Managed Cloud Database Security Scanning Through an Isolated Sandbox
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security assessment tools for cloud databases are limited in their ability to perform a comprehensive scan due to reliance on API-provided information, which lacks complete database metadata, and direct access methods risk harming production data or affecting performance.
Innovation Solution
A secure sandbox environment is programmatically created in the user's cloud environment, where a snapshot of the database is loaded and assessed, allowing for a 'deep' scan with direct access to all data without exposing the production database to harm.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a data security assessment tool obtains information about the database via API, then it can access the database without direct connection, but it is limited to analyzing information exposed by the API and cannot perform a deep scan
Solution Approach 1:
The patent introduces a cloud service as an intermediary that creates a secure sandbox environment. This intermediary facilitates deep database scanning by provisioning isolated computing resources that can directly connect to the database, while the sandbox environment ensures security. The intermediary resolves the contradiction by enabling both deep access and secure operation without requiring the assessment tool to directly connect to production systems.
Solution Approach 2:
The patent segments the database assessment process into two distinct parts: (1) API-based information gathering for basic metadata, and (2) sandbox-based deep scanning for comprehensive analysis. This segmentation allows each method to operate in its optimal environment - the API provides safe initial access while the sandbox enables thorough investigation without risking production systems.
2Measurement precision
If the database owner gives direct access to the database assessment tool, then it can perform deep scanning, but the queries may harm production data and affect database performance
Solution Approach 1:
The cloud service acts as an intermediary that provisions a sandbox environment between the assessment tool and the production database. This intermediary layer enables deep scanning by providing direct access to the database through isolated computing resources, while simultaneously protecting production data and performance through the sandbox's security constraints and isolation mechanisms.
Solution Approach 2:
The patent creates a sandbox environment that copies necessary database access capabilities and metadata into an isolated computing environment. This copying allows the assessment tool to perform deep scans on replicated database structures and data samples without directly querying the production database, thereby eliminating the risk of harming production data while maintaining assessment depth.
3Measurement precision
If a sandbox environment is created to enable deep scanning, then comprehensive assessment is possible, but additional computational resources and setup time are required
Solution Approach 1:
The cloud service automatically provisions and configures the sandbox environment in response to receiving code from the assessment tool. This self-service automation eliminates manual setup complexity by having the cloud service handle resource allocation, environment configuration, and security policy enforcement automatically. The sandbox is created on-demand and automatically cleaned up after assessment, reducing operational burden despite the added capability.
Solution Approach 2:
The cloud service provides a universal sandbox provisioning capability that can serve multiple assessment tools and multiple databases. This multi-functional platform reduces overall complexity by using standardized processes and resources that can be reused across different assessments, rather than requiring custom sandbox setups for each assessment scenario.
Data Source
AI summary
A method performed by a cloud computing platform of a cloud service is disclosed to assess a data security of a database deployed in a cloud environment associated with a user of the cloud service. The method includes creating a sandbox environment in the cloud environment associated with the user, loading scanner code in the sandbox environment, wherein the scanner code includes code for performing a data security assessment, loading and restoring a snapshot of the database in the sandbox environment, setting a unique password for admin access to the restored snapshot of the database, executing the scanner code in the sandbox environment to perform the data security assessment on the restored snapshot of the database, and tearing down the sandbox environment in response to a determination that the scanner code has finished execution.