In-Database SQL Allow-Listing for Comprehensive Injection Monitoring

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing database security measures, such as remote firewalls, are inadequate in preventing SQL injection threats, particularly for localized or out-of-band operations and stored procedures, as they require network reconfiguration and cannot monitor all SQL commands effectively.

Innovation Solution

Implement an in-database allow-list within the database management system to monitor and block unauthorized SQL commands, using a SQL enforcement module that generates signatures for legitimate SQL statements and enforces context-based policies to prevent malicious SQL injection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a remote firewall mechanism is used to prevent SQL injection threats, then network-based SQL injection attacks can be blocked, but localized or out-of-band connections and stored procedure SQL commands cannot be monitored

Engineering Contradiction:

ImproveSQL injection preventionVSAvoidmonitoring coverage

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent embeds a firewall mechanism directly within the database management system, nesting security functionality inside the target system it protects. This allows the database engine itself to monitor and filter SQL commands from any source including localized connections and stored procedures, eliminating the coverage gaps of external firewalls

Inventive Principle:

Principle #7Nested doll (Nesting)

Solution Approach 2:

The patent introduces an intermediary layer between the SQL command execution and the database engine. This intermediary firewall mechanism intercepts, analyzes, and filters SQL commands regardless of their source, providing comprehensive monitoring while maintaining the database's normal operations

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If a remote firewall is deployed to block SQL injection threats, then network SQL commands can be filtered, but network reconfiguration is required and deployment complexity increases

Engineering Contradiction:

ImproveSQL injection preventionVSAvoiddeployment complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent merges the firewall functionality with the database management system itself, combining security and data management into a single integrated system. This eliminates the need for separate firewall deployments and network reconfigurations, reducing overall system complexity while maintaining security

Inventive Principle:

Principle #5Merging (Combining)

3Adaptability or versatility

If an in-database allow-list is implemented to block unauthorized SQL, then comprehensive SQL monitoring is achieved, but system complexity increases

Engineering Contradiction:

Improvemonitoring coverageVSAvoidsystem complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements a self-service mechanism where the database system automatically learns legitimate SQL patterns from normal operations and uses this knowledge to filter malicious commands. The system serves its own security needs without requiring complex external configuration or management overhead

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS20250278507A1Efficient allow listing of SQL inside a database

Publication Date: 2025.09.04 ORACLE INT CORP

AI summary

Disclosed is an improved approach to implement an in-database allow-list to address SQL injection threats. The allow-list includes a list of legitimate SQL that is permitted to run within the database, which can be used to block the execution of any SQL that does not appear on the list. In this way, any malicious SQL from a SQL injection would be blocked since such malicious SQL would not be permitted to be included on an allow-list.