Multi-layer system for privacy enforcement and monitoring of suspicious data access behavior
View Patent ↗A method for controlling data access in a data-at-rest system includes executing a link intrusion prevention analysis between multiple layers of the data-at-rest system, introducing a privacy policy at enforcement points that span multiple system layers, and dynamically altering the privacy policy.
1. A method for controlling data access in a database, the method comprising:
receiving a request for data at an application layer stored in a memory of a database, the database comprising the application layer, a table layer, and a file layer, and the requested data residing in one or more data files stored at the file layer;
performing, by a processing system, a first intrusion detection analysis at the application layer to determine whether the received data request comprises an application layer intrusion;
performing, by the processing system, a second intrusion detection analysis at the table layer to determine whether the received data request comprises a table layer intrusion; and
granting access to the requested data in response to a determination that the received data request does not comprise an application layer intrusion or a table layer intrusion.
2. The method of claim 1 , wherein the request for data is received from a user associated with an access history, and wherein performing a first intrusion detection analysis at the application layer comprises:
determining a user role associated with the user, the user role associated with a first access criterion at the application layer; and
comparing, at the application layer, the user's access history to the first access criterion to determine whether the received data request comprises an application layer intrusion.
3. The method of claim 2 , wherein the user role is further associated with a second access criterion at the table layer, and wherein performing a second intrusion detection analysis at the table layer comprises:
comparing, at the table layer, the user's access history to the second access criterion to determine whether the received data request comprises a table layer intrusion.
4. The method of claim 1 , wherein the first and second access criteria each comprise at least one of: session authorization, session authentication, session encryption, password integrity, software integrity, application data integrity, database metadata integrity, security software integrity, time of day, and signature rules.
5. The method of claim 1 , further comprising modifying a protection of data at one or more of the application layer or the table layer based on a result of one or more of the first intrusion detection analysis and the second intrusion
detection analysis.
6. A non-transitory computer-readable storage medium containing computer-executable instructions for controlling data access in a database, the instructions configured to, when executed, cause a computer to perform steps
comprising:
receiving a request for data at an application layer stored in a memory of a database, the database comprising the application layer, a table layer, and a file layer, and the requested data residing in one or more data files stored at the file layer;
performing a first intrusion detection analysis at the application layer to determine whether the received data request comprises an application layer intrusion;
performing a second intrusion detection analysis at the table layer to determine whether the received data request comprises a table layer intrusion; and
granting access to the requested data in response to a determination that the received data request does not comprise an application layer intrusion or a table layer intrusion.
7. The computer-readable storage medium of claim 6 , wherein the request for data is received from a user associated with an access history, and wherein performing a first intrusion detection analysis at the application layer comprises:
determining a user role associated with the user, the user role associated with a first access criterion at the application layer; and
comparing, at the application layer, the user's access history to the first access criterion to determine whether the received data request comprises an application layer intrusion.
8. The computer-readable storage medium of claim 7 , wherein the user role is further associated with a second access criterion at the table layer, and wherein performing a second intrusion detection analysis at the table layer comprises:
comparing, at the table layer, the user's access history to the second access criterion to determine whether the received data request comprises a table layer intrusion.
9. The computer-readable storage medium of claim 6 , wherein the first and second access criteria each comprise at least one of: session authorization, session authentication, session encryption, password integrity, software integrity, application data integrity, database metadata integrity, security software integrity, time of day, and signature rules.
10. The computer-readable storage medium of claim 6 , the instructions configured to, when executed, cause a computer to perform further steps comprising modifying a protection of data at one or more of the application layer or the
table layer based on a result of one or more of the first intrusion detection analysis and the second intrusion detection analysis.
11. A system for controlling data access in a database, the system comprising:
a non-transitory computer-readable storage medium containing executable instructions configured to, when executed, perform steps comprising:
receiving a request for data at an application layer stored in a memory of a database, the database comprising the application layer, a table layer, and a file layer, and the requested data residing in one or more data files stored at the file layer;
performing a first intrusion detection analysis at the application layer to determine whether the received data request comprises an application layer intrusion;
performing a second intrusion detection analysis at the table layer to determine whether the received data request comprises a table layer intrusion; and
granting access to the requested data in response to a determination that the received data request does not comprise an application layer intrusion or a table layer intrusion; and
a hardware processor configured to execute the instructions.
