Runtime Query Filtering with Combined Allowlist and Blocklist
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database security systems face challenges in effectively securing access while allowing legitimate queries due to the limitations of using either allowlists or blocklists alone, leading to vulnerabilities that can be exploited by injection attacks.
Innovation Solution
A method and system that combines allowlist and blocklist semantic comparators to process runtime queries, where the blocklist comparator performs an inverse comparison to the allowlist, ensuring that queries are only executed if they are allowed by the allowlist and not blocked by the blocklist, thereby enhancing security against malicious attempts to circumvent access controls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If an allowlist is created through generalization of allowed queries, then the allowlist can permit broader legitimate queries, but it may become overly broad and permit queries that receive confidential information
Solution Approach 1:
The patent merges allowlist and blocklist mechanisms into a unified security system where both lists are evaluated together. The allowlist identifies permitted query patterns while the blocklist explicitly prohibits specific dangerous queries, creating a layered defense that resolves the contradiction between broad permission coverage and confidential information protection
Solution Approach 2:
The patent inverts the traditional allowlist-only approach by introducing a blocklist that explicitly defines what must be blocked. Instead of trying to enumerate all allowed queries (which risks being overly permissive), the system enumerates what must be blocked and combines this with the allowlist, flipping the security mindset from permissive-to-restrictive to restrictive-and-permissive
2Reliability
If a blocklist is used to define what should be blocked, then specific dangerous queries can be prevented, but the system cannot prevent future or unknown attacks
Solution Approach 1:
The patent applies preliminary action by pre-defining both allowlist patterns and blocklist prohibitions before attacks occur. The system prepares multiple security layers in advance: the allowlist establishes permitted query structures and the blocklist pre-identifies known attack patterns, enabling the system to respond to both known and unknown threats through their interaction
Solution Approach 2:
The patent implements preliminary anti-action by proactively blocking potential attacks through the blocklist before they can execute. The blocklist serves as a preemptive defense mechanism that counteracts known attack vectors, while the allowlist provides a framework for detecting deviations that may indicate future or unknown attacks
3Device complexity
If only an allowlist or blocklist is used for securing the system, then the security mechanism is simpler, but the security effectiveness is reduced
Solution Approach 1:
The patent merges two previously separate security mechanisms (allowlist and blocklist) into a unified evaluation system. The query evaluation module processes both lists simultaneously, combining their security benefits while managing them through a single integrated architecture, thus achieving enhanced security without proportionally increasing operational complexity
Data Source
AI summary
Combining allowlist and blocklist support in data queries includes performing operations including obtaining a runtime query and extracting a set of runtime tuples from the runtime query. The operations further include processing the set of runtime tuples by an allowlist semantic comparator comparing the set of runtime tuples with an allowlist to obtain a first comparison result and by a blocklist semantic comparator comparing the set of runtime tuples with a blocklist to obtain a second comparison result. The blocklist semantic comparator performs an inverse comparison of the allowlist semantic comparator. The operations further include combining the first comparison result with the second comparison to form an access determination and executing the runtime query according to the access determination.