Selective local database access restriction

• US 7,970,788 B2
• Filed: 08/02/2005
• Issued: 06/28/2011
• Est. Priority Date: 08/02/2005
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Tarandach, Izar, Ben-Natan, Ron
• Primary Examiner(s): Radtke; Mark A
• Application Number:
  US11/195,387
• Publication Number:
  US 20100131512A1
• Time in Patent Office: 2,156 Days
• Field of Search: 707/782
• US Class Current: 707/782
• CPC Class Codes: G06F 16/217 Database tuning G06F16/2282 takes precedence; database performance monitoring G06F11/3409
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6236 between heterogeneous systems

Abstract

A nonintrusive database access monitoring mechanism employs a hybrid approach that disallows, or blocks, the access mediums which are not feasible to intercept or analyze, as well as intercepting and analyzing access mediums for which interception and interrogation is available. Accordingly, various configurations provide the hybrid coverage approach to identifying access mediums, and either block or intercept the access attempts. In this manner, access mediums, such as interprocess communication (IPC) system calls, which may be efficiently intercepted and analyzed are captured and substantively processed, while other access mediums that are excessively burdensome or intrusive to capture are unselectively blocked from any communication, avoiding the need to analyze such access attempts.

Claims

1. A method of providing nonintrusive database security comprising:

identifying a plurality of access mediums operable to provide local access to a database in response to access attempts from a user, the identified access mediums including local access mediums emanating from a local server, the local server in direct communication with the database;

enumerating, for each of the identified access mediums, an access control mechanism operable to limit access attempts made via the access medium, and enumerating comprising covering all access attempts to the database emanating on the local server;

identifying local access attempts to the database made via the enumerated access mediums, the local access attempts employing a local client for database access, the local client defined by a local process independent of a disposition of an initiating user query device;

applying, to each of the identified access mediums, the enumerated access control mechanism, each of the enumerated access control mechanisms applicable to a subset of the identified access mediums; and

restricting the identified local access attempt made via the access medium in accordance with the enumerated control mechanism for that access medium, restricting further comprising performing at least one of preventing the access medium from making the access attempt in response to that access medium not being interceptable and reporting the access attempt made via the access medium for further analysis.

2. The method of claim 1 wherein enumerating further comprises:

determining if the access medium is responsive to an interceptor operable to retrieve and analyze access attempts made via the access medium.

3. The method of claim 2 wherein applying further comprises:

intercepting, if the access medium is responsive to the interceptor, the access attempt for selective access analysis; and

preventing, if the access medium is not responsive to the interceptor, access attempts via the enumerated access medium.

4. The method of claim 3 wherein preventing further comprises:

identifying access mediums which are not interceptable; and

preventing access for each of the access mediums which are not interceptable.

5. The method of claim 1 wherein applying further comprises eliminating a potential threat from each of the enumerated access mediums by at least one of

intercepting access attempts made via the enumerated access medium;

and

preventing usage of the enumerated access medium.

6. The method of claim 1 wherein applying the enumerated access control mechanism further comprises:

collecting access attempts and either blocking or enumerating the access attempts; and

transmitting the collected access attempts to a collector.

7. The method of claim 1 wherein the identified access mediums include local access mediums and remote access mediums, the local access mediums defined by interprocess communication mechanisms that initiate and terminate on the local server.

8. The method of claim 1 wherein the local access mediums define a virtual or physical path to the local server, the local server accessing interprocess communication mechanisms employed by an operating system for local access to the database.

9. The method of claim 1 wherein the local access attempts invoke an access medium defined by an IPC mechanism on the local server, the local access attempt initiated by a proximate user, the proximate user achieving access via a local device such that the local device circumvents a perimeter security approach.

10. The method of claim 1 wherein the access mediums include at least one of shared memory, Unix sockets, pipes, file handles, Windows LPC and Named pipes.

11. The method of claim 1 wherein local accesses are intercepted by interceding in an access path defined by an access medium from local processes.

12. The method of claim 11 wherein the local accesses are undetectable by remote parsing or stream based interrogation of an incoming network connection.

13. The method of claim 1 wherein identifying the plurality of access mediums further comprises defining a hybrid coverage approach which either blocks or intercepts access attempts, the hybrid coverage performing, for the identified access mediums, at least one of:

capturing and processing access mediums which may be intercepted; and

unselectively blocking access mediums which cannot be intercepted, such that a need for capture and analysis is avoided.

14. The method of claim 13 further comprising, if an access medium is determined non-interceptable, blocking disallowed access mediums for which scrutinized access is not attainable.

15. The method of claim 14 wherein enumerating the access mediums further comprises storing an access matrix denoting each access medium as interceptable and non interceptable, and intercepting or terminating affected processes.

16. A method for preventing unauthorized access to a database comprising:

identifying a plurality of access mediums to a protected database, the identified access mediums including local access mediums emanating from a local server, the local server in direct communication with the database;

determining access mediums responsive to an interrogative process and enumerating access mediums responsive to the interrogative process, the interrogative process operable to intercept access attempts made via the enumerated access mediums;

generating an access medium repository, wherein, for each of the enumerated access mediums, the access medium repository indicates the access mediums which the interrogative process is operable to intercept and analyze access attempts made via the respective access medium, wherein the access mediums are local access mediums emanating from a local server in direct communication with the database, the local access mediums defined by interprocess communication mechanisms emanating and terminating on the local server; and

blocking access to the protected database from access mediums nonresponsive to the interrogative process by prohibiting activity conducted via the nonresponsive access mediums.

17. The method of claim 16 further comprising:

identifying local access attempts to the database via the enumerated access mediums; and

intercepting the local access attempt, wherein intercepting further comprises performing at least one of preventing the access attempt and reporting the access attempt for further analysis.

