Data security at cloud scale
A method to protect data in a database. The method includes detecting an actual flow path for an API call between a source node and a destination node, determining whether the actual flow path for the API call deviates from an expected flow path for the API call, and in response to determining that the actual flow path for the API call deviates from the expected flow path by a predetermined threshold, denying access to data sought by the API call at the destination node.
1 . A method comprising:
detecting an actual flow path for an application programming interface (API) call between a source node and a destination node;
determining whether the actual flow path for the API call deviates from an expected flow path for the API call based on a combination of (a) whether the API call is a write API call or a read API call and (b) a persona of a user who initiated the API call;
in response to determining that the actual flow path for the API call deviates from the expected flow path by a predetermined threshold, denying access to data sought by the API call at the destination node;
generating a current hash value that represents the actual flow path for the API call;
generating an expected hash value that represents the expected flow path for the API call by monitoring a plurality of API calls similar to the API call over a predetermined period of time; and
encrypting predetermined data in a target database using the expected hash value as a key or as an input to a key generator.
2 . The method of claim 1 , wherein the current hash value is based on a unique value for each of the source node and the destination node, and at least one intervening node, and timestamp information representing time spent at the at least one intervening node.
3 . The method of claim 1 , further comprising storing the expected hash value as metadata along with predetermined data in a database hosted by the destination node.
4 . The method of claim 1 , wherein the API call is directed to a target database hosted by the destination node.
5 . The method of claim 4 , further comprising generating a first expected hash value for the read API call and a second expected hash value for the write API call.
6 . The method of claim 1 , further comprising controlling access to the data sought by the API call at the destination node based on at least one of an Identity and Access Management (IAM) policy, a Role-Based Access Control (RBAC) policy and an Attribute Based Access Control (ABAC) policy.
7 . The method of claim 6 , further comprising performing a reverse lookup of the API call to identify a user who initiated the API call.
8 . A device comprising:
an interface configured to enable network communications;
a memory; and
one or more processors coupled to the interface and the memory, and configured to:
detect an actual flow path for an application programming interface (API) call between a source node and a destination node;
determine whether the actual flow path for the API call deviates from an expected flow path for the API call based on a combination of (a) whether the API call is a write API call or a read API call and (b) a persona of a user who initiated the API call;
in response to determining that the actual flow path for the API call deviates from the expected flow path by a predetermined threshold, deny access to data sought by the API call at the destination node;
generate a current hash value that represents the actual flow path for the API call;
generate an expected hash value that represents the expected flow path for the API call by monitoring a plurality of API calls similar to the API call over a predetermined period of time; and
encrypt predetermined data in a target database using the expected hash value as a key or as an input to a key generator.
9 . The device of claim 8 , wherein the current hash value is based on a unique value for each of the source node and the destination node, and at least one intervening node, and timestamp information representing time spent at the at least one intervening node.
10 . The device of claim 8 , wherein the one or more processors are further configured to store the expected hash value as metadata along with predetermined data in a database hosted by the destination node.
11 . The device of claim 8 , wherein the one or more processors are further configured to control access to the data sought by the API call at the destination node based on at least one of an Identity and Access Management (IAM) policy, a Role-Based Access Control (RBAC) policy and an Attribute Based Access Control (ABAC) policy.
12 . The device of claim 8 , wherein the API call is directed to a target database hosted by the destination node.
13 . The device of claim 8 , wherein the one or more processors are further configured to generate a first expected hash value for the read API call and a second expected hash value for the write API call.
14 . The device of claim 8 , wherein the one or more processors are further configured to perform a reverse lookup of the API call to identify a user who initiated the API call.
15 . One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to:
detect an actual flow path for an application programming interface (API) call between a source node and a destination node;
determine whether the actual flow path for the API call deviates from an expected flow path for the API call based on a combination of (a) whether the API call is a write API call or a read API call and (b) a persona of a user who initiated the API call;
in response to determining that the actual flow path for the API call deviates from the expected flow path by a predetermined threshold, deny access to data sought by the API call at the destination node;
generate a current hash value that represents the actual flow path for the API call;
generate an expected hash value that represents the expected flow path for the API call by monitoring a plurality of API calls similar to the API call over a predetermined period of time; and
encrypt predetermined data in a target database using the expected hash value as a key or as an input to a key generator.
16 . The one or more non-transitory computer readable storage media of claim 15 , wherein the current hash value is based on a unique value for each of the source node and the destination node, and at least one intervening node, and timestamp information representing time spent at the at least one intervening node.
17 . The one or more non-transitory computer readable storage media of claim 15 , wherein the instructions, when executed by the processor, are configured to cause the processor to control access to the data sought by the API call at the destination node based on at least one of an Identity and Access Management (IAM) policy, a Role-Based Access Control (RBAC) policy and an Attribute Based Access Control (ABAC) policy.
18 . The one or more non-transitory computer readable storage media of claim 15 , wherein the instructions, when executed by the processor, are configured to cause the processor to store the expected hash value as metadata along with predetermined data in a database hosted by the destination node.
19 . The one or more non-transitory computer readable storage media of claim 15 , wherein the API call is directed to a target database hosted by the destination node.
20 . The one or more non-transitory computer readable storage media of claim 19 , wherein the instructions, when executed by the processor, are configured to generate a first expected hash value for the read API call and a second expected hash value for the write API call.