AsterionDB’s Zero-Trust Alignment

Topics for Further Discussion

Security

NoFS (No File System)

The NoFS (No File System) initiative lies at the heart of the AsterionDB Zero Trust Strategy. The legacy file system is the Achilles Heel of computer software design and it was never designed for security. We believe that it is time for the legacy file system to be replaced. AsterionDB turns the Oracle Database it into a virtual file system. This makes AsterionDB a platform with capabilities that are naturally aligned with the overall goals of the Zero-Trust architecture.

We move all user assets out of the file system and eliminate the reliance on static file names. This simple shift makes it impossible to search for content through the file system in advance of being granted access. This capability thwarts Ransomware and lateral discovery of file assets by hackers.

Single Point API

AsterionDB’s open-source project, DbTwig, is a middle-tier adapter that implements a single-point API. This condenses complex API signatures down to a single function call. We take advantage of the database’s built-in JSON capabilities to decompose the interface between the middle-tier and the data-layer to a function that takes and returns a JSON string.

This prevents discovery and probing of the API by intruders that connect from the middle-tier to the data-layer. Probing of the API will set off alarms and help to drive down the threshold between intrusion and detection.

Schema Visibility & Security

Working in conjunction with our Single Point API, we limit schema visibility to a minimum. This prevents intruders from discovering schema elements such as stored logic, tables, views, indexes, triggers and so-forth.

AsterionDB’s production implementation utilizes a proxy-user that can only see the Single-Point API while the owner of the schema objects is not allowed to create a connection to the database. This orientation allows us to take a minimalist approach to provisioning and secure the entire database environment by the DBA username and password only. Application updates are accomplished by connecting to the database as a DBA during audited, windowed, maintenance events.

Granular Security

By pushing all data and logic down to the data-layer and using our Single-Point API, we are able to ensure that there is no pathway to the data without going through the logic. This is the very essence of granular security.

We are able to implement logic to express any level of security required on an individual item basis. Furthermore, the DbTwig middle-tier adapter enforces a check of credentials before any API entry point is executed. This is one of the ways we are Secure-by-Design.

Apparatus Security

By limiting the role of middle-tier devices to being an elastic, security isolation and protocol transformation layer, our apparatus is more easily secured and audited. In addition, the lack of data and business logic resources in the middle-tier leaves nothing for an intruder to take advantage of.

AsterionDB can also act as a source-of-truth and single-point for securing and serving logic executed by the middle-tier.

Operations

Backup & Disaster Recovery

With all data and business logic in the database, backup and restore operations as well as disaster recovery procedures are greatly simplified. An added benefit is that the database operates the same on premises, in the cloud and at the edge. This allows for systems to be migrated between deployments models by merely backing up and restoring the database.

Scaling & Load Balancing

AsterionDB scales along four dimensions:

1. The power of the database (i.e. OCPU count)

2. The size of the database

3. The capabilities and number of middle-tier compute nodes

4. The network bandwidth allocated and number of load balancers

Consolidation, Convergence & Efficiency

AsterionDB’s consolidated and converged approach to system architecture is naturally efficient and cost effective. By increasing database storage to accommodate unstructured data, we allow multiple operational processes to be dovetailed into a unified procedure that manages data and logic as a whole.

A unlikely benefit is also realized by the fact that data in the AsterionDB paradigm does not move as a result of workflow state changes and so forth.

Taken altogether, AsterionDB’s consolidated and converged approach decreases:

• Hardware resources

• Person-hours for development, operations and maintenance

• Energy, HVAC & physical space requirements

• Network bandwidth

DevOps

Simplified Audit & Compliance

AsterionDB’s converged approach simplifies audit and compliance tasks by centralizing data and business logic. This makes it easy to verify data access pathways and credential requirements. Furthermore, our tight integration to the Oracle database makes features such as Data Labeling and Data Loss Prevention easily available to unstructured data.

Unified Data Fabric

In line with our NoFS initiative, AsterionDB is designed to be a more robust, capable and secure environment for sharing unstructured data among applications. AsterionDB has built-in capabilities such as multi-users, asset sharing, and discovery that makes it easy for applications to share data.

Simplified Deployment & Update

AsterionDB has the same deployment model in the cloud, on premises and at the edge. The database provides a majority of the infrastructure for AsterionDB and all requirements are easily fulfilled using standard software repositories. We utilize an Oracle Marketplace image that makes it easy to spin up compute nodes in a cookie-cutter fashion.

Data-Layer Business Logic

Expressing all business logic at the data-layer is a core capability of AsterionDB and key to our Zero-Trust Platform. This is what allows us to turn the middle-tier into a protocol transformation layer.

Presently, PL/SQL is the only language that allows for this approach although other languages can be incorporated in the future.

By placing all of the business logic in the database, we can ensure that there is no pathway to the data without going through the logic. This is essential to achieving granular security.

Extended Data-Layer Logical Capabilities

AsterionDB has the ability, through an integrated Plugin Server, to interface to external logic. This essentially allows us to make the database smarter. A smarter database can obviously a more capable database. Extended logical capabilities includes things such as:

• Metadata extraction

• AI/ML integration

• External device control

• Operational technology control

• Integration to foreign services

Use Cases

Horizontal Platform

AsterionDB is a horizontal software development platform. Unstructured data is pervasive throughout the software universe. It is growing at astronomical rates and is the favorite target of hackers and ransomware. AsterionDB can be used across all market segments and industry verticals.

AI/ML, Big Data, Cloud Migration, Device & Infrastructure Control

AsterionDB has been designed as an open, integration platform that makes it easy to integrate foreign technologies intro our Zero-Trust Platform. We can demonstrate the ability to trigger AI/ML processes, using Python, with all resources being stored and secured by the AsterionDB.

AsterionDB utilizes Object Storage in a unique way that can be directly leveraged in Big Data environments. We put Object Storage behind the database and use to provide hot, cold, frozen and deep-freeze data storage tiers.

For cloud migration projects, doing the work to transition file based data into AsterionDB makes the process of lifting and shifting to the cloud as simple as a database backup.

Leveraging AsterionDB’s extended logical capabilities, we can directly control the infrastructure around applications, external devices and complex machinery such as plasma cutters, CNC machines and robots.

Retrofit Existing Applications

Migrating legacy applications to a modern Zero-Trust posture is a challenge. This is largely driven by the fact that most Zero-Trust solutions have a cloud-native approach, focused on the network and perimeter, which is difficult for legacy applications to adapt to.

In contrast, AsterionDB looks and feels much like the legacy file system that existing applications largely rely upon. Migrating from the file-system to AsterionDB enables Zero-Trust at the data-layer.