18. The method of claim 17 further comprising:

intercepting access attempts to the database to selectively allow the access attempts;

reporting the intercepted access attempts to an analyzer; and

analyzing the access attempts to determine whether to allow the access attempt.

19. The method of claim 17 wherein the local access medium further comprises at least one of shared memory and a file structure.

20. The method of claim 19 further comprising:

identifying file handles in use for accessing a file structured device;

computing multiple processes accessing the same identified handle; and

terminating processes sharing the same file handle as the database.

21. The method of claim 19 further comprising:

identifying access mediums corresponding to shared memory segments in use;

computing processes employing the same shared memory segment as the database; and

terminating the computed process employing the same shared memory segment as the database.

22. The method of claim 19 further comprising modifying a library path operable for accessing an access method to the database by inserting an interceptor process in the library path operable to receive and analyze access attempts via the access method.

23. The method of claim 17 further comprising:

identifying a set of database login attempts for a particular period;

gathering reported logins collected from a particular access medium; and

comparing the identified database login attempts with the gathered logins to identify discrepancies indicative of potentially suspect login attempts.

24. A method of tracking database access comprising:

enumerating access mediums providing local access to a database via a local server, the enumerated access mediums including local access mediums emanating from the local server, the local server in direct communication with the database;

determining, for each of the enumerated access mediums, whether access attempts are interceptable for each particular access medium for retrieval and analysis of the access attempts

identifying local access attempts to the database made via the enumerated access mediums, the local access attempts occurring via interprocess communication mechanisms emanating and terminating on the local server,

collecting, for each of the interceptable access attempts, the access attempt; and

preventing access to the database for each of the access mediums which are not interceptable, preventing further comprising performing at least one of preventing the access attempt and reporting the access attempt for further analysis.

25. A server for monitoring database access comprising:

a processor;

a memory coupled to the processor;

a first process for intercepting database access attempts;

a second process for preventing database access attempts, the first process and the second process executable in the memory by the processor;

an enumeration of available access mediums, each of the enumerated access mediums responsive to at least one of the first process and the second process to limit access attempts made on that access medium, the enumerated access mediums including local access mediums emanating from the local server, the local server in direct communication with the database, and the enumeration covering all access attempts to the database emanating on the local server; and

an access controller for identifying local access attempts made via the local access mediums and employing the enumeration to determine applicability of the first and second process, and further for invoking at least one of the first and second processes for limiting the local access attempt made via the access medium, the local access attempts occurring via interprocess communication mechanisms emanating and terminating on the local server, the access controller further restricting the identified access attempt, restricting further comprising performing at least one of preventing the local access attempt made via the access medium in response to that access medium not being interceptable and reporting the local access attempt made via the access medium for further analysis.

26. The server of claim 25 wherein the enumeration is an access matrix adapted to indicate if the access medium is responsive to the first process, the first process further operable to retrieve and analyze access attempts made via the access medium.

27. The server of claim 26 wherein the first and second processes are responsive to the access controller for:

intercepting, if the access medium is responsive to the first process, the access attempt for selective access analysis; and

preventing, if the access medium is not responsive to the first process, access attempts via the enumerated access medium.

28. The server of claim 27 wherein the access controller:

identifies access mediums which are not interceptable; and

prevents access via the particular access medium for each of the access mediums which are not interceptable.

29. The server of claim 25 wherein the access controller eliminates a potential threat from each of the enumerated access mediums by at least one of:

intercepting the access attempts made via the enumerated access medium; and

preventing usage of the enumerated access medium.

30. A computer program product having a computer readable storage medium operable to store computer program logic embodied in computer program code encoded thereon that, when executed by a processor, cause the computer to perform a method for providing local database security, the method comprising:

identifying a plurality of access mediums operable to provide local access to a database via access attempts from a user, the identified access mediums including local access mediums emanating from a local server, the local server in direct communication with a database;

enumerating, for each of the identified access mediums, an access control mechanism operable to limit access attempts made via the access medium, and enumerating comprising covering all access attempts to the database emanating on the local server;

identifying local access attempts to the database via the enumerated access mediums, the local access attempts occurring via interprocess communication mechanisms emanating and terminating on the local server;

applying, to each of the identified access mediums, the enumerated access control mechanism, each of the enumerated access control mechanisms applicable to a subset of the identified access mediums, applying the enumerated access control mechanism to the access attempts further including;

collecting access attempts made via the access medium and either blocking the access medium in response to that access medium not being interceptable or recording the access attempts; and

transmitting the recorded access attempts to a collector operable to analyze the collected access attempts.

31. A method of providing nonintrusive database security comprising:

identifying a plurality of access mediums operable to provide local access to a database via access attempts from a user, the identified access mediums including local access mediums emanating from a local server, the local server in direct communication with the database;

enumerating, for each of the identified access mediums, an access control mechanism operable to limit access attempts made via the access medium, each access medium having a corresponding prevention measure, and enumerating comprising covering all access attempts to the database emanating on the local server;

generating, from a configuration file, an access matrix having an entry for each of a combination of operating systems and local access mediums, the access matrix indicating the corresponding prevention measure to be invoked for each combination, the local access mediums defined by interprocess communication mechanisms emanating and terminating on the local server;

indexing the access matrix based on the local access medium and the operating system; and

applying, to each of the identified access mediums, the enumerated access control mechanism to limit access attempts made via the access medium, each of the enumerated access control mechanisms applicable to a subset of the identified access mediums, limiting further comprising performing at least one of preventing the access attempt made via the access medium in response to that access medium not being interceptable and reporting the access attempt made via the access medium for further analysis.