Session Attribute Propagation in Secure Database Tiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In secure database environments, session attributes are not available to the database monitor agent due to encryption, limiting intrusion detection and security analysis, while unsecured environments lack the ability to handle encrypted data transmissions.
Innovation Solution
A mechanism where an unsecure access local agent extracts a unique identifiable key from an encrypted database client request and maps it to database session information, allowing a secure access local agent to decrypt and forward the data to an external security device for analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If data transmission is encrypted to improve security, then data protection is improved, but session attribute availability for security analysis deteriorates
Solution Approach 1:
The patent introduces a DSI mapping data structure as an intermediary mechanism that bridges the gap between encrypted data and session attributes. This mapping structure allows the secure access local agent to associate encrypted database client requests with their corresponding session attributes without decrypting the actual data, thus maintaining both security and analysis capability.
Solution Approach 2:
The patent segments the data processing into distinct functional components: the unsecure access local agent handles encrypted data reception and UIK extraction, while the secure access local agent handles decryption and session attribute mapping. This segmentation allows each component to operate optimally for its specific function while working together to solve the overall problem.
2Object-affected harmful factors
If cryptographic operations are implemented to secure data, then data security is improved, but processing complexity increases
Solution Approach 1:
The DSI mapping data structure serves as an intermediary that simplifies the relationship between encrypted requests and session attributes. By pre-establishing mappings between UIKs and session attributes, the system avoids complex real-time analysis of encrypted data structures, reducing processing complexity while maintaining security.
3Object-affected harmful factors
If encrypted database client requests are processed to maintain security, then data protection is improved, but session attribute propagation deteriorates
Solution Approach 1:
The patent uses the DSI mapping data structure as an intermediary that enables session attribute propagation through secure tiers. The mapping structure allows secure access local agents to retrieve and propagate session attributes associated with encrypted requests, maintaining information flow without compromising data protection.
Solution Approach 2:
The system performs preliminary mapping of UIKs to session attributes in advance, creating the DSI mapping data structure before encrypted requests arrive. This preliminary action enables rapid association of encrypted requests with their session attributes without complex real-time processing, thus maintaining both security and attribute propagation.
Data Source
AI summary
Mechanisms are provided for handling a database client request. An encrypted database client request (DCR) is received, by an unsecure access local agent, from a client computing device as part of a session between the client computing device and a database data processing system. The unsecure access local agent retrieves a database session information (DSI) address corresponding to the session and generates a first unique identifiable key (UIK) based on a portion of the encrypted DCR. The unsecure access local agent generates a DSI mapping data structure that maps the first UIK to the DSI address. A secure access local agent of the database data processing system processes the encrypted DCR using the DSI mapping data structure.