Devices and methods for controlling access to a database
Patent Information
- Application Number
- EP2023715834
- Authority / Receiving Office
- EP · EP
- Patent Type
- Applications
- Current Assignee / Owner
- Filing Date
- 2023-03-29
- Publication Date
- 2025-12-31
AI Technical Summary
Remote databases storing security-sensitive data are vulnerable to various attacks, such as SQL injection and insider threats, due to inadequate access control mechanisms.
A data processing apparatus and method that receive and evaluate user query requests against predefined query patterns associated with user identities, allowing or blocking requests based on compliance, and adjusting patterns dynamically to enhance security.
Effectively controls access to sensitive data by ensuring legitimate queries are executed while blocking malicious or unauthorized requests, thereby enhancing database security and detecting potential threats.
Smart Images
Figure EP2023058079_03102024_PF_FP_ABST
Abstract
Description
[0001] Devices and methods for controlling access to a database
[0002] TECHNICAL FIELD
[0003] The present disclosure relates to data storage. More specifically, the present disclosure relates to devices and methods for controlling access to a database.
[0004] BACKGROUND
[0005] Remote data storage is becoming more and more popular, because it allows user devices, which can usually store only a limited amount of data, to save data and files in one or more remote databases that can be accessed either through the public internet or a dedicated private network connection. For instance, a cloud storage provider may host, secure, manage, and maintain remote databases and associated infrastructure and enable the access of the user devices to the data stored in the databases. Since remote databases may also store security sensitive data, remote databases may be targeted by different types of attacks, such as SQL injection attacks trying to exploit a web application vulnerability, insider attacks, credential theft attacks and the like.
[0006] SUMMARY
[0007] It is an objective of the present disclosure to provide an improved devices and methods for controlling access to a database storing potentially security sensitive data.
[0008] The foregoing and other objectives are achieved by the subject matter of the independent claims. Further implementation forms are apparent from the dependent claims, the description, and the figures.
[0009] According to a first aspect a data processing apparatus is provided for controlling access to a database storing data. The data processing apparatus is configured to receive from a user entity a current query request in a database query language for data from the database. Moreover, the data processing apparatus is configured to obtain a query pattern associated with the user entity associated with a user identity. As will be described in more detail below, the query pattern associated with the user identity associated with the user entity may be a minimum query pattern associated with the user entity associated with the user identity and may define one or more query terms and / or one or more query ranges. The data processing apparatus is further configured to determine whether the current query request in the database query language for data from the database complies with the query pattern associated with the user entity associated with the user identity. Moreover, the data processing apparatus is configured to execute the current query request and to provide the data resulting from the execution of the query request to the user entity, if the current query request in the database query language for data from the database complies with the query pattern associated with the user entity associated with the user identity.
[0010] In a further possible implementation form of the first aspect, if the current query request in the database query language for data from the database does not comply with the query pattern associated with the user entity associated with the user identity, the data processing apparatus is configured to refuse, i.e. block the current query request, log the current query request to a logging entity and / or issue an alert message.
[0011] In a further possible implementation form of the first aspect, the data processing apparatus comprises a memory storing a plurality of query patterns associated with a plurality of user identities, wherein the data processing apparatus is configured to obtain the query pattern associated with the user entity associated with the user identity from the memory based on the current query request in the database query language.
[0012] In a further possible implementation form of the first aspect, the data processing apparatus is configured to determine the query pattern associated with the user entity associated with the user identity in a training stage by determining one or more common query terms of a plurality of training query requests of the user entity associated with the user identity.
[0013] In a further possible implementation form of the first aspect, if the current query request in the database query language for data from the database does not comply with the query pattern associated with the user entity associated with the user identity, the data processing apparatus is configured to adjust, i.e. modify the query pattern associated with the user entity associated with the user identity based on the current query request in the database query language.
[0014] In a further possible implementation form of the first aspect, the data processing apparatus is configured to adjust, i.e. modify the query pattern associated with the user entity associated with the user identity based on the current query request in the database query language by including one or more query terms of the current query request in the database query language not part of the query pattern associated with the user entity associated with the user identity yet in the query pattern associated with the user entity associated with the user identity.
[0015] In a further possible implementation form of the first aspect, the query request in the database query language is a SQL query request. According to a second aspect a computer-implemented data processing method is provided, wherein the data processing method comprises the steps of: receiving from a user entity a current query request in a database query language for data from a database; obtaining a query pattern associated with the user identity associated with a user identity; determining whether the current query request in the database query language for data from the database complies with the query pattern associated with the user entity associated with the user identity; and executing the current query request and providing the data resulting from the execution of the current query request to the user entity, if the current query request in the database query language for data from the database complies with the query pattern associated with the user entity associated with the user identity.
