Methods and systems for implementing a self defending/repairing database

• US 8,918,869 B2
• Filed: 02/25/2013
• Issued: 12/23/2014
• Est. Priority Date: 05/29/2009
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Kestner, Peter, Lysy, Kurt
• Primary Examiner(s): Chea, Philip
• Assistant Examiner(s): Johnson, Carlton
• Application Number:
  US13/776,632
• Publication Number:
  US 20130166512A1
• Time in Patent Office: 666 Days
• Field of Search: None
• US Class Current: 726/22
• CPC Class Codes: G06F 11/1448 Management of the data involved in backup or backup restore
• CPC Class Codes: G06F 21/554 involving event detection and direct action

Abstract

This disclosure describes, generally, methods and systems for self defending and repairing a database. The method includes monitoring, at a database server, code modifications to a database management application. The database management application is configured to maintain the database. The method further includes determining that a code modification has occurred to the database management application. The method further includes checking the code modification for the presence of an authorization key, and in response to an invalid or non-existent authorization key, determining that the code modification is unauthorized. Further, the method includes quarantining the modified code in a secure storage location, and automatically accessing original code of the database management application and replacing the modified code with code from the original code of the database management application.

Claims

1. A method of self-defending and repairing a database, the method comprising:

installing, at a database server, a database security component;

configuring the database security component in a self-defense mode to monitor database management applications and/or software running on the database server and to immediately identify and repair any modifications to the database management applications and/or software;

initializing the database security component, wherein the initializing of the database security component includes;

storing a secure mirror copy of the original source code in a secure, read-only and encrypted storage location, wherein the database security component is configured to monitor the code modifications and replace the modified code with the original code;

continuously monitoring, at the database server by the security component, for any code modifications to the database management applications and/or software, wherein the database management applications and/or software are configured to maintain the database;

determining that a code modification has occurred to the database management applications and/or software;

checking the code modification for the presence of an authorization key;

in response to an invalid or non-existent authorization key, determining that the code modification is unauthorized;

quarantining the modified code in a secure storage location; and

automatically accessing the original code of the database management applications and/or software from the secure mirror copy of the original source code and replacing the modified code with code from the secure mirror copy of the original code of the database management applications and/or software.

2. The method of claim 1, further comprising identifying a code structure associated with the code modification.

3. The method of claim 1, further comprising:

determining if an auditing mode for the database is engaged; and

in response to the auditing mode being engaged, allowing the code modification to occur in order to track the intruder'"'"'s actions.

4. The method of claim 1, wherein, in response to a valid authorization key, the code modification is allowed to remain.

5. The method of claim 4, wherein the code modification is determined to be an authorized update and/or patch to the database management applications and/or software.

6. The method of claim 1, further comprising:

logging code modification activities; and

storing the logged activities in an instruction log file.

7. The method of claim 1, further comprising replacing the modified code with the original code prior to executing of the modified code.

8. A system for self-defending and repairing a database, the system comprising:

a database configured to store data;

a secure storage location; and

a database server coupled with the database and the secure storage location, the database server including;

a security component, wherein the database server is configured to;

install the database security component,

configure the database security component in a self-defense mode to monitor database management applications and/or software running on the database server, and

immediately identify and repair any modifications to the database management applications and/or software, initialize the database security component,

wherein the initializing of the database security component includes;

storing a secure mirror copy of the original source code in a secure, read-only and encrypted storage location, wherein the database security component is configured to monitor the code modifications and replace the modified code with the original code, and wherein the security component is configured to continuously monitor code modifications to the database management applications and/or software, wherein the database management applications and/or software are configured to maintain the database,

determine that a code modification has occurred to the database management applications and/or software,

check the code modification for the presence of an authorization key, in response to an invalid or non-existent authorization key,

determine that the code modification is unauthorized,

quarantine the modified code in the secure storage location, and automatically access the original code of the database management applications and/or software from the secure mirror copy of the original source code, and

replace the modified code with code from the secure mirror copy of the original code of the database management applications and/or software.

9. The system of claim 8, wherein the security component is further configured to identify a code structure associated with the code modification.

10. The system of claim 8, wherein the security component is further configured to determine if an auditing mode for the database is engaged, and in response to the auditing mode being engaged, allow the code modification to occur in order to track the intruder'"'"'s actions.

11. The system of claim 8, wherein, in response to a valid authorization key, the code modification is allowed to remain.

12. The system of claim 11, wherein the code modification is determined to be an authorized update and/or patch to the database management applications and/or software.

13. The system of claim 8, wherein the security component is further configured to log code modification activities, and store the logged activities in an instruction log file.

14. The system of claim 8, wherein the security component is further configured to replace the modified code with the original code prior to executing of the modified code.

15. A non-transitory machine-readable medium having sets of instructions stored thereon for self-defending and repairing a database which, when executed by a machine, cause the machine to:

install, at a database server, a database security component;

configure the database security component in a self-defense mode to monitor database management applications and/or software running on the database server and to immediately identify and repair any modifications to the database management applications and/or software;

initialize the database security component, wherein the initializing of the database security component includes;

store a secure mirror copy of the original source code in a secure, read-only and encrypted storage location, wherein the database security component is configured to monitor the code modifications and replace the modified code with the original code;

continuously monitor, at the database server by the security component, for any code modifications to the database management applications and/or software, wherein the database management applications and/or software are configured to maintain the database;

determine that a code modification has occurred to the database management applications and/or software;

check the code modification for the presence of an authorization key;

in response to an invalid or non-existent authorization key, determine that the code modification is unauthorized;

quarantine the modified code in a secure storage location; and

automatically access the original code of the database management applications and/or software from the secure mirror copy of the original source code and replacing the modified code with code from the secure mirror copy of the original code of the database management applications and/or software.

16. The non-transitory machine-readable medium of claim 15, wherein the sets of instructions, when further executed by the machine, cause the machine to identify a code structure associated with the code modification.

17. The non-transitory machine-readable medium of claim 15, wherein the sets of instructions, when further executed by the machine, cause the machine to:

determine if an auditing mode for the database is engaged; and

in response to the auditing mode being engaged, allow the code modification to occur in order to track the intruder'"'"'s actions.

18. The non-transitory machine-readable medium of claim 15, wherein in response to a valid authorization key, the code modification is allowed to remain.

19. The non-transitory machine-readable medium of claim 15, wherein the sets of instructions, when further executed by the machine, cause the machine to:

log code modification activities; and

store the logged activities in an instruction log file.

20. The non-transitory machine-readable medium of claim 15, wherein the sets of instructions, when further executed by the machine, cause the machine to replace the modified code with the original code prior to executing of the modified code.