Database Activity Monitoring via Result Set Metadata Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current database activity monitoring systems fail to effectively validate dynamic SQL queries against security policies due to the dynamic construction and execution of SQL statements at runtime, making it difficult to detect access violations as the violating operation and data object are not visible to the monitoring service.
Innovation Solution
A method that intercepts database server responses with result sets, extracts dynamic query elements, and creates a security construct based on database protocol rules to validate against security policies, issuing alerts for non-compliance, even for dynamically constructed queries by analyzing result set metadata.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If database activity monitoring systems use static query analysis to validate security policies, then validation simplicity is improved, but detection capability for dynamic SQL queries deteriorates because the violating operation and data object are not visible in the static query
Solution Approach 1:
Instead of analyzing the outgoing query to detect security violations, the patent analyzes the incoming result set from the database server. By inverting the analysis direction and examining what the database returns rather than what the application requests, the system can detect dynamic SQL violations that are not visible in the original query statement.
Solution Approach 2:
The patent uses the result set metadata as an intermediary to bridge the gap between dynamic query execution and security policy validation. The metadata contains information about the actual operation and data objects accessed, serving as a mediator that enables security analysis of dynamic queries without requiring modification of the query itself.
2Measurement precision
If database monitoring systems analyze result set metadata to detect dynamic SQL violations, then detection capability is improved, but system complexity increases due to the need to intercept and parse database responses
Solution Approach 1:
The database server itself generates and provides the result set metadata containing the information needed for security validation. The monitoring system does not need to reconstruct or infer this information but can directly extract it from the server-provided metadata, reducing the complexity of the monitoring system while maintaining high detection capability.
3Loss of time
If real-time validation of dynamic SQL queries is implemented through result set analysis, then security response time is improved, but processing overhead increases due to intercepting and analyzing database responses
Solution Approach 1:
The patent applies validation only to result sets that require security checking, rather than processing all database traffic uniformly. By selectively analyzing only the necessary result sets and their metadata, the system achieves real-time security validation with reduced processing overhead compared to comprehensive traffic analysis.
Data Source
AI summary
A computer system, in response to intercepting a database server response with a result set issued by a database server in response to a database query received by the database server, extracts a selection of data from the result set, the selection of data identifying dynamic query elements of the dynamic database query as constructed by the database server at runtime. The database activity monitoring service determines whether the dynamic query elements comply with any security policies. The database activity monitoring service, in response to determining that the dynamic query elements fail to comply with any security policies, issues a security alert.