[0016] In a further possible implementation form of the second aspect, the method further comprises refusing the current query request, logging the current query request to a logging facility and / or issuing an alert message, if the current query request in the database query language for data from the database does not comply with the query pattern associated with the user entity associated with the user identity.
[0017] In a further possible implementation form of the second aspect, the method comprises obtaining the query pattern associated with the user entity associated with the user identity from a memory, e.g. a disk or RAM, based on the current query request in the database query language, wherein the memory stores a plurality of query patterns associated with a plurality of user identities.
[0018] In a further possible implementation form of the second aspect, the method further comprises determining the query pattern associated with the user entity associated with the user identity in a training stage by determining one or more common query terms of a plurality of training query requests of the user entity associated with the user identity.
[0019] In a further possible implementation form of the second aspect, the method further comprises adjusting, i.e. modifying the query pattern associated with the user entity associated with the user identity based on the current query request in the database query language, if the current query request in the database query language for data from the database does not comply with the query pattern associated with the user entity associated with the user identity. In a further possible implementation form of the second aspect, adjusting, i.e. modifying the query pattern associated with the user entity associated with the user identity based on the current query request in the database query language comprises including one or more query terms of the current query request in the database query language not part of the query pattern associated with the user entity associated with the user identity in the query pattern associated with the user entity associated with the user identity.
[0020] In a further possible implementation form of the second aspect, the query request in the database query language is a SQL query request.
[0021] The method according to the second aspect of the present disclosure can be performed by the apparatus according to the first aspect of the present disclosure. Thus, further features of the method according to the second aspect of the present disclosure result directly from the functionality of the apparatus according to the first aspect of the present disclosure as well as its different implementation forms described above and below.
[0022] According to a third aspect, a computer program product comprising a non-transitory computer-readable storage medium for storing program code which causes a computer or a processor to perform the method according to the second aspect, when the program code is executed by the computer or the processor, is provided.
[0023] Details of one or more embodiments are set forth in the accompanying drawings and the description below. Other features, objects, and advantages will be apparent from the description, drawings, and claims.
[0024] BRIEF DESCRIPTION OF THE DRAWINGS
[0025] In the following, embodiments of the present disclosure are described in more detail with reference to the attached figures and drawings, in which:
[0026] Fig. 1 is a schematic diagram illustrating a data storage system according to an embodiment, including a plurality of user entities and a data processing apparatus according to an embodiment for controlling access to a database;
[0027] Fig. 2a is a schematic diagram illustrating processing steps implemented by a data processing apparatus according to an embodiment for generating during a training phase a query pattern used for controlling access to a database during a runtime phase; Fig. 2b is a schematic diagram illustrating processing steps implemented by a data processing apparatus according to an embodiment for using during a runtime phase a query pattern for controlling access to a database;
[0028] Figs. 3a-c are schematic diagrams illustrating further details of processing steps implemented by a data processing apparatus according to an embodiment for generating during a training phase a query pattern and using the query pattern for controlling access to a database during a runtime phase; and
[0029] Fig. 4 is a flow diagram illustrating a data processing method according to an embodiment for controlling access to a database.
[0030] In the following, identical reference signs refer to identical or at least functionally equivalent features.
[0031] DETAILED DESCRIPTION OF THE EMBODIMENTS
[0032] In the following description, reference is made to the accompanying figures, which form part of the disclosure, and which show, by way of illustration, specific aspects of embodiments of the present disclosure or specific aspects in which embodiments of the present disclosure may be used. It is understood that embodiments of the present disclosure may be used in other aspects and comprise structural or logical changes not depicted in the figures. The following detailed description, therefore, is not to be taken in a limiting sense, and the scope of the present disclosure is defined by the appended claims.
