Centralized access control for cloud relational database management system resources

Patent metadata

Field	Value
Publication number	US-12259992-B2
Application number	US-202418428402-A
Country	US
Kind code	B2
Filing date	Jan 31, 2024
Priority date	May 27, 2021
Publication date	Mar 25, 2025
Grant date	Mar 25, 2025

Abstract

Methods for centralized access control for cloud relational database management system resources are performed by systems and devices. The methods utilize a central policy storage, managed externally to database servers, which stores external policies for access to internal database resources at up to fine granularity. Database servers in the processing system each receive external access policies that correspond to users of the system by push or pull operations from the central policy storage, and store the external access policies in a cache of the database servers for databases. For resource access, access conditions are determined via policy engines of database servers based on an external access policy in the cache that corresponds to a user, responsive to a resource access request from a device of the user specifying the internal resource. Data associated with the resource is provided to the user based on the access condition being met.

First claim

What is claimed is:

1. A method comprising:
providing, from a central policy storage to a first database server located remotely from the central policy storage, an external access policy corresponding to access conditions for a user to access resources of the first database server;
providing, to an administrator device, a user interface (UI) portal comprising a policy management options for creation and modification of the external access policy;
receiving, at the central policy storage, information associated with at least one of a policy creation or a policy modification provided via the UI portal for the external access policy;
updating, at the central policy storage, the external access policy based on the received information; and
providing, to the first database server, the updated external access policy to enable the first database server to update the access conditions for the user to access resources of the first database server.

2. The method of claim 1 , wherein said providing, to the first database server, the updated external access policy comprises:
pushing the updated external policy to the first database server in response to a periodicity condition being met at the central policy storage.

3. The method of claim 2 , wherein the periodicity condition is based on an amount of time that has elapsed since a policy pull request was issued by the first database server.

4. The method of claim 1 , wherein the external access policy comprises a granular access policy corresponding to at least one of a database server, a database, a database schema, a database table, a column of data, a database object, or a database-related operation.

5. The method of claim 1 , wherein the method further comprises:
provide, to a second database server that shares the centralized policy storage with the first database server, the updated external access policy to enable the second database server to update the access conditions for the user to access resources of the second database server,
wherein the user is enabled to perform operations associated with the external access policy on resources of the first database server and the second database server as defined by the scope of the external access policy.

6. The method of claim 1 , wherein the updated external access policy comprises security rules represented as a data structure comprising a plurality of nodes, each node in the data structure comprising an expression which can be evaluated to a Boolean value.

7. The method of claim 6 , wherein the data structure comprises at least one of a hierarchical data structure, or a tree data structure, and the data structure enables the first database server to allow or deny access to the internal resources of the first database server by recursively iterating over the data structure to determine a Boolean value of a root node of the data structure.

8. A system comprising:
a processor; and
a memory that stores program instructions that, when executed by the processor, cause the processor to:
provide, from a central policy storage to a first database server located remotely from the central policy storage, an external access policy corresponding to access conditions for a user to access resources of the first database server;
provide, to an administrator device, a user interface (UI) portal comprising a policy management options for creation and modification of the external access policy;
receive, at the central policy storage, information associated with at least one of a policy creation or a policy modification provided via the UI portal for the external access policy;
update, at the central policy storage, the external access policy based on the received information; and
provide, to the first database server, the updated external access policy to enable the first database server to update the access conditions for the user to access resources of the first database server.

9. The system of claim 8 , wherein, to provide the updated external access policy to the first database server, the program instructions, when executed by the processor, cause the processor to push the updated external policy to the first database server in response to a periodicity condition being met at the central policy storage.

10. The system of claim 9 , wherein the periodicity condition is based on an amount of time that has elapsed since a policy pull request was issued by the first database server.

11. The system of claim 8 , wherein the program instructions, when executed by the processor, cause the processor to:
provide, to a second database server that shares the centralized policy storage with the first database server, the updated external access policy to enable the second database server to update the access conditions for the user to access resources of the second database server,
wherein the user is enabled to perform operations associated with the external access policy on resources of the first database server and the second database server as defined by the scope of the external access policy.

12. The system of claim 8 , wherein the external access policy comprises a granular access policy corresponding to at least one of a database server, a database, a database schema, a database table, a column of data, a database object, or a database-related operation.

13. The system of claim 8 , wherein the updated external access policy comprises security rules represented as a data structure comprising a plurality of nodes, each node in the data structure comprising an expression which can be evaluated to a Boolean value.

14. The system of claim 13 , wherein the data structure comprises at least one of a hierarchical data structure, or a tree data structure, and the data structure enables the first database server to allow or deny access to the internal resources of the first database server by recursively iterating over the data structure to determine a Boolean value of a root node of the data structure.

15. A computer-readable storage medium having program instructions recorded thereon that, when executed by a processor, cause the processor to:
provide, from a central policy storage to a first database server located remotely from the central policy storage, an external access policy corresponding to access conditions for a user to access resources of the first database server;
provide, to an administrator device, a user interface (UI) portal comprising a policy management options for creation and modification of the external access policy;
receive, at the central policy storage, information associated with at least one of a policy creation or a policy modification provided via the UI portal for the external access policy;
update, at the central policy storage, the external access policy based on the received information; and
provide, to the first database server, the updated external access policy to enable the first database server to update the access conditions for the user to access resources of the first database server.

16. The computer-readable storage medium of claim 15 , wherein, to provide the updated external access policy to the first database server, the program instructions, when executed by the processor, cause the processor to push the updated external policy to the first database server in response to a periodicity condition being met at the central policy storage.

17. The computer-readable storage medium of claim 16 , wherein the periodicity condition is based on an amount of time that has elapsed since a policy pull request was issued by the first database server.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Wang Yueren
• Degefa Elnata
• Wolter Andreas
• Gott Steven Richard
• Gupta Nitish
• Kaushik Raghav
• Khanduja Rakesh
• Ahmad Shafi
• Arumugam Dilli Dorai Minnal
• Naik Pankaj Prabhakar
• Ogg Nikolas Christopher

Classifications

• G06F2212/45

  Caching of specific data in cache memory · CPC title

• G06F15/17331

  Distributed shared memory [DSM], e.g. remote direct memory access [RDMA] · CPC title

• G06F12/0875

  with dedicated cache, e.g. instruction or stack · CPC title

• G06F16/9574

  of access to content, e.g. by caching · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title