MULTI-LAYER SYSTEM FOR PRIVACY ENFORCEMENT AND MONITORING OF SUSPICIOUS DATA ACCESS BEHAVIOR

• US 20140165202A1
• Filed: 02/17/2014
• Published: 06/12/2014
• Est. Priority Date: 02/18/2005
• Status: Active Grant

• Current Assignee: Protegrity USA, Inc. (Xcelera Inc.)
• Original Assignee: Protegrity USA, Inc. (Xcelera Inc.)
• Inventors: Mattsson, Ulf
• Granted Patent: US 8,935,787 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A method for controlling data access in a data-at-rest system includes executing a link intrusion prevention analysis between multiple layers of the data-at-rest system, introducing a privacy policy at enforcement points that span multiple system layers, and dynamically altering the privacy policy.

Claims

1. A method for controlling data access in a database, the method comprising:

receiving a request for data at an application layer of a database, the database comprising the application layer, a table layer, and a file layer, and the requested data residing in one or more data files stored at the file layer;

performing, by a processing system, a first intrusion detection analysis at the application layer to determine whether the received data request comprises an application layer intrusion;

performing, by the processing system, a second intrusion detection analysis at the table layer to determine whether the received data request comprises a table layer intrusion; and

granting access to the requested data in response to a determination that the received data request does not comprise an application layer intrusion or a table layer intrusion.

2. The method of claim 1, wherein the request for data is received from a user associated with an access history, and wherein performing a first intrusion detection analysis at the application layer comprises:

determining a user role associated with the user, the user role associated with a first access criterion at the application layer; and

comparing, at the application layer, the user'"'"'s access history to the first access criterion to determine whether the received data request comprises an application layer intrusion.

3. The method of claim 2, wherein the user role is further associated with a second access criterion at the table layer, and wherein performing a second intrusion detection analysis at the table layer comprises:

comparing, at the table layer, the user'"'"'s access history to the second access criterion to determine whether the received data request comprises a table layer intrusion.

4. The method of claim 1, wherein the first and second access criteria each comprise at least one of:

session authorization, session authentication, session encryption, password integrity, software integrity, application data integrity, database metadata integrity, security software integrity, time of day, and signature rules.

5. The method of claim 1, further comprising modifying the protection of data at one or more of the application layer or the table layer based on a result of one or more of the first intrusion detection analysis and the second intrusion detection analysis.

6. A non-transitory computer-readable storage medium containing computer-executable instructions for controlling data access in a database, the instructions configured to, when executed, cause a computer to perform steps comprising:

receiving a request for data at an application layer of a database, the database comprising the application layer, a table layer, and a file layer, and the requested data residing in one or more data files stored at the file layer;

performing a first intrusion detection analysis at the application layer to determine whether the received data request comprises an application layer intrusion;

performing a second intrusion detection analysis at the table layer to determine whether the received data request comprises a table layer intrusion; and

granting access to the requested data in response to a determination that the received data request does not comprise an application layer intrusion or a table layer intrusion.

7. The computer-readable storage medium of claim 6, wherein the request for data is received from a user associated with an access history, and wherein performing a first intrusion detection analysis at the application layer comprises:

determining a user role associated with the user, the user role associated with a first access criterion at the application layer; and

comparing, at the application layer, the user'"'"'s access history to the first access criterion to determine whether the received data request comprises an application layer intrusion.

8. The computer-readable storage medium of claim 7, wherein the user role is further associated with a second access criterion at the table layer, and wherein performing a second intrusion detection analysis at the table layer comprises:

comparing, at the table layer, the user'"'"'s access history to the second access criterion to determine whether the received data request comprises a table layer intrusion.

9. The computer-readable storage medium of claim 6, wherein the first and second access criteria each comprise at least one of:

session authorization, session authentication, session encryption, password integrity, software integrity, application data integrity, database metadata integrity, security software integrity, time of day, and signature rules.

10. The computer-readable storage medium of claim 6, the instructions configured to, when executed, cause a computer to perform further steps comprising modifying the protection of data at one or more of the application layer or the table layer based on a result of one or more of the first intrusion detection analysis and the second intrusion detection analysis.