12. The system of claim 11 , wherein the request for data is received from a user associated with an access history, and wherein performing a first intrusion detection analysis at the application layer comprises:
determining a user role associated with the user, the user role associated with a first access criterion at the application layer; and
comparing, at the application layer, the user's access history to the first access criterion to determine whether the received data request comprises an application layer intrusion.
13. The system of claim 12 , wherein the user role is further associated with a second access criterion at the table layer, and wherein performing a second intrusion detection analysis at the table layer comprises:
comparing, at the table layer, the user's access history to the second access criterion to determine whether the received data request comprises a table layer intrusion.
14. The system of claim 11 , wherein the first and second access criteria each comprise at least one of: session authorization, session authentication, session encryption, password integrity, software integrity, application data integrity, database metadata integrity, security software integrity, time of day, and signature rules.
15. The system of claim 11 , the instructions configured to, when executed, perform further steps comprising modifying a protection of data at one or more of the application layer or the table layer based on a result of one or more of
the first intrusion detection analysis and the second intrusion detection analysis.
16. A non-transitory computer-readable storage medium containing computer-executable instructions for controlling data access in a database, the instructions configured to, when executed, cause a computer to perform steps
comprising:
receiving a request for data at an application layer stored in a memory of a database, the database comprising the application layer, a table layer, and a file layer, and the requested data residing in one or more data files stored at the file layer;
responsive to the received data request, performing a first intrusion detection analysis at the table layer to determine whether the received data request comprises a table layer intrusion;
responsive to a determination that the received data request does not comprise a table layer intrusion, performing a second intrusion detection analysis at the file layer to determine whether the received data request comprises a file layer
intrusion; and
granting access to the requested data in response to a determination that the received data request does not comprise a file layer intrusion.
17. A system comprising:
a non-transitory computer-readable storage medium containing executable instructions configured to, when executed, perform steps comprising:
receiving a request for data at an application layer stored in a memory of a database, the database comprising the application layer, a table layer, and a file layer, and the requested data residing in one or more data files stored at the file layer;
responsive to the received data request, performing a first intrusion detection analysis at the application layer to determine whether the received data request comprises an application layer intrusion;
responsive to a determination that the received data request does not comprise an application layer intrusion, performing a second intrusion detection analysis at the table layer to determine whether the received data request comprises a table
layer intrusion; and
granting access to the requested data in response to a determination that the received data request does not comprise a table layer intrusion; and
a hardware processor configured to execute the instructions.
18. The system of claim 17 , wherein the request for data is received from a user associated with an access history, and wherein performing a first intrusion detection analysis at the application layer comprises:
determining a user role associated with the user, the user role associated with a first access criterion at the application layer; and
comparing, at the application layer, the user's access history to the first access criterion to determine whether the received data request comprises an application layer intrusion.
19. A non-transitory computer-readable storage medium containing computer-executable instructions for controlling data access in a database, the instructions configured to, when executed, cause a computer to perform steps
comprising:
receiving a request for data at an application layer stored in a memory of a database, the database comprising the application layer, a table layer, and a file layer, and the requested data residing in one or more data files stored at the file layer;
responsive to the received data request, performing a first intrusion detection analysis at the application layer to determine whether the received data request comprises an application layer intrusion;
responsive to a determination that the received data request does not comprise an application layer intrusion, performing a second intrusion detection analysis at the table layer to determine whether the received data request comprises a table
layer intrusion; and
granting access to the requested data in response to a determination that the received data request does not comprise a table layer intrusion.
20. The computer-readable storage medium of claim 19 , wherein the request for data is received from a user associated with an access history, and wherein performing a first intrusion detection analysis at the application layer comprises:
determining a user role associated with the user, the user role associated with a first access criterion at the application layer; and
comparing, at the application layer, the user's access history to the first access criterion to determine whether the received data request comprises an application layer intrusion.