Database Query Audit via Session Context Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Prior business intelligence systems are unable to generate a complete audit trail for database queries and transactions due to the stripping of user IDs and relevant information by the server, resulting in incomplete monitoring and control capabilities.
Innovation Solution
A system that supplements monitored information between the web server and database with additional audit data from the BI server's internal log, and adds comments to queries before they are passed to the database, allowing for correlation of user-specific information and construction of a full audit record.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the server utilizes a single database login to process requests, then the server can efficiently manage multiple user requests, but user-specific information is stripped and unavailable for monitoring
Solution Approach 1:
The system segments the monitoring function by creating separate monitoring agents that attach to individual database sessions. Each agent independently tracks user-specific information for its assigned session, allowing the server to maintain a single login while preserving user identification through session-level segmentation.
Solution Approach 2:
Monitoring agents act as intermediaries between the server's single database login and the need for user-specific information. These agents attach to individual sessions and retrieve user identification from session context, bridging the gap between the server's aggregated login approach and the requirement for granular user monitoring.
2Measurement precision
If the monitoring tool intercepts communications between server and database, then it can monitor query activity, but it cannot access internal server information such as user IDs
Solution Approach 1:
Monitoring agents serve as intermediaries that operate at two levels: they intercept communications between the server and database for query monitoring, and simultaneously access session context information stored on the server side. This dual capability allows them to retrieve user IDs and other internal information that would otherwise be inaccessible to external monitoring tools.
Solution Approach 2:
The monitoring agent embeds itself within the server's session management structure, nesting its monitoring functions inside the existing session context. This allows the agent to access internal server information such as user IDs while maintaining its external monitoring capabilities.
3Ease of operation
If user information is stripped from queries before reaching the database, then the server can simplify database authentication, but the audit trail becomes incomplete
Solution Approach 1:
The system segments the audit trail generation by creating session-specific monitoring agents that capture user information at the session level rather than requiring it in every database query. This allows simplified database authentication while maintaining complete audit trails through session-level information capture.
Solution Approach 2:
The monitoring agent performs preliminary action by capturing user identification and session information early in the session establishment phase, before queries are executed. This preliminary capture of information ensures complete audit trails without requiring user information to be present in every subsequent database communication.
Data Source
AI summary
An improved method and apparatus for auditing database queries, wherein comments are added by a server prior to the server forwarding the queries to the database system. The comments are then used to derive audit information, which is correlated with other audit information in a different server, to produce a more complete audit record.