RU2676223C1 - Method for separating database objects based on privacy labels - Google Patents

Abstract

FIELD: data processing.SUBSTANCE: invention relates to data processing with an impact on the order of their location or on the content of the data being processed. Method for separating database objects based on privacy labels includes the steps of generating a privacy label for each object in the database, characterizing the level of confidentiality of the information contained in the object, form for each memory page, storing the database, the parameter, identifying the privacy group associated with the mentioned privacy labels, define a request to provide access to database objects containing data about the level of privacy, comparing the information received in the access request with the information contained in the said privacy labels, determine on the basis of the performed comparison of the privacy labels the corresponding one or more privacy groups and the associated memory pages of the storage device.EFFECT: technical result is an increase in the reliability of the DBMS and the prevention of unauthorized access to objects in the DB.9 cl, 3 dwg

Description

FIELD OF TECHNOLOGY

The technical solution relates to the field of digital data processing using electrical devices, namely, it considers a method and device for processing data with an impact on the order of their location or on the content of the processed data - a method for page-by-page separation of database records based on privacy labels in which each subject (user, process) one of the access levels is assigned, and each object (record) is assigned one of the privacy labels, privacy labels are divided into groups nN, each page of the memory device is assigned a group of confidentiality, each page can store only those objects (entries) that pertain to the designated privacy group.

BACKGROUND

The following database management systems are known in the art that support credential row-level access control: Oracle Database, PostgreSQL, Microsoft SQL Server.

- Oracle Database or Oracle RDBMS - an object-relational database management system from Oracle, providing multi-level data access control in the complement of Oracle Label Security).

- PostgreSQL - an open-source object-relational database management system that supports mandatory access control using the sepgsql downloadable module

- Microsoft SQL Server is a relational database management system (RDBMS) developed by Microsoft Corporation. Starting with SQL Server 2016, this DBMS provides row-level security.

The above products provide storage and use of privacy labels for database entries, store entries in pages on a storage device, but do not provide a mechanism for distributing records across pages of a storage device based on the values of the labels.

US 7539682 B2 “MultiIevel secure database”, patent holder of Microsoft Corporation, which, among other things, describes how to organize security at the row level (RLS) and at the cell level (cell level security (CLS), is known from the prior art). ) using DBMS representations. The method does not consider issues of the location of objects on the storage device.

The prior art is US 7240046 B2 “Row-level security in a relational database management system”, the patent holder of International Business Machines Corporation, which describes a system and method for controlling access to database objects based on security labels integrated into the record. The described system and method do not address the issues of placing objects on a storage device.

ESSENCE OF TECHNICAL SOLUTION

This technical solution is aimed at eliminating the disadvantages inherent in existing analogues.

The technical result from the use of this technical solution is to increase the reliability of the DBMS and prevent unauthorized access to objects in the database.

This technical result is achieved due to the group processing of the page of the storage device based on information about the assigned privacy group.

In one of the preferred embodiments, a method is proposed for separating database objects based on confidentiality labels, characterized in that: generate a confidentiality label for each object in the database characterizing the level of confidentiality of information contained in the object; form for each memory page of the storage device storing the database, a parameter identifying the privacy group associated with the said privacy labels, and each memory page stores only those database objects that belong to the assigned privacy group; determine a request for providing access to database objects containing data on the level of confidentiality; comparing the information received in the access request with the information contained in the said privacy labels; determine, based on the comparison of the privacy labels, the corresponding one or more privacy groups and the associated memory pages of the storage device.

During the operations of creating new database objects, the free pages of the memory of the storage device with the corresponding privacy group are searched, if there are no pages of memory that satisfy this condition, then an empty memory page is allocated to which the necessary group is assigned, and a new database object is written to it. .

During the operations of creating new database objects, the free pages of the memory of the storage device with the corresponding privacy group are searched and a new database object is recorded in the found memory page of the storage device.

During operations, changes to an object already stored in the database determine the possibility of changing the confidentiality label of this object before this operation.

The composition of privacy groups can be adapted taking into account accumulated statistics on the frequency of use of specific access tags.

Each privacy group can consist of only one value.

The write operation of an object already stored in the database is not a single operation and is carried out as sequential operations of deleting the old object and inserting a new one with updated data.

