Real-Time Stored Procedure Sensitivity Detection Without Data Exposure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems lack effective real-time monitoring and security measures for stored procedures, leading to potential vulnerabilities and data breaches due to the encapsulation of commands within stored procedures, which traditional monitoring methods struggle to detect.
Innovation Solution
A sensitive stored procedure identification engine that utilizes a discovery process to assign sensitivity scores based on pattern searches and machine learning, comparing scores in real-time to allow or block procedure calls, ensuring comprehensive security without exposing sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If stored procedures are precompiled to improve execution performance, then database interaction speed is improved, but security monitoring capability deteriorates because traditional monitoring methods struggle to detect encapsulated commands
Solution Approach 1:
The patent introduces a security system as an intermediary layer between database clients and stored procedures. This system intercepts stored procedure calls before execution, analyzes their content, and monitors responses without requiring the stored procedure code to be exposed or modified. The intermediary security system enables monitoring of encapsulated commands while preserving the performance benefits of precompiled stored procedures.
2Productivity
If stored procedures are used to streamline database operations, then operational efficiency is improved, but vulnerability to data breaches increases due to encapsulation of commands
Solution Approach 1:
The patent applies preliminary action by analyzing stored procedure calls before they execute and by continuously monitoring responses during execution. The system proactively identifies potential vulnerabilities by examining the call content, parameters, and response data patterns, enabling preventive security measures before actual data breaches occur. This allows the system to maintain operational efficiency while preventing harmful factors.
Solution Approach 2:
The patent implements feedback mechanisms that continuously monitor stored procedure responses for sensitive data patterns and security anomalies. The system analyzes response data, compares it against security rules, and provides feedback about potential breaches or unauthorized access attempts. This feedback loop enables real-time security monitoring without interfering with the normal operational efficiency of stored procedures.
3Reliability
If real-time monitoring of stored procedures is implemented, then security responsiveness is improved, but system complexity increases
Solution Approach 1:
The patent extracts security monitoring functions from the stored procedure execution path and places them in a separate, dedicated security system. This extraction allows real-time monitoring of stored procedure calls and responses without embedding complex monitoring logic within the stored procedures themselves. The separated security system maintains reliability through continuous monitoring while minimizing the complexity increase by keeping monitoring logic external and modular.
Data Source
AI summary
An embodiment initiates, by a sensitive stored procedure identification engine, a periodic discovery process on a database server to identify a stored procedure and assign a first sensitivity score to the stored procedure based on a searching of a sensitive data pattern in the stored procedure. The embodiment assigns in real-time, by the sensitive stored procedure identification engine responsive to receiving a stored procedure call by a client over a network, a second sensitivity score to the stored procedure based on a searching of a sensitive data pattern in a response to the stored procedure call. The embodiment compares, by the sensitive stored procedure identification engine, the first sensitivity score and the second sensitivity score. The embodiment determines, by the sensitive stored procedure identification engine based on the comparison, to allow a response to the stored procedure call to the client.