Database Patching via Elevated Privilege Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database patching methods are error-prone and insecure, often requiring databases to be taken offline, leading to potential security vulnerabilities and regulatory compliance issues due to complex dependencies and direct SSH connections.
Innovation Solution
A system and method for database patching that involves a patching controller to receive and process patching requests, generate configuration files, establish direct connections between patching servers and client databases, execute patching commands, and parse output files, while incorporating security features like multi-factor authentication and limited user access to enhance security and minimize downtime.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If direct SSH connection is used from patching server to client database, then patching efficiency is improved, but security vulnerabilities increase
Solution Approach 1:
The patent introduces an intermediary authentication mechanism between the patching server and client database. Instead of direct SSH connections, the system uses elevated privilege authentication where the patching server validates credentials against the client database's authentication system, creating a secure intermediary layer that maintains efficiency while eliminating security vulnerabilities
Solution Approach 2:
The patent extracts the authentication function from the direct SSH connection process. By separating credential validation into a distinct authentication step using elevated privileges, the system removes the security vulnerability of direct SSH access while preserving the efficiency benefits of direct communication channels
2Object-affected harmful factors
If multiple dependencies are introduced for secure patching, then security is improved, but downtime increases
Solution Approach 1:
The patent extracts third-party patch deployment services from the patching process and replaces them with native elevated privilege authentication built into the database system. This eliminates external dependencies while maintaining security, thereby reducing downtime caused by coordination and integration with external services
Solution Approach 2:
The patent enables the database system to authenticate patching requests using its own elevated privilege mechanisms rather than relying on external third-party services. This self-service authentication approach removes external dependencies and reduces downtime by keeping the authentication process within the database's own infrastructure
3Object-affected harmful factors
If databases are taken offline for patching, then security is improved, but productivity decreases
Solution Approach 1:
The patent performs authentication and authorization validation before the patching process begins. By establishing elevated privilege credentials in advance and validating them prior to offline operations, the system ensures security is already in place before databases go offline, minimizing the security-related overhead during downtime
Solution Approach 2:
The patent maintains continuous authentication and authorization validation throughout the patching process rather than requiring complete offline isolation. The elevated privilege mechanism allows security checks to continue during patch application, reducing the need for extended offline periods while maintaining security
4Reliability
If complex collaboration between teams is implemented, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent implements automated authentication and authorization mechanisms that operate without requiring manual coordination between infrastructure teams and database teams. The elevated privilege system automatically validates credentials and authorizes patching operations, reducing human intervention and simplifying the collaboration process while maintaining reliability through automated validation
Data Source
AI summary
Systems and methods for improved database patching are provided. Exemplary embodiments may receive a database patching request and access patching instructions related to the database patching request. A configuration file based on the patching instructions may then be generated at a patching server. A controller may then execute a command at the patching server which causes the patching server to establish a direct connection to a client database and transmit the configuration file to the client database. The controller may then execute a command which causes the client database to perform a database patching activity.