Runtime Agent Metadata Injection for Database User Accountability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional approaches to linking database activity to specific application users in large distributed computing environments are computationally expensive and inaccurate, particularly when users access databases indirectly via applications, leading to difficulties in monitoring and securing sensitive data.
Innovation Solution
Capturing contextual information for data accesses using a flow enrichment or distributed tracing approach, where metadata from various stages of the request processing pipeline is serialized and stored with database queries, enabling accurate user accountability by associating user actions with specific application users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If statistical correlations are performed between application traffic and database traffic to link database activity to application users, then user accountability is achieved, but computational resources are excessively consumed and accuracy is reduced
Solution Approach 1:
The patent applies preliminary action by injecting a trace identifier into the application layer request at the beginning of the request processing pipeline, before the request reaches the database. This allows the trace identifier to be propagated through all intermediate components (application server, message queue, microservices) and automatically captured in the database query metadata, eliminating the need for post-hoc statistical correlations and significantly reducing computational resources while maintaining accurate user accountability
Solution Approach 2:
The patent introduces a trace identifier as an intermediary element that mediates between application users and database activity. This trace identifier serves as a unique link that propagates through the entire distributed system, allowing database queries to be accurately associated with specific application users without requiring complex statistical analysis, thus resolving the contradiction between measurement precision and computational resource consumption
2Reliability
If database activity is monitored in large distributed computing environments with disconnected audit trails, then security monitoring coverage is improved, but the complexity of reconstructing and correlating audit trails increases
Solution Approach 1:
The patent merges previously disconnected audit trails by injecting a trace identifier that propagates through all system components (application server, message queue, microservices, database). This single trace identifier consolidates distributed audit information into a unified trail, allowing complete request lifecycle tracking without complex reconstruction, thus improving security monitoring coverage while reducing system complexity
Solution Approach 2:
The trace identifier is preliminarily injected at the application layer before requests traverse through multiple distributed components. This preliminary action ensures that all subsequent components automatically capture and propagate the same identifier, creating pre-connected audit trails that eliminate the need for complex post-processing and correlation of disconnected audit logs
3Measurement precision
If metadata is captured and serialized with each database query to enable accurate user attribution, then user accountability is improved, but the size of database queries and metadata storage increases
Solution Approach 1:
The patent extracts only the essential trace identifier metadata from the complex request context and propagates it through the system. By taking out just this single, compact identifier rather than serializing entire request objects or comprehensive metadata, the solution achieves accurate user attribution while minimizing the quantity of metadata generated and stored, thus resolving the contradiction between measurement precision and quantity of substance
Data Source
AI summary
A method by one or more runtime agents protecting a web application for capturing contextual information for data accesses. The method includes determining first metadata associated with a web application layer request sent by a web application firewall to the web application, determining second metadata associated with the web application layer request based on information available to the web application, serializing the first metadata and the second metadata to generate serialized metadata, and adding the serialized metadata to a database query that is to be submitted by the web application to the database server, wherein execution of the database query that includes the serialized metadata by the database server is to cause the database activity monitor to store the serialized metadata and third metadata associated with the database query determined by the database activity monitor in a data storage.