You could create a proxy, but then you've simply changed the problem from "controlling access to the database" to "controlling access to the proxy".

...although you seem ok with having a child do the connecting, so you could pass a random token generated by the child to the parent to serve to authenticate the connection to the child. It's a pity that DBD::Proxy doesn't require any authentication, but maybe you could edit it to your needs.

...although DBD::Proxy's cipher options might do the trick.

Update: Added second paragraph.
Update: Added third paragraph.