Methods and systems for regulating database activity

• US 10,097,667 B2
• Filed: 12/29/2015
• Issued: 10/09/2018
• Est. Priority Date: 07/16/2012
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Wo, Zhaogang, Tejomurtula, Venkata Muralidhar, Patel, Maryann, Wong, Fang, Singh, Atul, Williams, Christopher, Nachnani, Pawan
• Primary Examiner(s): LE, DEBBIE M
• Application Number:
  US14/982,267
• Publication Number:
  US 20160112538A1
• Time in Patent Office: 1,015 Days
• Field of Search: None
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70

Abstract

Methods and systems are provided for regulating access to a database by a server. One exemplary method involves the server receiving one or more requests for an activity with respect to the database and determining an attempted usage for the activity over a monitoring period by a source of the requests. When the attempted usage exceeds an allowed usage of the activity for the monitoring period, the server creates an entry in a cache that includes an identifier associated with the source of the one or more requests. Thereafter, the requested activity with respect to the database on behalf of the source may be prevented based on the entry in the cache.

Claims

1. A method of regulating access to a database by a server coupled to the database, the method comprising:

receiving, by the server, one or more requests for an activity;

determining, by the server, an attempted usage for the activity over a monitoring period by a source of the one or more requests, the attempted usage comprising a counted number of requests for the activity received from the source during a preceding time interval equal to the monitoring period; and

creating, by the server, an entry in a cache when the attempted usage exceeds an allowed usage for the activity for the monitoring period, wherein;

the entry includes an identifier associated with the source of the one or more requests; and

the allowed usage comprises an allowed number of requests for the activity for the monitoring period.

2. The method of claim 1, further comprising initiating a human verification test when the attempted usage exceeds the allowed usage for the activity for the monitoring period, wherein the server creates the entry in response to receiving an unsatisfactory response to the human verification test from the source.

3. The method of claim 1, further comprising updating the database to indicate the source has been blocked.

4. The method of claim 1, further comprising updating a database record associated with the source and maintained by the database to indicate the source has been prevented from initiating the activity.

5. The method of claim 1, further comprising authenticating, by the server, the source prior to receiving the one or more requests.

6. The method of claim 5, wherein authenticating the source comprises verifying login information for a user of a client device coupled to the server via the network matches stored login information associated with the user in the database, the one or more requests being received from the client device.

7. The method of claim 6, wherein the identifier comprises a user identifier associated with the user.

8. The method of claim 1, further comprising determining, by the server, a second attempted usage for the activity over a second monitoring period by the source of the one or more requests, the second monitoring period being different from the monitoring period, wherein creating the entry comprises creating the entry in the cache when either the attempted usage exceeds the allowed usage for the activity for the monitoring period or the second attempted usage exceeds a second allowed usage for the activity for the second monitoring period.

9. The method of claim 8, wherein:

the counted number comprises a first counted number of requests for the activity received from the source during a first preceding time interval equal to the monitoring period;

the second attempted usage comprises a second counted number of requests for the activity received from the source during a second preceding time interval equal to the second monitoring period;

the allowed number comprises a first allowed number of requests for the monitoring period;

the second allowed usage comprises a second allowed number of requests for the second monitoring period; and

the server automatically initiates the activity with respect to the database when the first counted number is less than the first allowed number of requests and the second counted number is less than the second allowed number of requests.

10. The method of claim 1, wherein:

the server automatically initiates the activity with respect to the database when the counted number is less than the allowed number of requests for the activity for the monitoring period;

the server provides a human verification test to the source when the counted number is greater than the allowed number of requests;

the server continues creates the entry in response to receiving an unsatisfactory response to the human verification test from the source; and

the server continues servicing the one or more requests in response to receiving a satisfactory response to the human verification test from the source.

11. The method of claim 1, wherein determining the attempted usage comprises:

generating a cache key based at least in part on the activity, the source, and the monitoring period; and

accessing a second cache coupled to the server to obtain the counted number of requests for the activity associated with a second entry in the second cache matching the cache key.

12. The method of claim 11, wherein generating the cache key comprises:

calculating a window value based on a current reference time for the server and the monitoring period; and

appending the window value to a first value indicative of the activity and a second value indicative of the source.

13. The method of claim 12, wherein calculating the window value comprises:

dividing the current reference time for the server by the monitoring period to obtain a quotient; and

performing a modulus operation on the quotient, wherein the window value comprises a residue of the modulus operation.

14. The method of claim 11, further comprising:

incrementing the counted number of requests; and

after incrementing the counted number;

providing, by the server, a human verification test to the source when the counted number exceeds the allowed number of requests for the activity for the monitoring period; and

initiating, by the server, the activity with respect to the database in response to receiving, from the source, a satisfactory response to the human verification test.

15. The method of claim 1, further comprising:

calculating a resumption time indicative of when the source can resume initiating the activity with respect to the database based on a current reference time for the server, wherein the entry maintains an association between the source and the resumption time; and

preventing the activity with respect to the database on behalf of the source until the calculated resumption time.

16. The method of claim 1, further comprising:

receiving, by the server, a plurality of requests for the activity from a plurality of sources;

determining a confidence interval for a number of requests per source over the monitoring period based on the plurality of requests; and

determining an upper limit of the confidence interval as the allowed number of requests for the activity for the monitoring period.

17. A computing system comprising:

a database;

a cache; and

a server coupled to the database and the cache to receive, from a source via a network, one or more requests for an activity with respect to the database, determine an attempted usage by the source for the activity over a preceding duration of time equal to a monitoring period exceeds an allowed usage for the activity for the monitoring period, and create an entry in the cache when the attempted usage exceeds the allowed usage for the activity for the monitoring period, wherein the entry includes an identifier associated with the source of the one or more requests.

18. The computing system of claim 17, wherein the allowed usage comprises an upper limit of a confidence interval for a number of requests per source over the monitoring period determined based on a plurality of requests received from a plurality of sources.

19. The computing system of claim 17, wherein the source comprises a user of a client device coupled to the network, the user being previously authenticated based on login information received from the client device prior to the server receiving the one or more requests.

20. A computer-readable medium comprising computer-executable instructions that, when executed by a processing system, cause the processing system to:

determine an attempted usage over a monitoring period for an activity with respect to a database by a source in response to receiving one or more requests for the activity from the source;

initiate the activity with respect to the database when the attempted usage does not exceed an allowed usage for the activity for the monitoring period; and

create an entry in a cache coupled to the processing system when the attempted usage exceeds the allowed usage for the activity for the monitoring period, wherein the entry includes an identifier associated with the source of the one or more requests.