[0033] For instance, it is to be understood that a disclosure in connection with a described method may also hold true for a corresponding device or system configured to perform the method and vice versa. For example, if one or a plurality of specific method steps are described, a corresponding device may include one or a plurality of units, e.g. functional units, to perform the described one or plurality of method steps (e.g. one unit performing the one or plurality of steps, or a plurality of units each performing one or more of the plurality of steps), even if such one or more units are not explicitly described or illustrated in the figures. On the other hand, for example, if a specific apparatus is described based on one or a plurality of units, e.g. functional units, a corresponding method may include one step to perform the functionality of the one or plurality of units (e.g. one step performing the functionality of the one or plurality of units, or a plurality of steps each performing the functionality of one or more of the plurality of units), even if such one or plurality of steps are not explicitly described or illustrated in the figures. Further, it is understood that the features of the various exemplary embodiments and / or aspects described herein may be combined with each other, unless specifically noted otherwise. Figure 1 is a schematic diagram illustrating a data storage system 100 according to an embodiment. As will be described in more detail below, the data storage system 100 may comprise a plurality of user entities 110, such as for example smart phones, smart watches, tablet computers, laptop computers, desktop computers or other types of loT devices, and one or more remote data processing apparatuses, for instance, data storage servers 120 for controlling access to a database 125a. The database 125a may be implemented as a relational database, for instance, a SQL based relational database.
[0034] As illustrated in figure 1 , the data processing apparatus 120 may comprise a memory 125, for example a disk memory 125 for implementing a non-relational database 125a and the user entity 110 may be configured to operate therewith. Although in the embodiment of figure 1 , the database 125a is illustrated as a component of the data processing apparatus 120, in further embodiments the data processing apparatus 120 and the database 125a may both be standalone entities. As further illustrated in figure 1 , the plurality of user entities 110 and the data processing apparatus 120 may be configured to communicate with each other via a wireless, e.g. cellular and / or wired communication network 140, for instance, the Internet 140.
[0035] The user entity 110 may comprise a processor 111 for processing and generating data, a communication interface 113, including, for instance, an antenna, for exchanging data with the other components of the data storage system 100, and a non-transitory memory 115 for storing data. The processor 111 of the user entity 110 may be implemented in hardware and / or software. The hardware may comprise digital circuitry, or both analog and digital circuitry. Digital circuitry may comprise components such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), or general-purpose processors. The non-transitory memory 115 may store data, such as an executable program code which, when executed by the processor 111 , causes the user entity 110 to perform the functions, operations and methods described herein. The communication interface 113 may comprise a wired or wireless communication interface 113.
[0036] Likewise, the data processing apparatus 120 may comprise a processor 121 for processing and generating data, a communication interface 123 for exchanging data with the other components of the data storage system 100 as well as a memory 125 for storing data such as an executable program code which, when executed by the processor 121 , causes the data processing apparatus 120 to perform the functions, operations and methods described herein. As schematically illustrated in figure 1 , the data processing apparatus 120 is configured to receive from the user entity 110 a query request 130 in a database query language, such as SQL, for data from the database 125a. As will be described in more detail below, for controlling access to the database 125a the data processing apparatus 120 is further configured to obtain a query pattern associated with the user entity 110 associated with a user identity and to determine whether the query request 130 in the database query language for data from the database 125a complies with the query pattern associated with the user entity 110 associated with the user identity. If the query request 130 in the database query language for data from the database 125a complies with the query pattern associated with the user entity 110 associated with the user identity, the data processing apparatus 120 may execute the query request 130 and provide the resulting data from the database 125 to the user entity 110. In the alternative case that the query request 130 in the database query language for data from the database 125a does not comply with the query pattern associated with the user entity 110 associated with the user identity, the data processing apparatus 120 may be configured to refuse the query request 130, log the query request 130 and / or issue an alert message.
[0037] As used herein, the user entity 110 associated with the user identity may be associated with one or more physical users or software functions. For instance, in an embodiment, the user identity “Database Administrators” may be associated with a list of database users who all act as database administrators. In an embodiment, a different user identity may be defined for different IP addresses. In an embodiment, the user identity may be a web server application (as database client) running on a cluster with a physical user of the database 125 so that the user identity may be defined by the name of the physical user, a range of IP addresses as well as application client information. In a further embodiment, the user identity may be associated with a group of developers charged with debugging the client application.
[0038] In an embodiment, the memory 125 of the data processing apparatus 120 is configured to store a plurality of query patterns associated with a plurality of user identities, which may be associated with the plurality of user entities 110, and the data processing apparatus 120 is configured to obtain the query pattern associated with the user entity 110 associated with the user identity from the memory 125 based on the query request 130 in the database query language.
