Accessor Authorization Using Query Signatures and Execution Plans
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authorization techniques fail to consider the intricacies of data access language patterns and query execution plans, leading to missed detection of malicious activities and vulnerabilities in datastores.
Innovation Solution
A system and method that generate an information-interaction-signature by analyzing data access language patterns and query execution plans to validate accessors, using machine-readable structures and validation strategies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If behavior-centric authorization approaches are used, then access control decisions can be made based on simple access types, but data access language patterns and query execution plan intricacies are not considered
Solution Approach 1:
The patent combines multiple authorization approaches by merging behavior-centric access control with data access language pattern analysis and query execution plan examination. The system integrates these different dimensions into a unified authorization framework that considers all three aspects simultaneously when making access control decisions.
Solution Approach 2:
The patent adds new dimensions to the authorization process by incorporating data access language patterns (syntactic and semantic patterns) and query execution plan characteristics as additional authorization criteria. This transforms the authorization system from considering only basic access types to evaluating multiple dimensional aspects of data access requests.
2Device complexity
If execution plan analysis is not performed, then authorization processing is simpler, but malicious activities and vulnerabilities are missed
Solution Approach 1:
The patent performs preliminary analysis of query execution plans during the authorization phase, before actual data access occurs. By examining execution plans in advance and comparing them against known malicious patterns, the system can prevent unauthorized access while maintaining reliable security detection.
Solution Approach 2:
The patent introduces an intermediary authorization layer that sits between the query submission and execution phases. This intermediary component analyzes both the data access language patterns and query execution plans, acting as a mediator that can block or allow queries based on comprehensive pattern matching before they reach the database engine.
3Device complexity
If diverse language patterns are not captured, then behavior-based signatures are simpler to generate, but individual accessor styles are not recognized
Solution Approach 1:
The patent changes the parameters used for signature generation from simple access type counts to include syntactic patterns, semantic patterns, and execution plan characteristics. By modifying these parameters, the system can capture diverse language patterns and individual accessor styles while maintaining a structured approach to signature creation.
Data Source
AI summary
A system and method to validate an accessor accessing a datastore is disclosed. When a data access request formulated using a data access language is received, a first representation based on parameters of the data access language and characteristics of the accessor is generated. A second representation is generated based on data characteristics and execution characteristics of an execution plan. An information-interaction-signature is generated based on the first and second representations. The accessor is validated based on the generated signature and one or more validation strategies. The system and method utilize data access language patterns and execution plans to generate a signature, enhancing the capability to make informed authorization decisions and reinforce intrusion detection measures.