11. A system for controlling data access in a database, the system comprising:

a non-transitory computer-readable storage medium containing executable instructions configured to, when executed, perform steps comprising;

receiving a request for data at an application layer of a database, the database comprising the application layer, a table layer, and a file layer, and the requested data residing in one or more data files stored at the file layer;

performing a first intrusion detection analysis at the application layer to determine whether the received data request comprises an application layer intrusion;

performing a second intrusion detection analysis at the table layer to determine whether the received data request comprises a table layer intrusion; and

granting access to the requested data in response to a determination that the received data request does not comprise an application layer intrusion or a table layer intrusion; and

a processor configured to execute the instructions.

12. The system of claim 11, wherein the request for data is received from a user associated with an access history, and wherein performing a first intrusion detection analysis at the application layer comprises:

determining a user role associated with the user, the user role associated with a first access criterion at the application layer; and

comparing, at the application layer, the user'"'"'s access history to the first access criterion to determine whether the received data request comprises an application layer intrusion.

13. The system of claim 12, wherein the user role is further associated with a second access criterion at the table layer, and wherein performing a second intrusion detection analysis at the table layer comprises:

comparing, at the table layer, the user'"'"'s access history to the second access criterion to determine whether the received data request comprises a table layer intrusion.

14. The system of claim 11, wherein the first and second access criteria each comprise at least one of:

session authorization, session authentication, session encryption, password integrity, software integrity, application data integrity, database metadata integrity, security software integrity, time of day, and signature rules.

15. The system of claim 11, the instructions configured to, when executed, perform further steps comprising modifying the protection of data at one or more of the application layer or the table layer based on a result of one or more of the first intrusion detection analysis and the second intrusion detection analysis.

16. A non-transitory computer-readable storage medium containing computer-executable instructions for controlling data access in a database, the instructions configured to, when executed, cause a computer to perform steps comprising:

receiving a request for data at an application layer of a database, the database comprising the application layer, a table layer, and a file layer, and the requested data residing in one or more data files stored at the file layer;

responsive to the received data request, performing a first intrusion detection analysis at the table layer to determine whether the received data request comprises a table layer intrusion;

responsive to a determination that the received data request does not comprise a table layer intrusion, performing a second intrusion detection analysis at the file layer to determine whether the received data request comprises a file layer intrusion; and

granting access to the requested data in response to a determination that the received data request does not comprise a file layer intrusion.

17. A system comprising:

a non-transitory computer-readable storage medium containing executable instructions configured to, when executed, perform steps comprising;

receiving a request for data at an application layer of a database, the database comprising the application layer, a table layer, and a file layer, and the requested data residing in one or more data files stored at the file layer;

responsive to the received data request, performing a first intrusion detection analysis at the application layer to determine whether the received data request comprises an application layer intrusion;

responsive to a determination that the received data request does not comprise an application layer intrusion, performing a second intrusion detection analysis at the table layer to determine whether the received data request comprises a table layer intrusion; and

granting access to the requested data in response to a determination that the received data request does not comprise a table layer intrusion; and

a processor configured to execute the instructions.

18. The system of claim 17, wherein the request for data is received from a user associated with an access history, and wherein performing a first intrusion detection analysis at the application layer comprises:

determining a user role associated with the user, the user role associated with a first access criterion at the application layer; and

comparing, at the application layer, the user'"'"'s access history to the first access criterion to determine whether the received data request comprises an application layer intrusion.

19. A non-transitory computer-readable storage medium containing computer-executable instructions for controlling data access in a database, the instructions configured to, when executed, cause a computer to perform steps comprising:

receiving a request for data at an application layer of a database, the database comprising the application layer, a table layer, and a file layer, and the requested data residing in one or more data files stored at the file layer;

responsive to the received data request, performing a first intrusion detection analysis at the application layer to determine whether the received data request comprises an application layer intrusion;

responsive to a determination that the received data request does not comprise an application layer intrusion, performing a second intrusion detection analysis at the table layer to determine whether the received data request comprises a table layer intrusion; and

granting access to the requested data in response to a determination that the received data request does not comprise a table layer intrusion.

20. The computer-readable storage medium of claim 19, wherein the request for data is received from a user associated with an access history, and wherein performing a first intrusion detection analysis at the application layer comprises:

determining a user role associated with the user, the user role associated with a first access criterion at the application layer; and

comparing, at the application layer, the user'"'"'s access history to the first access criterion to determine whether the received data request comprises an application layer intrusion.