[0039] As will be described in more detail below, in an embodiment, the data processing apparatus 120 is configured to determine the query pattern associated with the user entity 110 associated with the user identity in a training stage by determining the common query terms of a plurality of training query requests 130 of the user entity 110 associated with the user identity. In the runtime or application stage, if the query request 130 in the database query language for data from the database 125a does not comply with the query pattern associated with the user entity 110 associated with the user identity, the data processing apparatus 120 may adjust the query pattern associated with the user entity 110 associated with the user identity based on the query request 130 in the database query language. In an embodiment, the data processing apparatus 120 may adjust the query pattern associated with the user entity 110 associated with the user identity based on the query request 130 in the database query language by including one or more query terms of the query request 130 in the database query language not part of the query pattern associated with the user entity 110 associated with the user identity in the query pattern associated with the user entity 110 associated with the user identity.
[0040] Embodiments of the data processing apparatus 120 disclosed herein may address, for instance, the following scenario. A bank account mobile application running on the user device 110, which may be associated with a physical user identity, allows viewing the user’s bank account transactions with different filters and options. Consequently, it may generate different queries 130 in SQL, like the following exemplary queries 130:
[0041] Select date, amount, from transactions where account_id=? order by date desc limit 100;
[0042] Select date, amount, from transactions where account_id=? and amount > 0 order by date desc limit 100;
[0043] Select date, amount, from transactions where account_id=? and amount > 0 and date > 1 / 1 / 2020 order by date desc limit 100;
[0044] Select date, amount, from transactions where account_id=? and amount < 1000 and amount > 10000 and date > 1 / 1 / 2020 order by date desc limit 100;
[0045] For this example, the data processing apparatus 120 according to an embodiment may determine a minimum query pattern with the following elements:
[0046] • Select fields: date, amount
[0047] • Criteria: account_id=?
[0048] • Limit 100
[0049] As will be appreciated, by capturing these common conditions, the data processing apparatus 120 according to an embodiment may ensure that the application running on the user device 110 does not have access to data the application does not need. Thus, even if there is a bug in the application or an SQL injection attack is performed, the data processing apparatus 120 according to an embodiment may ensure that it is not possible to select more fields or view account details associated with a different bank account associated with a different user identity and / or user entity using the application.
[0050] Furthermore, embodiments of the data processing apparatus 120 disclosed herein may address, for instance, the following scenario, where a user entity 110 associated with a user identity may have permission to copy data from a production database to another database. To this end, the user entity 110 may run the following query 130, for instance, every week: Select amount, order_date, product_type, user_type from orders where order_date >= <last_copy_date>.
[0051] If the user entity 110 becomes malicious or corrupted, it may try to select all fields from that table including fields with security sensitive information, such as payment details and other personal information, using the following query 130: Select * from orders.
[0052] However, based on the weakly query described above, the data processing apparatus 120 according to an embodiment would determine a minimum query pattern with the following elements:
[0053] • Select fields: amount, order_date, product_type, user_type
[0054] • Criteria: order_date >= ?
[0055] Based on this minimum query pattern the data processing apparatus 120 according to an embodiment would determine the query pattern from the malicious or corrupted user entity 110 not to confirm with the minimum query pattern and, therefore, would, for instance, refuse the query pattern from the malicious or corrupted user entity 110.
[0056] The data processing apparatus 120 according to embodiments disclosed herein allows detecting malicious database queries using a kind of database query history based on a deterministic approach defined by the query pattern. As will be described in the context of more detailed embodiments of the data processing apparatus 120 in the following, to this end the data processing apparatus 120 may extract, in particular during a training phase (also referred to as learning phase), the attributes of the most permissive queries and use these attributes later for evaluating queries during a runtime or application phase (also referred to as application development phase). In an embodiment, the data processing apparatus 120 is configured to handle the current query request 130 and generate the query pattern based on the following graph model for queries:
[0057] • Access type - The action performed on the database, can be one of: READ I UPDATE I DELETE I INSERT
[0058] • Quantity - Number of records to retrieve - * if none
[0059] • Resource - Holds the name of the database 125a resources (tables, views, collections, procedures etc.)
[0060] • Target - The list of the columns being accessed, if all fields are being fetched “*” node is added
[0061] • Qualification - Holds list of query’s conditions. In case of OR, the query is actually modeled to different models with a list of OR conditions. This is done using the “distributive property” rule. In case of a sub query, a new model may be added as a child model. If none a single entry “*” is added.
[0062] Herein the following representation of the graph model described above will be used for queries and query patterns:
[0063] [{ACCESS_TYPE, QUANTITY, RESOURCE, {TARGET LIST}, {Condition 1}},
[0064] {ACCESS_TYPE, QUANTITY, RESOURCE, {TARGET LIST}, {Condition n}}]
[0065] In the following several examples are provided of how the data processing apparatus 120 may represent a respective query based on the model described above.
