resource to the device of the user based at least on the access condition being met to access the resource;
provide, to an administrator device, a user interface (UI) portal having a policy management portion comprising creation and modification options for the external access policies;
receive, at the central policy storage, information associated with a policy creation, or a policy modification, for the external access policies via the UI portal;
update the external access policies at the central policy storage based on the information; and
provide the external access policies that are updated to the plurality of database servers.

6. The system of claim 1 , wherein one or more of the plurality of external access policies comprise a granular access policy corresponding to at least one of a database server, a database, a database schema, a database table, a column of data, a database object, or a database-related operation.

7. A method performed by a computing system, the method comprising:
receiving at each of a plurality of database servers in the system, from a central policy storage managed externally to the database server, a plurality of external access policies that correspond to users;
in response to said receiving, storing at each of the plurality of database servers, in a cache of a respective database, the plurality of external access policies that are received;
responsive to a resource access request received from a device of a user that specifies a resource internal to the database server, determining an access condition via a policy engine of one of the database servers, based at least on one of the plurality of external access policies and one of a plurality of internal access policies;
determining that both the one of the plurality of external access policies and the one of the plurality of internal access policies indicate a grant of access; and
providing data associated with the resource to the device of the user based at least on the access condition being met to access the resource.

8. The method of claim 7 , wherein the plurality of internal access policies and the plurality of external access policies are stored in a hierarchical data structure in the cache.

9. The method of claim 8 ,
wherein the method further comprises:
responsive to another resource access request received from another device of another user that specifies the resource or another resource internal to the database server, determining another access condition via the policy engine of one of the database servers, based at least on another one of the plurality of external access policies and another one of the plurality of internal access policies; and
denying access of the other device of the other user to the data associated with the resource or to other data associated with the other resource based at least on the access condition being unmet by at least the other one of the plurality of internal access policies or the other one of the plurality of external access.

10. The method of claim 7 , further comprising:
providing, over a network from the one of the database servers, a policy pull request to the central policy storage based on one or more of:
a starting or restarting of the one of the database servers;
a periodicity condition; or
a failover condition;

wherein the policy pull request specifies provision of the plurality of external access policies to the one of the database servers.

11. A method performed by a computing system, the method comprising:
receiving at each of a plurality of database servers in the system, from a central policy storage managed externally to the database server, external access policies that correspond to users;
storing at each of the plurality of database servers, in a cache of a respective database, the access policies that are received;
determining an

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Wang Yueren
• Degefa Elnata
• Wolter Andreas
• Gott Steven Richard
• Gupta Nitish
• Kaushik Raghav
• Khanduja Rakesh
• Ahmad Shafi
• Arumugam Dilli Dorai Minnal
• Naik Pankaj Prabhakar
• Ogg Nikolas Christopher

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F12/0875

  with dedicated cache, e.g. instruction or stack · CPC title

• G06F15/17331

  Distributed shared memory [DSM], e.g. remote direct memory access [RDMA] · CPC title

• G06F16/9574

  of access to content, e.g. by caching · CPC title

• G06F2212/45

  Caching of specific data in cache memory · CPC title