Database Query Access Control Using Call-Location Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for protecting data stored at database servers are limited as they evaluate request queries from a single perspective, fail to identify the origin of requests, and result in increased latency and reduced performance due to proxy-based solutions.
Innovation Solution
A method and apparatus that collect information on the origin and generation of database requests, using an access control list (ACL) to compare this information with reference data and constraints to determine if a request should be allowed or denied, thereby preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a proxy computer is used to evaluate database requests, then data protection is improved, but latency increases and performance decreases
Solution Approach 1:
The patent extracts the security evaluation function from the proxy computer and relocates it to the web server. The web server collects information about where and how database requests are generated, then performs access control list evaluations directly at the web server layer, eliminating the need for proxy-based interception and evaluation of database requests.
Solution Approach 2:
The patent introduces an access control list mechanism that operates as an intermediary layer between the web server and database server. This ACL system evaluates requests based on collection information about request origin and generation context, providing security enforcement without requiring proxy computer intervention in the request path.
2Reliability
If database servers or proxy computers evaluate requests, then unauthorized access is prevented, but the system cannot identify threatening requests from non-threatening ones
Solution Approach 1:
The patent performs preliminary information collection at the web server about where and how database requests are generated, before the requests reach the database server. This collection information includes context about the request origin and generation process, enabling informed security decisions without requiring the database server or proxy to analyze request semantics.
Solution Approach 2:
The system implements feedback by using the collected information about request generation context to inform access control decisions. The access control list mechanism uses this feedback to determine whether to allow or deny database requests, enabling the system to distinguish between threatening and non-threatening requests based on their origin and generation characteristics.
Data Source
AI summary
The present disclosure is directed to protecting data stored at a database in a manner that increases data protection minimizing performance reductions. Apparatus and methods consistent with the present disclosure may collect information from user devices from which user inputs are received when collecting data that may be used to protect database data. Methods consistent with the present disclosure may identify code paths traversed, pages of program code where actions were initiated, and functions associated with those actions. This information may be cross-referenced with a set of data, constraints, rules, or command parameters when data associated with a database query is initially associated with an “allow” action or a “deny” action. This information may also be used to evaluate whether newly generated database queries should be allowed to be sent to a database server or to identify whether a database request should be blocked.