[0066] In an embodiment, the select query
[0067] SELECT a, b FROM table_1 where (a=? Orb=?) AND c>? Limit 100; may be represented by the data processing apparatus 120 based on the model described above as:
[0068] [{READ, 100, table_1 , {a,b}, {a=?, c <?}},
[0069] {READ, 100, table_1 , {a,b}, {b=?, c <?}}]
[0070] In an embodiment, the select query
[0071] SELECT a, b from table 1 where a > 0 AND b = 1 AND (c =1 ord = 2); may be represented by the data processing apparatus 120 based on the model described above with no quantity token as:
[0072] [{READ, *, table_1 , {a,b}, {a>?, b=?, c=?}},
[0073] {READ, *, table_1 , {a,b}, {a>?, b=?, d=?}}] In an embodiment, the select query
[0074] Select * from table2; may be represented by the data processing apparatus 120 based on the model described above with no quantity token and no qualification token as:
[0075] {READ, *, table_2, {*}, {*}}
[0076] In an embodiment, the insert query
[0077] Insert into table3 (a,b) values (1,2); may be represented by the data processing apparatus 120 based on the model described above as:
[0078] {INSERT, *, table_3, {a,b}, {*}}
[0079] In an embodiment, the update query
[0080] Update into table4 set a= 1, b=2 where a > 0 AND b =1 AND (c =1 ord = 2); may be represented by the data processing apparatus 120 based on the model described above as:
[0081] [{UPDATE, *, table_4, {a,b}, {a>?, b=?, c=?}}, {UPDATE, *, table_4, {a,b}, {a>?, b=?, d=?}}]
[0082] In an embodiment, the delete query
[0083] Delete from tablet where id = 10 may be represented by the data processing apparatus 120 based on the model described above as:
[0084] {DELETE, *, table_1 , {*}, {id=?}}
[0085] In an embodiment, the data processing apparatus 120 is configured to implement a graph model matching scheme. In an embodiment, according to the graph model matching scheme a model M(l) representing a query I complies with a model M(J) representing a query or query pattern J if all of the conditions below are met:
[0086] • M(l)[Access Type] = M (J) [Access Type], i.e. both models have the same access type, such as read, update, delete or insert
[0087] • M(l)[Quantity] <= M(J) [Quantity] OR M (J) [Quantity] = *
[0088] • M(l)[Resource] c M(J) [Resource], i.e. the query is using a subset or all of the resources of the query or query pattern J
[0089] • M(l)[Target] c M (J) [Target] OR M(J)[Target] = * • a M(l)[conditions][k] c M(J)[conditions][l] OR M(J)[conditions] = *. i.e. at least one of the conditions (k) of M(l) is a subset of one of the conditions (I) of M(J) or M(J) has no conditions.
[0090] In an embodiment, the data processing apparatus 120 is configured to determine based on the graph model matching scheme described above to determine whether the current query request 130 (represented by the model M(l)) complies with the query pattern (represented by the model M(J)) associated with the user entity 110 associated with the user identity. More specifically, if the current query request M(l) 130 matches the query pattern M(J), which was learned during the training stage, the data processing apparatus 120 may allow and execute the current query request M(l) 130.
[0091] The graph model matching scheme, which may be implemented by the data processing apparatus 120 for checking the compliance of the current query request M(l) 130 with the query pattern M(J), will be described in the following in the in the context of a select query example and an update query example.
[0092] Select query example:
[0093] Query A:
[0094] SELECT tablel.a, tablel.b from tablel where tablel.e = 3 and (tablel.d > 3 ortable1.c=3 and table 1.a>9) limit 100
[0095] Model: [{READ, 100, table_1 , {a,b}, {a>?, c=?, e=?}}, {READ, 100, table_1 , {a,b}, {d>?, e=?}}]
[0096] • Access type - READ
[0097] • Quantity - 100
[0098] • Source Node - Tablel
[0099] • Target Node - {a,b}
[0100] • Qualifications -
[0101] • Condition of sub model 1 {a>?, c=?, e=?}
[0102] • Condition of sub model 2 {d<?, e=?}
[0103] Query B:
[0104] SELECT tablel.a from tablel where tablel.a > 9 and tablel.d > 0 and e=1 limit 50
[0105] Model: {READ, 50, table_1 , {a,b}, {a>?, d>?, e=?}}
[0106] • Access type node - READ match A
[0107] • Quantity - 50 < A[Quantity] • Source Node - Tablel match A
[0108] • T arget Node {a} match subset of A
[0109] • Qualifications
[0110] • Condition 1 - {a>?, d<?, e=?}
[0111] A[condition2] is subset of B[condition1] - match
[0112] Query C:
[0113] SELECT tablel.e from tablel where tablel.e = 3
[0114] Model: {READ, *, table_1 , {e}, {e=?}}
[0115] • Access type node - SELECT
[0116] • Quantity - * No match
[0117] • Source Node - Tablel
[0118] • Target Node -
[0119] • tablel .e No match
[0120] • Qualifications
[0121] Condition 1 {e=?} No match
[0122] For this first select query example, the data processing apparatus 120 after it has learned query A, will not learn query B, because it is a subset of query A. However, the data processing apparatus 120 will learn query C, because it is not a subset of query A.