This technical solution can be made in the form of a system for separating database objects based on confidentiality labels, containing: at least one command processing device; at least one data storage device; one or more computer programs loaded into at least one of the aforementioned data storage devices and executed on at least one of the aforementioned command processing devices, while one or more computer programs contain the following instructions: generate for each object in the database data confidentiality label, characterizing the level of confidentiality of information contained in the object; form for each memory page of the storage device storing the database, a parameter identifying the privacy group associated with the said privacy labels, and each memory page stores only those database objects that belong to the assigned privacy group; determine a request for providing access to database objects containing data on the level of confidentiality; comparing the information received in the access request with the information contained in the said privacy labels; determine, based on the comparison of the privacy labels, the corresponding one or more privacy groups and the associated memory pages of the storage device.

During the operations of creating new database objects, the free pages of the memory of the storage device with the corresponding privacy group are searched, if there are no pages of memory that satisfy this condition, then an empty memory page is allocated to which the necessary group is assigned, and a new database object is written to it. .

During the operations of creating new database objects, the free pages of the memory of the storage device with the corresponding privacy group are searched and a new database object is recorded in the found memory page of the storage device.

During operations, changes to an object already stored in the database determine the possibility of changing the confidentiality label of this object before this operation.

The composition of privacy groups can be adapted taking into account accumulated statistics on the frequency of use of specific access tags.

Each privacy group can consist of only one value.

The write operation of an object already stored in the database is not a single operation and is carried out as sequential operations of deleting the old object and inserting a new one with updated data.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 - page structure on a storage device indicating groups and privacy labels;

FIG. 2 is a flowchart illustrating a recording of a new object using a method for separating database objects based on privacy labels;

FIG. 3 is a system for implementing a method for separating database objects based on privacy labels.

DETAILED DESCRIPTION OF THE TECHNICAL SOLUTION

In this device, a system means a computer system, a computer (electronic computer), CNC (numerical program control), PLC (programmable logic controller), computerized control systems, and any other devices that can perform a given, clearly defined sequence of operations (actions, instructions).

By a command processing device is meant an electronic unit or an integrated circuit (microprocessor) that executes machine instructions (programs).

The command processing device reads and executes machine instructions (programs) from one or more data storage devices. Data storage devices may include, but are not limited to, hard disks (HDDs), flash memory, ROM (read only memory), solid state drives (SSDs), and optical drives.

Below we will consider some terms that will be used later in the description of the technical solution.

A program is a sequence of instructions intended for execution by a control device of a computer or a device for processing commands.

Database, database - a set of independent materials (articles, calculations, normative acts, court decisions and other similar materials) presented in an objective form, systematized in such a way that these materials can be found and processed using an electronic computer (computer).

Database management system, Database Management System, DBMS, DBMS - a set of software and linguistic tools for general or special purposes, providing management of the creation and use of databases.

Storage device, memory - a device designed to record and store data.

Mandatory access control, mandatory access control, MAC - differentiation of subjects' access to objects, based on the assignment of a confidentiality label for the information contained in the objects, and the issuance of official permissions (admission) to subjects to access information of this level of confidentiality. Also sometimes translated as forced access control.

Row Level Security or row-level security is a mechanism for delimiting access to information to the database, which allows users to restrict access to individual rows in tables.

Multilevel security, multilevel protection - protection that provides access control for subjects with different access rights to objects of different privacy levels.

Record - a set of values of various types, intended for storage on the memory.

Access object (Object, Access object) - a unit of information resource of an automated system, access to which is regulated by the rules of access control.

Access subject (Subject, Access subject) - a person or process whose actions are governed by the rules of access control.

The pages of the storage device are blocks of a fixed size into which the memory of the memory is divided.

This technical solution provides an increase in the reliability of the DBMS and the prevention of unauthorized access to objects in the database due to the group processing of the page of the storage device based on information about the assigned privacy group.

According to the proposed technical solution, the method for separating database objects based on confidentiality labels is to perform the following steps.

First, a privacy label is generated for each object in the database, characterizing the level of confidentiality of the information contained in the object. The labels directly record on the disk / memory, i.e. access levels are a characteristic of this data. Labels can be represented by a pair of values in the range from 1 to 16: data reading level (RAL) and data access level (WAL). The label is assigned when the object is created and updated when it is modified based on the access level of the subject who created this object.

