Identifying attribute propagation for multi-tier processing

• US 8,141,100 B2
• Filed: 12/20/2006
• Issued: 03/20/2012
• Est. Priority Date: 12/20/2006
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Ben-Natan, Ron, Segal, Ury
• Primary Examiner(s): Sough, H. S.
• Assistant Examiner(s): WATHEN, BRIAN W
• Application Number:
  US11/642,432
• Publication Number:
  US 20100132024A1
• Time in Patent Office: 1,917 Days
• Field of Search: 719/313, 707/781, 707/782, 726/13, 726/22
• US Class Current: 719/313
• CPC Class Codes: G06F 2209/542 Intercept
• CPC Class Codes: G06F 9/545 where tasks reside in different layers, e.g. user- and kernel-space

Abstract

A multi-tier attribute tracking mechanism identifies end user credentials and other client information and attributes and assigns them to database requests in an application server architecture. Disclosed configurations identify the processing unit, or thread, assigned by the operating system to service the incoming request from the user at the application tier. A matching of users to threads allows successive thread activity to be mapped back to the initiating user. Conventional interception of database access attempts at the application level (“server taps,” or staps) identified only the database user (the account in the database) and associated connection as the responsible user. By intercepting, or “tapping” the access request at the operating system level (using kernel taps, or “ktaps”), the mechanism matches which application requests map to which database requests. With this matching, the database requests can be tagged with the user credentials which are known through the application request.

Claims

1. A computer-implemented method for propagating attributes comprising:

receiving a request to perform a processing operation at a computer system including an operating system, the request including an attribute indicative of an initiator of the request;

determining a processing thread associated with the request via the operating system, the processing thread operable to service the request;

identifying a processing operation performed by the determined processing thread for satisfying the request;

matching the processing operation to the request by identifying the processing thread common to the request and the processing operation, the common processing thread identified by intercepting in relation to an incoming port of the computer system a system call of the operating system to receive the request and intercepting in relation to an outgoing port of the computer system a system call of the operating system to perform the processing operation; and

mapping the common processing thread associated with the request to the processing operation being performed to service the request.

2. The method of claim 1 wherein the request corresponds to an attribute indicative of a responsible user and the processing operation includes a database call to access a database for satisfying the request.

3. The method of claim 2 wherein the attribute is a user identifier, further comprising receiving a user credential indicative of an operator corresponding to the user identifier.

4. The method of claim 1 wherein mapping further comprises:

identifying the attribute of the request;

storing an association of the attribute and the common processing thread; and

detecting a successive application function performed by the common processing thread as corresponding to the identified attribute.

5. The method of claim 4 wherein receiving the request and performing the processing operation occur on different application tiers, further comprising performing the processing operation on a tier in which the attribute is unavailable via propagation to the tier performing the processing operation.

6. The method of claim 4 wherein the request further comprises an inbound request including at least one of a connection request and a data request, the inbound request directed to a predetermined set of connections through which requests are channeled.

7. The method of claim 6 wherein the system call of the operating system to perform the processing operation is an outbound call to an outbound IPC portal operative to perform application functions on behalf of the identified attribute.

8. The method of claim 7 wherein intercepting the outbound call further comprises:

intercepting an invocation to a system routine for accessing the outbound IPC portal; and

matching the processing thread performing the outbound IPC portal access with the processing thread servicing the inbound request to perform application functions.

9. The method of claim 1 wherein receiving the request further comprises intercepting invocations to a system routine for instantiating the processing thread, the processing thread operable to perform a read via an interface resource to which the request is directed, receiving further comprising scrutinizing requests for at least one of a connection request and a query request.

10. The method of claim 7 wherein intercepting the outbound IPC portal access further comprises:

watching write operations to a port associated with the database, the port accessible via a socket responsive to the processing thread; and

identifying a user identifier corresponding to the processing thread, the processing thread assigned by the operating system for servicing the inbound request.

11. The method of claim 6 wherein matching the processing operation to the request further comprises:

listening to a set of ports designated as interface resources operable for database access and to a set of ports designated as interface resources operable for application requests;

intercepting a connection request to a socket bound to one of the ports in the set of ports designated as the interface resources operable for application requests as issued on behalf of a user;

determining the thread for servicing the connection request, the thread operable to service successive data access requests emanating from the same user; and

intercepting successive data access requests by watching socket writes to ports associated with the database made by the determined thread.

12. The method of claim 6 wherein the connection request includes a credential indicative of a user, further comprising:

retrieving user identification information from the credential;

identifying a session token corresponding to the user identification;

identifying successive data access requests corresponding to the session token; and

mapping the identified successive data access requests to the user via the session token.

13. The method of claim 6 wherein following intercepting an inbound connection request and identifying corresponding outgoing database requests, the corresponding outgoing database requests are performed by the same thread as the inbound request.

14. The method of claim 13 further comprising:

identifying incoming IPC mechanisms through which application requests emanate from a user;

identifying outgoing IPC mechanisms through which the database requests to the database are made; and

identifying the incoming and outgoing IPC mechanisms includes identifying a port against which a socket operation was executed.

