Query Refinement for Database Security Risk Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Securing computer systems and data has become increasingly challenging due to attackers exploiting software bugs and vulnerabilities, as well as applications inadvertently providing unnecessary access to data, making it difficult to detect and manage such access effectively.
Innovation Solution
The method involves capturing and comparing query results and displayed results to identify over-provisioning of data, refining queries to limit data returned, and iteratively modifying SQL statements to only retrieve information needed for display, thereby reducing security risks and generating alerts for further improvements or issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If applications query all available data from databases, then complete information is retrieved, but unnecessary data access increases security risks
Solution Approach 1:
The patent extracts only the necessary data fields from database queries that are actually required for application functionality. By analyzing application code and query patterns, the system identifies and removes unnecessary data retrieval, keeping only essential fields to minimize security exposure while maintaining application requirements.
Solution Approach 2:
The patent applies different data access strategies to different parts of the application. Instead of uniform data retrieval across all queries, the system analyzes each query's specific purpose and retrieves only the locally appropriate data subset needed for that particular function, reducing overall data access volume while preserving necessary access where required.
2Ease of operation
If query results are extensively processed and transformed, then data is made ready for display, but the complexity of detecting over-provisioning increases
Solution Approach 1:
The patent performs preliminary analysis of application code and query patterns before executing queries. By pre-identifying which data fields are actually used in the application logic and display layers, the system can filter queries in advance to retrieve only necessary data, simplifying the detection process while ensuring proper data processing occurs.
Solution Approach 2:
The patent implements a feedback mechanism that monitors query results against actual application usage. The system tracks which retrieved data is actually consumed by the application versus what remains unused, and uses this feedback to continuously refine and optimize query formulations, reducing over-provisioning while maintaining ease of data processing.
Data Source
AI summary
Systems, methods, and computer media for securing data accessible through software applications are provided herein. By capturing path data such as returned results for a query and displayed results provided by an application (e.g., to or by a web browser) for an operation, it can be determined if the query returned more data than was needed for what was displayed. The query can be refined to limit the data returned and reduce the security risk of such over-provisioning of data.