Stored Function Protection With Database-Agnostic Gateway Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for securing server-side stored functions in network-based native client applications are complex, require database-specific digital signature management, and lack a universal, simplified method to monitor and protect these functions, making them vulnerable to attacks like SQL injection and data exposure.
Innovation Solution
A non-transitory computer readable medium and method for monitoring and securing stored functions by identifying sessions, generating signature representations, and comparing them with stored signatures to determine action allowance, using a database gateway or proxy that is agnostic to any particular database structure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital signatures and certificates are used to secure stored functions, then security is improved, but system complexity increases due to certificate management and access rights tracking
Solution Approach 1:
The patent introduces a gateway as an intermediary component that mediates between native clients and database servers. The gateway intercepts and validates requests containing stored function calls, performing security checks without requiring the database system itself to implement complex digital signature management. This intermediary approach centralizes security logic and simplifies the overall system architecture.
Solution Approach 2:
The patent extracts the security validation logic from the database server and relocates it to a separate gateway component. By taking out the complex certificate management and access rights tracking from the core database system, the patent reduces the complexity burden on the database while maintaining security functionality in the gateway layer.
2Reliability
If database-specific digital signature management is implemented, then security is improved, but adaptability decreases due to database structure dependencies
Solution Approach 1:
The patent creates a universal gateway that can secure stored functions across multiple different database systems. The gateway implements a standardized validation mechanism that works with various database structures and types, making the security solution adaptable and versatile rather than database-specific. This multi-functional approach allows the same gateway architecture to protect different database technologies.
Solution Approach 2:
Instead of making each database system implement its own security mechanism tailored to its specific structure, the patent inverts the approach by having a external gateway impose a unified security model on top of various databases. This inversion allows the security logic to be independent of database-specific implementations.
3Productivity
If server-side stored functions are used to improve performance, then productivity is improved, but security risks increase due to centralized attack vectors
Solution Approach 1:
The patent implements preliminary security validation in the gateway before requests reach the server-side stored functions. By performing security checks, validation, and authorization in advance at the gateway layer, the patent prevents malicious requests from executing harmful stored functions, thereby mitigating security risks while preserving the performance benefits of server-side processing.
Solution Approach 2:
The patent converts the potential harm of centralized stored functions into a benefit by using the gateway as a protective layer. The centralized nature of stored functions, which creates security risks, is transformed into an opportunity to implement centralized security validation at the gateway, turning the vulnerability into a controlled security architecture where all function calls are monitored and validated.
Data Source
AI summary
Disclosed embodiments relate to systems and methods for securing stored functions. Techniques include identifying a session between a network identity and a network resource, the network resource being associated with one or more stored functions; monitoring the session to identify a request to perform at least one action associated with at least one function of the one or more stored functions; generating, based on the request, a signature representation of the at least one function; comparing the generated signature representation of the at least one function with at least one stored signature representation of the at least one function; and determining whether to allow the at least one action based on the comparison.