15. A computer program product having a computer readable memory device storing an encoded set of processor based instructions that when executed by said processor perform a method of user identification via attribute propagation comprising:

receiving, from a user, a request to perform a function of an application;

extracting an attribute from the request;

intercepting in relation to an incoming port of the processor an inbound system call to service the request by an interprocess communication (IPC) portal;

determining, from the intercepted system call, a processing thread assigned to service the request;

watching operations performed by the assigned processing thread to capture database access attempts by the assigned processing thread;

intercepting in relation to an outgoing port of the processor an outbound system call to access the database by the assigned processing thread;

mapping the processing thread to the extracted attribute in the inbound system call;

associating the attribute to the access made by the assigned processing thread; and

logging the association of the database access attempt to the mapped attribute.

16. The computer program product of claim 15 wherein watching further comprises:

establishing a front end responsive to system calls;

filtering system calls by identifying calls made to access IPC portals associated with the database made by a watched processing thread; and

computing the processing thread assigned in response to the system calls.

17. The computer program product of claim 15 wherein intercepting the inbound system call to an IPC portal further comprises:

identifying a port employed by the requests to access the application;

identifying a request to bind a socket to the identified port; and

receiving connection requests on behalf of a user directed to the identified port.

18. A data security device for tracking database access attempts comprising:

a computer system comprising;

an operating system;

a monitor operable to receive an application request to perform an application function, the application request including an attribute;

a thread table operable to determine a processing thread associated with the application request, the processing thread operable to service the application request;

an interface to an interception layer operable to identify a database call performed by the determined processing thread for satisfying the application request via database access; and

a mapper operable to map the attribute to the database calls caused when servicing the request by identifying the processing thread common to the application request and database call, the common processing thread identified by intercepting in relation to an incoming port of the computer system a system call of the operating system to receive the request and intercepting in relation to an outgoing port of the computer system a system call of the operating system to send the database call, the mapper further operable to employ the thread table to map the common processing thread with the attribute included in the application request.

19. The device of claim 18 wherein the application request further comprises an inbound request including at least one of a connection request and a data request, the inbound request directed to a predetermined set of interface resources through which database access attempts are channeled.

20. The device of claim 19 wherein the database call is an outbound database call to an outbound IPC portal operative to access data in the database on behalf of a user corresponding to the attribute included in the application request.

21. The device of claim 20 wherein the interface for identifying the database call is further operable to:

intercept an invocation to a system routine for accessing the outbound IPC portal; and

match the processing thread performing the outbound IPC portal access with the processing thread performing the inbound application request.

22. The device of claim 19 wherein the monitor is operable to receive the application request by intercepting invocations to a system routine for instantiating the processing thread, the processing thread operable to perform a read via the interface resource to which the request is directed, receiving further comprising scrutinizing the application requests for at least one of a connection request and a query request.

23. The device of claim 20 wherein the interface to the interception layer is further operable to:

watch write operations to a port associated with the database, the port accessible via a socket responsive to the processing thread, wherein the monitor is operable to identify a user identifier corresponding to the processing thread, the processing thread further assigned by the operating system for servicing the inbound request.

24. The device of claim 20 wherein the monitor is further operable to:

listen to a set of ports designated as interface resources operable for database access;

listen to a set of ports designated as interface resources operable for application requests;

intercept a connection request to a socket, the socket bound to one of the ports in the set of ports designated as the interface resources operable for application requests, issued on behalf of a user;

determine the thread for servicing the connection request, the thread operable to service successive data access requests emanating from the same user; and

intercept successive data access requests by watching socket writes to ports associated with the database made by the determined thread.

25. The device of claim 20 wherein the connection request includes a credential indicative of the user, and wherein the monitor is further operable for:

retrieving user identification information from the credential;

identifying a session token corresponding to the user identification;

identifying successive data access requests corresponding to the session token;

mapping the identified successive data access requests to the user via the session token, such that following intercepting an inbound connection request and identifying corresponding outgoing database requests, the corresponding outgoing database requests are performed by the same thread as the inbound request; and

logging the data access requests correlated with the mapped user.

26. A computer program product having a computer readable memory device storing computer program logic embodied in computer program code encoded thereon for tracking database access comprising:

computer program code for receiving at a computer system with an operating system a request to access a database, the request including a user identifier;

computer program code for determining a thread associated with the request, the thread operable to service the request;

computer program code for identifying a database call performed by the determined thread for satisfying the request via database access;

computer program code for matching the database call to the request by identifying a thread common to the request and the database call, the common thread identified by intercepting in relation to an incoming port of the computer system a system call of the operating system to receive the request and intercepting in relation to an outgoing port of the computer system a system call of the operating system to perform the database access; and

computer program code for correlating the identified thread with the user identifier to identify the user responsible for the database access.

27. The computer program product of claim 26 further comprising computer program code for logging the database access correlated with the responsible user.