The presentation of the access token is not restrictive.

Each subject (user, process) is assigned one of the access levels. Access levels are introduced to verify the rights of subjects to read / write information at the DBMS kernel level. The access level can be represented by a pair of numerical values in the range from 1 to 16: the read access level - RAL (Read Access Level) and the write access level - WAL (Write Access Level), which display the current restrictions on the actions associated with the corresponding operation.

Access levels for subjects are assigned by the subject with the corresponding role (for example, the security administrator can assign access levels to other users).

The presentation of the access level is not restrictive.

Then, a parameter identifying a confidentiality group associated with said confidentiality labels is formed for each memory page of the storage device storing the database, and each memory page stores only those database objects that belong to the assigned privacy group.

The subject's appeal to the object is regulated by the DBMS in accordance with the access control and management model, which is not restrictive. Such a model, for example, may be the Bell-LaPadula Model (BLP).

The allocation and release of memory pages is regulated by the DBMS in accordance with the space management rules of the memory, which are not limiting. Space management can be based, for example, on the use of a page fill threshold.

In FIG. 1 shows pages (102, 103, 104) on a storage device (101). Pages 103 and 104 are detailed in 103 'and 104' Page 103 'has an assigned privacy group (105) that allows you to contain objects (107, 108) with only the label s0 (105). Page 104 'has an assigned privacy group (106) that allows you to contain objects (109, 110) with only labels s0 and s1 (106).

The DBMS stores information about the assigned privacy group for each page.

DBMS divides objects only by actually existing privacy groups. Those. if, for example, records with WAL: RAL = 5: 5 and with WAL: RAL = 10: 10 exist in the database, then these two groups will be used. When a record appears with an excellent label value, a third group will be created, etc.

Separation of records occurs at the stage of their creation, because, - at this moment the label is assigned. A record modification is considered as a pair of operations: deleting the old and recording is new, i.e. the label (and group) may change.

Next, a request for providing access to database objects containing data on the level of confidentiality is determined.

After that, the information obtained in the access request is compared with the information contained in the said privacy labels.

All requests of the subject to read or write the object of the DBMS are checked for compliance with the adopted access model, and only in the case of a positive decision on the permission of the operation do they refer to the page of the memory.

For write operations for new objects, the DBMS searches for free pages with the corresponding confidentiality group, if there are no pages that satisfy this condition, then a blank page without records is selected, to which the necessary group is assigned. The found or highlighted page is recorded.

As a particular example in FIG. 2 is a flowchart illustrating a recording of a new object. Decision (203) on allowing or prohibiting an operation is made in accordance with the access control and management model, and a new page (207) is allocated in accordance with the rules for managing storage space.

Based on the comparison of the privacy labels, the corresponding one or more privacy groups and the associated memory pages of the storage device are determined.

For write operations of an object already stored in the database (including its deletion), the DBMS determines whether the operation will change the privacy label so that its new value does not correspond to the current page privacy group, and also applies storage space management rules. If the changed object cannot be located on the current page, then a new page is searched in a manner similar to the page search for new objects, the record is transferred to the found or selected page.

All further results are achieved due to physically separate storage of records with different groups / access tags in different pages, which allows you to apply batch processing of memory pages.

Batch processing of pages of the storage device thus includes:

- making a decision on the prohibition or permission to read or write an object on a page based on a confidentiality group without the need to read directly the records, i.e. when requesting to read a record from a page, it is possible to read the page title first, and if the reader level does not correspond to the group, then stop the operation as it is obviously impossible;

- the ability to conduct various audit mechanisms for pages with different privacy groups; for example, if there are only two groups in the database - “secret” and “not secret”, then for pages “not secret” you can disable audit completely.

- the ability to store pages with different privacy groups on different media, i.e., for example, you can store more valuable groups of pages on more reliable and / or protected media.

- the ability to use separate caching mechanisms for pages of different groups, i.e., for example, you can disable caching for pages with valuable data by removing residual traces of data in RAM.

