Method of query return data analysis for early warning indicators of possible security exposures

• US 20040088561A1
• Filed: 10/31/2002
• Published: 05/06/2004
• Est. Priority Date: 10/31/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Dettinger, Richard D., Stevens, Richard J.
• Granted Patent: US 6,928,554 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

System, method and article of manufacture for securing data. Queries are analyzed to detect security violation efforts. In one embodiment, algorithms for detecting selected security violation patterns are implemented. Generally, patterns may be detected prior to execution of a query and following execution of a query. Illustrative patterns include union query analysis, pare down analysis, non-overlapping and others.

Claims

1. A method of providing security with respect to data, comprising:

receiving a query issued against a database by a user; and

determining whether a security violation pattern exists based on at least one of;

(i) pre-execution comparative analysis of the query with respect to at least one other previously issued query from the user; and

(ii) post-execution comparative analysis of results returned from execution of the query and results returned from execution of the at least one other previously issued query.

2. The method of claim 1, wherein the at least one other previously issued query includes only those queries from a current logon session of the user.

3. The method of claim 1, wherein determining whether the security violation pattern exists based on step (i), comprises determining a relative commonality between the query and the at least one other previously issued query.

4. The method of claim 3, wherein determining whether the security violation pattern exists based on step (i), further comprises:

determining whether the relative commonality is less than a predefined value; and

if so, invoking a security rule.

5. The method of claim 3, wherein determining whether the security violation pattern exists based on step (ii), further comprises:

determining whether a number of common results between the results returned from execution of the query and the results returned from execution of the at least one other previously issued query decreased;

if so, determining whether the relative commonality is less than a predefined value, and if so, invoking a security rule.

6. The method of claim 1, wherein determining whether the security violation pattern exists based on step (i), comprises detecting that common query conditions of the query and the at least one other previously issued query are configured to return non-overlapping results.

7. The method of claim 1, wherein determining whether the security violation pattern exists based on step (i), comprises detecting a user'"'"'s attempt to acquire an unauthorized amount of a database as characterized by a presence of one or more common query conditions of the query and the at least one other previously issued query configured to return at least partially non-overlapping results.

8. The method of claim 1, wherein determining whether the security violation pattern exists based on step (i) is performed only if the query and the at least one other previously issued query are configured to access a common table column.

9. The method of claim 1, wherein determining whether the security violation pattern exists based on step (ii), comprises detecting the results returned from execution of the query and the results returned from execution of the at least one other previously issued query are non-overlapping.

10. The method of claim 1, wherein determining whether the security violation pattern exists based on step (ii), comprises detecting a pattern of results subsetting.

11. The method of claim 1, further comprising, if the security violation pattern exists, invoking a security rule.

12. The method of claim 11, wherein invoking the security rule upon determining that the security violation pattern exists after performing step (i), comprises terminating the query.

13. The method of claim 11, wherein invoking the security rule upon determining that the security violation pattern exists after performing step (ii), comprises withholding from the user the results returned from execution of the query.

14. A method of providing security with respect to data, comprising:

receiving a plurality of queries from a user;

executing the plurality of queries against a database;

receiving a subsequent query issued against the database by the user; and

based on the plurality of queries and the subsequent query, programmatically determining whether a user effort to access an unauthorized amount of data from the database is identifiable.

15. The method of claim 14, wherein programmatically determining comprises detecting that common query conditions of the subsequent query and the plurality of queries are configured to return at least partially non-overlapping results.

16. A method of providing security with respect to data, comprising:

receiving a plurality of queries from a user;

executing the plurality of queries against a database;

receiving a subsequent query issued against the database by the user;

executing the subsequent query; and

based on the plurality of queries and the subsequent query, programmatically determining whether a user effort to bypass security constraints preventing unique identification of individuals is identifiable.

17. The method of claim 16, wherein programmatically determining comprises:

determining a relative commonality between the subsequent query and the plurality of queries;

determining whether a number of common results between results returned from execution of the subsequent query and the results returned from execution of the plurality of queries decreased;

if so, determining whether the relative commonality is less than a predefined value, and if so, invoking a security rule.

18. The method of claim 16, wherein programmatically determining comprises detecting a pattern of results subsetting.

19. A method of providing security to data having a particular physical data representation, comprising:

providing a query specification comprising a plurality of logical fields for defining abstract queries;

providing mapping rules which map the plurality of logical fields to physical entities of the data;

providing security rules;

receiving an abstract query issued against the data by a user, wherein the abstract query is defined according to the query specification and is configured with at least one logical field value; and

analyzing the abstract query with respect to the at least one previously received abstract query from the user to detect an existence of security violation activity prompting invocation of a security rule.

20. The method of claim 19, wherein analyzing the abstract query and the at least one previously received abstract query from the user to detect an existence of security violation activity comprises performing a pre-execution comparative analysis of the abstract query and at least one other previously issued abstract query from the user

21. The method of claim 19, wherein analyzing the abstract query and the at least one previously received abstract query from the user to detect an existence of security violation activity comprises performing a post-execution comparative analysis of results returned from execution of the abstract query and results returned from execution of the at least one other previously issued abstract query.

22. The method of claim 19, further comprising:

detecting the existence of the security violation activity; and

invoking the security rule.

