Multi-tenant Database Query Plan Detection and Firewall Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant database network systems, there is a risk of data being delivered to the wrong user due to errors or defects in shared hardware and software infrastructure, which existing security measures like network firewalls and intrusion detection may not adequately address.
Innovation Solution
Implementing a query plan detection module to identify and alert on suspect query plans, and using both server-side and client-side firewall systems to verify that data and pages are sent to the correct user by comparing user and organization information, ensuring that only appropriate users access their data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network firewalls and intrusion detection systems are used to protect data, then physical and network security are improved, but they cannot prevent data from being delivered to the wrong user due to software or hardware errors
Solution Approach 1:
The patent introduces an intermediary verification system that sits between the data retrieval process and data delivery. This system includes components that verify data ownership by checking identifiers embedded in the data against the requesting user's credentials, acting as a mediator to prevent wrong data delivery even when firewalls and intrusion detection are in place
Solution Approach 2:
The patent implements feedback mechanisms where the system continuously monitors and verifies data delivery attempts. When data is retrieved, the system provides feedback by checking whether the data should be delivered to the requesting user, and can alert or block delivery if the verification fails, creating a closed-loop security system
2Reliability
If additional security systems are implemented beyond firewalls, then data security against software and hardware errors is improved, but system complexity increases
Solution Approach 1:
The patent merges the verification functionality into the existing data retrieval and delivery infrastructure. Rather than adding completely separate security systems, the verification checks are integrated into the data flow path, combining security verification with normal data access operations to reduce overall system complexity
Solution Approach 2:
The system performs self-verification by automatically checking data ownership and delivery appropriateness without requiring external security systems. The verification process uses identifiers embedded in the data itself and compares them against user credentials, allowing the system to self-regulate data delivery security
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Network security is enhanced in a multi-tenant database network environment using a query plan detection module to continually poll the database system to locate and raise an alert for suspect query plans. Security also can be enhanced using a firewall system sitting between the application servers and the client systems that records user and organization information for each client request received, compares this with information included in a response from an application server, and verifies that the response is being sent to the appropriate user. Security also can be enhanced using a client-side firewall system with logic executing on the client system that verifies whether a response from an application server is being sent to the appropriate user system by comparing user and organization id information stored at the client with similar information in the response.