[0123] Update query example:
[0124] Query A:
[0125] UPDATE table set a = 100, b = 200 where tablel.e = 3 and (tablel. d > 3 or tablel ,c=3 and table1.a>9)
[0126] • Access type - UPDATE
[0127] • Quantity - N / A
[0128] • Source Node - Tablel
[0129] • Target
[0130] • tablela
[0131] • tablelb
[0132] • Qualifications -
[0133] • Condition 1
[0134] • tablel .e = ?
[0135] • tablel .e = ? • table1.a > ?
[0136] • Condition 2
[0137] • tablel.d > ?
[0138] • table1.e = ?
[0139] Query B:
[0140] UPDATE table set a = 100 where tablel.e = 3 and tablel.d > 3 and tablel.c > 0
[0141] • Access type node - UPDATE
[0142] • Quantity - N / A
[0143] • Source Node - Tablel match A
[0144] • T arget Node match subset of A
[0145] • tablel . a
[0146] • Qualifications
[0147] • Condition 1 - A. condition 2 is subset of B. condition 1
[0148] • tablel.c > ?
[0149] • tablel.d > ?
[0150] • tablel.e = ?
[0151] Query C:
[0152] UPDATE table set c = 500 where tablel.e = 3
[0153] • Access Type - UPDATE
[0154] • Quantity - N / A
[0155] • Source Node - Tablel
[0156] • Target Node -
[0157] • tablel .c No match
[0158] • Qualifications
[0159] • Condition 1 No match tablel.e = ?
[0160] For this first update query example, the data processing apparatus 120 after it has learned queries A[1 ,2], will learn query B, because it is a subset of query A[2], However, the data processing apparatus 120 will not learn query C, because it is not a subset of queries A[1 ,2],
[0161] Figure 2a is a schematic diagram illustrating processing steps implemented by the data processing apparatus 120 according to an embodiment for generating during a training phase the query pattern based on the graph model described above. In 201 of figure 2a, the data processing apparatus 120 converts the query Qi 130 to a set of models Mi with n conditions. The outer loop is done for each condition of the model Mi (see 203 of figure 2a). If M[n] already exist as a query pattern in the model store stored in the memory 125, no further action is required (see 205 of figure 2a). In 207 of figure 2a the data processing apparatus 120 is configured to check if Mi[n] is a subset of any saved model, i.e. query pattern MS(j) in the MS stored in the memory 125. If that is the case, it means it would comply with an existing query pattern and, therefore, is allowed so that no further action is required. In the alternative case for learning a new model, i.e. query pattern the data processing apparatus 120 may check in an inner loop for each of the already existing models if they can be removed. Thus, if an existing model is a subset of the new Mi[n] model, it is removed from the model store as it is not needed (see 209, 211 , 213 of figure 2a). The model Mi[n] is added to the model store (see 215 of figure 2a).
[0162] The more abstract training phase scheme shown in figure 2a is illustrated in the following based on an illustrative example including three queries A, B, and C received by the data processing apparatus 120 during learning phase:
[0163] Query A: select * from t1 where a = ? limit 1;
[0164] Query B: select a,b,c from t1 where a = ? or b > ? limit 1;
[0165] Query C: select a,b,c from t1 where b > ? limit 100;
[0166] After processing query A, there is one model stored in the memory 125: {READ, 1 , t1 , {*}, {a=?}}
[0167] After processing query B, there are two models stored in the memory 125:
[0168] {READ, 1 , t1 , {*}, {a=?}} {READ, 1 , t1 , {a,b,c}, {b>?}}
[0169] After processing query C, there are two models stored in the memory, because the new model based on query C replaces the second model with limit 100 instead of just 1 :
[0170] {READ, 1 , t1 , {*}, {a=?}} {READ, 100, t1 , {a,b,c}, {b<?}}
[0171] Figure 2b is a schematic diagram illustrating processing steps implemented by the data processing apparatus 120 according to an embodiment for using during the runtime phase the query pattern, i.e. model learned during the training phase for controlling access to the database 125a.