23. A computer-readable medium containing instructions which, when executed, perform a security violation identification operation, comprising:

receiving a query issued against a database by a user; and

determining whether a security violation pattern exists based on at least one of;

(i) pre-execution comparative analysis of the query with respect to at least one other previously issued query from the user; and

(ii) post-execution comparative analysis of results returned from execution of the query and results returned from execution of the at least one other previously issued query.

24. The computer-readable medium of claim 23, wherein the at least one other previously issued query includes only those queries from a current logon session of the user.

25. The computer-readable medium of claim 23, wherein determining whether the security violation pattern exists based on step (i), comprises determining a relative commonality between the query and the at least one other previously issued query.

26. The computer-readable medium of claim 25, wherein determining whether the security violation pattern exists based on step (i), further comprises:

determining whether the relative commonality is less than a predefined value; and

if so, invoking a security rule.

27. The computer-readable medium of claim 25, wherein determining whether the security violation pattern exists based on step (ii), further comprises:

determining whether a number of common results between the results returned from execution of the query and the results returned from execution of the at least one other previously issued query decreased;

if so, determining whether the relative commonality is less than a predefined value, and if so, invoking a security rule.

28. The computer-readable medium of claim 23, wherein determining whether the security violation pattern exists based on step (i), comprises detecting that common query conditions of the query and the at least one other previously issued query are configured to return non-overlapping results.

29. The computer-readable medium of claim 23, wherein determining whether the security violation pattern exists based on step (i), comprises detecting a user'"'"'s attempt to acquire an unauthorized amount of a database as characterized by a presence of one or more common query conditions of the query and the at least one other previously issued query configured to return at least partially non-overlapping results.

30. The computer-readable medium of claim 23, wherein determining whether the security violation pattern exists based on step (i) is performed only if the query and the at least one other previously issued query are configured to access a common table column.

31. The computer-readable medium of claim 23, wherein determining whether the security violation pattern exists based on step (ii), comprises detecting the results returned from execution of the query and the results returned from execution of the at least one other previously issued query are non-overlapping.

32. The computer-readable medium of claim 23, wherein determining whether the security violation pattern exists based on step (ii), comprises detecting a pattern of results subsetting.

33. The computer-readable medium of claim 23, further comprising, if the security violation pattern exists, invoking a security rule.

34. The computer-readable medium of claim 33, wherein invoking the security rule upon determining that the security violation pattern exists after performing step (i), comprises terminating the query.

35. The computer-readable medium of claim 33, wherein invoking the security rule upon determining that the security violation pattern exists after performing step (ii), comprises withholding from the user the results returned from execution of the query.

36. A computer-readable medium containing security validation instructions which, when executed, performs a security validation operation comprising:

receiving a plurality of plurality queries from a user;

executing the plurality of queries against a database;

receiving a subsequent query issued against the database by the user; and

based on the plurality of queries and the subsequent query, programmatically determining whether a user effort to access an unauthorized amount of data from the database is identifiable.

37. The computer-readable medium of claim 36, wherein programmatically determining comprises detecting that common query conditions of the subsequent query and the plurality of queries are configured to return at least partially non-overlapping results.

38. A computer-readable medium containing security validation instructions which, when executed, performs a security validation operation comprising:

receiving a plurality of queries from a user;

executing the plurality of queries against a database;

receiving a subsequent query issued against the database by the user;

executing the subsequent query; and

based on the plurality of queries and the subsequent query, programmatically determining whether a user effort to bypass security constraints preventing unique identification of individuals is identifiable.

39. The computer-readable medium of claim 38, wherein programmatically determining comprises:

determining a relative commonality between the subsequent query and the plurality of queries;

determining whether a number of common results between results returned from execution of the subsequent query and the results returned from execution of the plurality of queries decreased;

if so, determining whether the relative commonality is less than a predefined value, and if so, invoking a security rule.

40. The computer-readable medium of claim 38, wherein programmatically determining comprises detecting a pattern of results subsetting.

41. A computer-readable medium, comprising information stored thereon, the information comprising:

a query specification comprising a plurality of logical fields for defining abstract queries;

a plurality of mapping rules which map the plurality of logical fields to physical entities of data;

a plurality of security rules;

a runtime component executable to perform a security violation activity detection operation in response to receiving an abstract query issued against the data by a user, wherein the abstract query is defined according to the query specification and is configured with at least one logical field value, the security violation activity detection operation comprising;

receiving an abstract query issued against the data by a user, wherein the abstract query is defined according to the query specification and is configured with at least one logical field value; and

analyzing the abstract query with respect to at least one previously received abstract query from the user to detect an existence of security violation activity prompting invocation of a security rule.

42. The computer-readable medium of claim 41, wherein analyzing the abstract query and the at least one previously received abstract query from the user to detect an existence of security violation activity comprises performing a pre-execution comparative analysis of the abstract query and at least one other previously issued abstract query from the user.

43. The computer-readable medium of claim 41, wherein analyzing the abstract query and the at least one previously received abstract query from the user to detect an existence of security violation activity comprises performing a post-execution comparative analysis of results returned from execution of the abstract query and results returned from execution of the at least one other previously issued abstract query.

44. The computer-readable medium of claim 41, further comprising:

detecting the existence of the security violation activity; and

invoking the security rule.

45. The computer-readable medium of claim 41, wherein the security rule prevents execution of the abstract query.

46. The computer-readable medium of claim 41, wherein the security rule is defined to log receipt of the abstract query from the user.