METHODS AND SYSTEMS FOR IMPLEMENTING A SELF DEFENDING/REPAIRING DATABASE

• US 20100306826A1
• Filed: 05/29/2009
• Published: 12/02/2010
• Est. Priority Date: 05/29/2009
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Lysy, Kurt, Kestner, Peter
• Granted Patent: US 8,407,788 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 11/1448 Management of the data involved in backup or backup restore
• CPC Class Codes: G06F 21/554 involving event detection and direct action

Abstract

This disclosure describes, generally, methods and systems for self defending and repairing a database. The method includes monitoring, at a database server, code modifications to a database management application. The database management application is configured to maintain the database. The method further includes determining that a code modification has occurred to the database management application. The method further includes checking the code modification for the presence of an authorization key, and in response to an invalid or non-existent authorization key, determining that the code modification is unauthorized. Further, the method includes quarantining the modified code in a secure storage location, and automatically accessing original code of the database management application and replacing the modified code with code from the original code of the database management application.

Claims

1. A method of self defending and repairing a database, the method comprising:

monitoring, at a database server, code modifications to a database management application, wherein the database management application is configured to maintain the database;

determining that a code modification has occurred to the database management application;

checking the code modification for the presence of an authorization key;

in response to an invalid or non-existent authorization key, determining that the code modification is unauthorized;

quarantining the modified code in a secure storage location; and

automatically accessing original code of the database management application and replacing the modified code with code from the original code of the database management application.

2. The method of claim 1, further comprising identifying a code structure associated with the code modification.

3. The method of claim 1, further comprising:

determining if an auditing mode for the database is engaged; and

in response to the auditing mode being engaged, allowing the code modification to occur in order to track the intruder'"'"'s actions.

4. The method of claim 1, further comprising storing a secure mirror copy of the original source code.

5. The method of claim 4, wherein the secure mirror copy and the secure storage location are stored using a high security storage mechanism.

6. The method of claim 4, wherein the original source code is accessed at the secure mirror copy.

7. The method of claim 1, wherein, in response to a valid authorization key, the code modification is allowed to remain.

8. The method of claim 7, wherein the code modification is determined to be an authorized update and/or patch to the database management application.

9. The method of claim 1, further comprising:

logging code modification activities; and

storing the logged activities in an instruction log file.

10. The method of claim 1, further comprising installing, at the database server, a database security component.

11. The method of claim 10, initializing the database security component.

12. The method of claim 11, wherein the initializing of the database security component comprises storing a secure mirror copy of the original source code.

13. The method of claim 12, wherein the database security component is configured to monitor the code modifications and replace the modified code with the original code.

14. A system for self defending and repairing a database, the system comprising:

a database configured to store data;

a secure storage location; and

a database server coupled with the database and the secure storage location, the database server including a security component, wherein the security component is configured to monitor code modifications to a database management application, wherein the database management application is configured to maintain the database, determine that a code modification has occurred to the database management application, check the code modification for the presence of an authorization key, in response to an invalid or non-existent authorization key, determine that the code modification is unauthorized, quarantining the modified code in the secure storage location, and automatically access original code of the database management application and replace the modified code with code from the original code of the database management application.

15. The system of claim 14, further comprising a safe mirror copy storage location coupled with the database server, wherein the safe mirror copy is configured to store a secure mirror copy of the original source code.

16. A machine-readable medium having sets of instructions stored thereon for self defending and repairing a database which, when executed by a machine, cause the machine to:

monitor, at a database server, code modifications to a database management application, wherein the database management application is configured to maintain the database;

determine that a code modification has occurred to the database management application;

check the code modification for the presence of an authorization key;

in response to an invalid or non-existent authorization key, determine that the code modification is unauthorized;

quarantine the modified code in a secure storage location; and

automatically access original code of the database management application and replace the modified code with code from the original code of the database management application.

17. The machine-readable medium of claim 16, wherein the sets of instructions, when further executed by the machine, cause the machine to identify a code structure associated with the code modification.

18. The machine-readable medium of claim 16, wherein the sets of instructions, when further executed by the machine, cause the machine to:

determine if an auditing mode for the database is engaged; and

in response to the auditing mode being engaged, allow the code modification to occur in order to track the intruder'"'"'s actions.

19. The machine-readable medium of claim 19, wherein the sets of instructions, when further executed by the machine, cause the machine to store a secure mirror copy of the original source code.

20. The machine-readable medium of claim 19, wherein the secure mirror copy and the secure storage location are stored using a high security storage mechanism.