[0172] In 201 of figure 2b, the data processing apparatus 120 converts the current query request Qi 130 to a set of models Mi with n conditions. The loop is done for each condition of the model set Mi (see 203 of figure 2b). Each condition has to match one of the conditions to be considered a legitimate query: condition 1 - If the model Mi[n] for condition n already exists as a query pattern in the model store stored in the memory 125 (see 205 of figure 2a); condition 2 - The condition is matching one for the saved condition in the model store (see 205 of figure 2a) If none of the conditions are met, the query is evaluated with a false value and may be handled according to the system settings. If the loop is completed, the query is evaluated with true.
[0173] Figures 3a-c are schematic diagrams illustrating further details of processing steps implemented by the data processing apparatus 120 according to an embodiment for generating during a training phase a query pattern and using the query pattern for controlling access to the database 125 during a runtime phase.
[0174] More specifically, figure 3a shows that during the training phase a training query request 130 is received by the data processing apparatus 120. In an embodiment, the data processing apparatus 120 is configured to implement a parser component 300 for parsing incoming queries. In an embodiment, the parser component 300 may generate a parser tree and / or some other type of parser output. The parser output 301 is handed over to the access pattern learning component 305 implemented by the data processing apparatus 120. As already described above, queries learning mapping rules 303 may be applied so that every query is being added to the right model store 307, i.e. the right query pattern. In an embodiment, the access pattern learning component 305 may be working in parallel to the data store query execution, so that it does not delay the query execution during the learning mode. To this end, the “access pattern learning component” 305 may be executed in another thread, process, container or machine, so the query execution is not delayed thereby. In an embodiment, the “access pattern learning component” 305 keeps updating the different models until the learning period is finished.
[0175] Figures 3b and 3c illustrate further details of the runtime or detection phase with the same components as the embodiment shown in figure 3a and further including an access pattern detection component 310. As already described above, every query is matched to its model using the queries detection mapping rules 303. If the action selected for the current query according to the queries detection mapping rules 305 is blocking the query, then the query evaluation should happen before the query is further handled. For other actions, the query can continue the execution and the evaluation may happen in parallel in a different thread, process, container, physical machine. It can even be done later using a log facility.
[0176] Figure 4 is a flow diagram illustrating steps of a computer-implemented data processing method 400 for controlling access to the database 125a. The data processing method 400 comprises a step 401 of receiving from the user entity 110 a current query request 130 in a database query language for data from the database 125a. Moreover, the data processing method 400 comprises a step 403 of obtaining a query pattern associated with the user entity 110 associated with a user identity and a step 405 of determining whether the current query request 130 in the database query language for data from the database 125a complies with the query pattern associated with the user entity 110 associated with the user identity. The data processing method 400 further comprises the step 405 of executing the current query request 130 and providing the data resulting from the execution of the current query request to the user entity 110, if the current query request 130 in the database query language for data from the database 125a complies with the query pattern associated with the user entity 110 associated with the user identity.
[0177] As already mentioned above, the method 400 can be performed by the data processing apparatus 120. Thus, further features of the method 400 result directly from the functionality of the apparatus 120 as well as its different embodiments described above and below.
[0178] The person skilled in the art will understand that the "blocks" ("units") of the various figures (method and apparatus) represent or describe functionalities of embodiments of the present disclosure (rather than necessarily individual "units" in hardware or software) and thus describe equally functions or features of apparatus embodiments as well as method embodiments (unit = step).
[0179] In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the described embodiment of an apparatus is merely exemplary. For example, the unit division is merely logical function division and may be another division in an actual implementation. For example, a plurality of units or components may be combined or integrated into another system, or some features may be ignored or not performed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections may be implemented by using some interfaces. The indirect couplings or communication connections between the apparatuses or units may be implemented in electronic, mechanical, or other forms.
[0180] The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one position, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
[0181] In addition, functional units in the embodiments of the present disclosure may be integrated into one processing unit, or each of the units may exist alone physically, or two or more units are integrated into one unit.