According to FIG. 3, an exemplary system for implementing a technical solution includes a data processing device 300. The data processing device 300 can be configured as a client, server, mobile device, or any other computing device that interacts with data in a network-based collaboration system. In the most basic configuration, the data processor 300 typically includes at least one processor 301 and a data storage device 302. Depending on the exact configuration and type of computing device, system memory 302 may be volatile (e.g., random access memory (RAM, RAM)), non-volatile (for example, read-only memory (ROM)), or some combination thereof. The data storage device 302 typically includes one or more application programs 303 and may include program data 304. The present technical solution as a method described in detail above is implemented in application programs 303.

The data processing device 300 may have additional features or functionality. For example, the data processing device 300 may also include additional data storage devices (removable and non-removable), such as, for example, magnetic disks, optical disks, or tape. Such additional storages are illustrated in FIG. 3 through non-removable storage 307 and removable storage 308. Computer storage media may include volatile and non-volatile, removable and non-removable media implemented in any way or using any technology for storing information. A storage device 302, a non-removable storage 307, and a removable storage 308 are examples of computer storage media. Computer storage media includes, but is not limited to, random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact ROM a disc (CD-ROM), universal digital disks (DVDs) or other optical storage devices, magnetic tapes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that may be used on to store the desired information and which can be accessed by the data processing device 300. Any such computer storage medium may be part of the device 300. The data processing device 300 may also include an input device (a) 305, such as a keyboard, mouse, pen , a voice input device, a touch input device, and so on. Output device (a) 306, such as a display, speakers, printer, and the like, may also be included in the device.

The data processing device 300 includes communication connections that allow the device to communicate with other computing devices, for example over a network. Networks include local area networks and wide area networks along with other large, scalable networks, including, but not limited to, corporate networks and extranets. Communication connection is an example of a communication environment. Typically, a communication medium can be implemented using computer-readable instructions, data structures, program modules or other data in a modulated information signal, such as a carrier wave, or in another transport mechanism, and includes any information delivery medium. The term "modulated information signal" means a signal, one or more of its characteristics are changed or set in such a way as to encode information in this signal. By way of example, but without limitation, communication media include wired media such as a wired network or a direct wired connection, and wireless media such as acoustic, radio frequency, infrared, and other wireless media. The term “machine-readable medium”, as used herein, includes both storage media and communication media.

Claims (17)

1. The method of separating database objects based on confidentiality labels, characterized in that: • generate for each object in the database a confidentiality label characterizing the level of confidentiality of the information contained in the object; • form for each memory page of the storage device storing the database, a parameter identifying the privacy group associated with the said privacy labels, and each memory page stores only those database objects that belong to the assigned privacy group; • define a request for providing access to database objects containing data on the level of confidentiality; • compare the information received in the access request with the information contained in the said privacy labels; • determine, based on the comparison of the privacy labels, the corresponding one or more privacy groups and the associated memory pages of the storage device. 2. The method according to p. 1, characterized in that during the operations of creating new database objects, a search is made for free pages of the memory of the storage device with the corresponding privacy group, if there is not a single page of memory that satisfies this condition, then an empty memory page is allocated, which is assigned necessary group, and a new database object is written to it. 3. The method according to claim 1, characterized in that during the operations of creating new database objects, a search is made for free pages of the memory of the storage device with the corresponding privacy group, and a new database object is recorded in the found memory page of the storage device. 4. The method according to claim 1, characterized in that during the operations of changing an object already stored in the database, it is possible to change the confidentiality label of this object before this operation. 5. The method according to claim 1, characterized in that the composition of the privacy groups can be adapted taking into account the accumulated statistics on the frequency of use of specific access tags. 6. The method according to p. 1, characterized in that each of the privacy groups can consist of only one value. 7. The method according to claim 1, characterized in that the write operation of an object already stored in the database is not a single operation and is performed as sequential operations of deleting an old object and inserting a new one with updated data. 8. A system for separating database database objects based on confidentiality labels, comprising: • at least one command processing device; • at least one data storage device; • one or more computer programs loaded into at least one of the aforementioned data storage devices and executed on at least one of the aforementioned command processing devices, wherein one or more computer programs contain instructions for performing the method according to any one of claims. 1-7. 9. A machine-readable storage medium containing machine-readable instructions executed by one or more processors, which, when executed, implement a method for separating database database objects based on privacy labels according to any one of paragraphs. 1-7.

Images