User Tracking Module for Web Database Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In web application environments, the stateless nature of HTTP protocols leads to security and performance issues due to the inability to track user identities at the database level, resulting in unregulated access and increased vulnerability to attacks like SQL injection, as users share the same database connection and privileges, making fine-grained access control and intrusion detection challenging.
Innovation Solution
An automatic system and method that tracks user requests by analyzing network traffic and logs between web application clients, servers, and databases, mapping user identities to their corresponding SQL statements without requiring changes to existing systems, utilizing a two-layer approach for network management and user tracking, which includes learning and real-time modes to identify and tag user actions and SQL queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If connection pooling is used to improve performance, then system performance is improved, but user tracking capability deteriorates
Solution Approach 1:
The patent introduces a user tracking module as an intermediary component between the connection pool and the database. This module intercepts SQL statements, correlates them with user identities using HTTP session data, and maintains a mapping without requiring changes to the connection pooling mechanism itself. The intermediary preserves performance while recovering user identity information that would otherwise be lost.
Solution Approach 2:
The patent adds a new dimension of user tracking by maintaining a separate mapping layer that correlates HTTP session identifiers with database user identities. This additional dimension allows the system to track user activities across pooled connections without interfering with the existing connection pooling performance optimization.
2Device complexity
If all users connect to the same database account to reduce complexity, then device complexity is reduced, but access control precision deteriorates
Solution Approach 1:
The patent implements a feedback mechanism where the user tracking module continuously monitors SQL statements executed through the connection pool, correlates them with user identities, and provides this information back to the access control system. This feedback loop enables precise access control decisions based on actual user activities while maintaining the simplified single database account connection model.
Solution Approach 2:
The user tracking module serves as an intermediary that bridges the gap between the simplified single database account model and the need for fine-grained access control. It captures user identity information from HTTP sessions and correlates it with database operations, enabling precise access control without requiring multiple database accounts or complex connection management.
3Adaptability or versatility
If connection pooling is implemented to support multiple users, then system adaptability is improved, but intrusion detection capability deteriorates
Solution Approach 1:
The user tracking module acts as an intermediary surveillance layer that monitors all SQL statements executed through the connection pool. It correlates each SQL statement with the corresponding user identity by matching HTTP session data with database connection information, enabling intrusion detection while preserving the adaptive multi-user connection pooling architecture.
Solution Approach 2:
The patent replaces the need for mechanical user tracking through multiple database accounts with an information processing approach. The user tracking module uses HTTP session correlation and SQL statement analysis to virtually associate users with their database operations, enabling intrusion detection without changing the underlying connection pooling mechanics.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention is a method and system that provides user tracking functionality for web databases. The system enables tracking of all activities from the end user through the Web application to the database, without requiring any changes in existing databases, and web applications. The user-tracking ability provided by the invention provides a basis for fine grained access control. Such user-tracking ability is required for the identification of logical sessions, which are crucial to intrusion detection techniques. The users tracking ability can be used to monitor the actual access privileges of users and can be used for role mining and role engineering. The latter application is extremely important for legacy applications.