Claims
CLAIMS1 . A data processing apparatus (120) for controlling access to a database (125a), wherein the data processing apparatus (120) is configured to: receive from a user entity (110) associated with a user identity a query request (130) in a database query language for data from the database (125a); obtain a query pattern associated with the user entity (110) associated with the user identity; determine whether the query request (130) in the database query language for data from the database (125a) complies with the query pattern associated with the user entity (110) associated with the user identity; and if the query request (130) in the database query language for data from the database (125a) complies with the query pattern associated with the user entity (110) associated with the user identity, execute the query request (130) and provide the resulting data to the user entity (110).
2. The data processing apparatus (120) of claim 1 , wherein, if the query request (130) in the database query language for data from the database (125a) does not comply with the query pattern associated with the user entity (110) associated with the user identity, the data processing apparatus (120) is configured to refuse the query request (130), log the query request (130) and / or issue an alert message.
3. The data processing apparatus (120) of claim 1 or 2, wherein the data processing apparatus (120) comprises a memory (125) storing a plurality of query patterns associated with a plurality of user identities and wherein the data processing apparatus (120) is configured to obtain the query pattern associated with the user entity (110) associated with the user identity from the memory (125) based on the query request (130) in the database query language.
4. The data processing apparatus (120) according to any one of the preceding claims, wherein the data processing apparatus (120) is configured to determine the query pattern associated with the user entity (110) associated with the user identity in a training stage by determining the common query terms of a plurality of training query requests (130) of the user entity (110) associated with the user identity.
5. The data processing apparatus (120) of any one of the preceding claims, wherein, if the query request (130) in the database query language for data from the database (125a) does not comply with the query pattern associated with the user entity (110) associated with the user identity, the data processing apparatus (120) is configured to adjust the query patternassociated with the user entity (110) associated with the user identity based on the query request (130) in the database query language.
6. The data processing apparatus (120) of claim 5, wherein the data processing apparatus (120) is configured to adjust the query pattern associated with the user entity (110) associated with the user identity based on the query request (130) in the database query language by including one or more query terms of the query request (130) in the database query language not part of the query pattern associated with the user entity (110) associated with the user identity in the query pattern associated with the user entity (110) associated with the user identity.
7. The data processing apparatus (120) of any one of the preceding claims, wherein the query request (130) in the database query language is a SQL request (130).
8. A data processing method (400), wherein the data processing method (400) comprises: receiving (401) from a user entity (110) a query request (130) in a database query language for data from a database (125a); obtaining (403) a query pattern associated with the user entity (110) associated with a user identity; determining (405) whether the query request (130) in the database query language for data from the database (125a) complies with the query pattern associated with the user entity (110) associated with the user identity; and executing (407) the query request (130) and providing the resulting data to the user entity (110), if the query request (130) in the database query language for data from the database (125) complies with the query pattern associated with the user entity (110) associated with the user identity.
9. The data processing method (400) of claim 8, wherein the method (400) further comprises refusing the query request (130), logging the query request (130) and / or issuing an alert message, if the query request (130) in the database query language for data from the database (125a) does not comply with the query pattern associated with the user entity (110) associated with the user identity.
10. The data processing method (400) of claim 8 or 9, wherein the method (400) comprises obtaining the query pattern associated with the user entity (110) associated with the user identity from a memory (125) based on the query request (130) in the database querylanguage, wherein the memory (125) stores a plurality of query patterns associated with a plurality of user identities.
11. The data processing method (400) of any one of claims 8 to 10, wherein the method (400) further comprises determining the query pattern associated with the user entity (110) associated with the user identity in a training stage by determining the common query terms of a plurality of training query requests (130) of the user entity (110) associated with the user identity.
12. The data processing method (400) of any one of claims 8 to 11 , wherein the method (400) further comprises adjusting the query pattern associated with the user entity (110) associated with the user identity based on the query request (130) in the database query language, if the query request (130) in the database query language for data from the database (125a) does not comply with the query pattern associated with the user entity (110) associated with the user identity.
13. The data processing method (400) of claim 12, wherein adjusting the query pattern associated with the user entity (110) associated with the user identity based on the query request (130) in the database query language comprises including one or more query terms of the query request (130) in the database query language not part of the query pattern associated with the user entity (110) associated with the user identity in the query pattern associated with the user entity (110) associated with the user identity.
14. The data processing method (400) of any one of claims 8 to 13, wherein the query request (130) in the database query language is a SQL request (130).
15. A computer program product comprising a computer-readable storage medium for storing program code which causes a computer or a processor to perform the method (400) of any one of claims 8 to 14, when the program code is executed by the computer or the processor.