Network Intrusion Manager for Database Account Failover
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Database systems face challenges in providing near real-time network intrusion event response and protection, particularly against cyber-attacks like malware and ransomware, due to existing security measures being inadequate for immediate and effective action.
Innovation Solution
The implementation of a network intrusion manager (NIM) that configures account replication between source and target accounts, monitors for network intrusion events, and generates notifications to lock down compromised accounts in near real-time, utilizing encryption keys based on private and root keys for secure failover and data protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional security measures are used in database systems, then basic data protection is maintained, but near real-time response capability to network intrusion events is insufficient
Solution Approach 1:
The patent implements account replication in advance, creating a backup account before any intrusion occurs. When an intrusion is detected, the system can immediately switch to the replicated account, enabling near real-time response without waiting for security measures to be built up or deployed after the attack begins.
Solution Approach 2:
The system continuously monitors network traffic and account activity for signs of intrusion, creating a feedback loop that detects security threats in real-time. This feedback mechanism triggers automatic responses such as locking down compromised accounts and activating replicated accounts, enabling rapid response while maintaining reliable security protection.
2Loss of time
If account replication and failover mechanisms are implemented, then near real-time response to intrusions is enabled, but system complexity increases
Solution Approach 1:
The patent creates a copy of the compromised account in advance (the replicated account), which contains identical data and structure. When intrusion is detected, the system switches to this pre-made copy, eliminating downtime while the original account is locked down. This copying approach minimizes loss of time without requiring complex real-time reconstruction of account data.
Solution Approach 2:
The system introduces a network intrusion manager as an intermediary component that handles the complexity of monitoring, detection, and failover operations. This intermediary layer abstracts the complexity from the user experience, enabling near real-time response while keeping the user interface simple and transparent to end users.
3Reliability
If encryption keys based on private and root keys are used for failover, then data security is enhanced, but key management complexity increases
Solution Approach 1:
The patent segments the encryption key structure into separate components: a root key that remains secure and private, and individual account-specific encryption keys that can be independently managed and rotated. This segmentation allows the system to maintain strong data security during failover while reducing key management complexity by isolating the critical root key from operational key rotation activities.
Solution Approach 2:
The system changes the parameter of key usage by transitioning from single-key encryption to hierarchical encryption where data is encrypted with account-specific keys that are themselves encrypted with the root key. This parameter change enhances data security during failover while the root key acts as a stable reference point that simplifies key management by providing a consistent decryption mechanism.
Data Source
AI summary
A system includes at least one hardware processor and at least one memory storing instructions that cause the at least one hardware processor to perform operations. The operations include encoding data stored at a first account of a user. The first account is configured at a primary deployment of a database system. The encoding is based on a first encryption key. The operations include detecting a network intrusion event associated with the first account of the user. The operations include performing a failover of the first account to a second account of the user based on the detecting of the network intrusion event. The failover grants the user access to a replicated version of the data based at least on a second encryption key.