Call location based access control of query to database
The present disclosure is directed to protecting data stored at a database in a manner that increases data protection minimizing performance reductions. Apparatus and methods consistent with the present disclosure may collect information from user devices from which user inputs are received when collecting data that may be used to protect database data. Methods consistent with the present disclosure may identify code paths traversed, pages of program code where actions were initiated, and functions associated with those actions. This information may be cross-referenced with a set of data, constraints, rules, or command parameters when data associated with a database query is initially associated with an “allow” action or a “deny” action. This information may also be used to evaluate whether newly generated database queries should be allowed to be sent to a database server or to identify whether a database request should be blocked.
1. A method for protecting data stored at a database server, the method comprising:
receiving user input from a computing device;
allowing a database request to be generated based on the received user input;
collecting information associated with the generation of the database request when the database request is generated, the database request including a parameter;
comparing the collected information and the database parameter with reference information and a constraint before the database request is sent to the database server to identify a deny action that prevents the database request from being sent to the database server based on a condition associated with the reference information, the constraint, and the action; and
preventing the database request from being sent to the database server in accordance with the deny action when:
the collected information matches the reference information,
the constraint matches the database parameter, and
the condition corresponds to the reference information and the constraint, wherein the deny action prevents the database request from reaching the database server.
2. The method of claim 1 , further comprising identifying a program code location where a function associated with generating the database request is initiated.
3. The method of claim 2 , further comprising storing the program code location as data in an access control list.
4. The method of claim 1 , further comprising identifying a function that is associated with generating the database request.
5. The method of claim 4 , further comprising storing information that identifies the function in an access control list.
6. The method of claim 1 , further comprising collecting information that identifies the computing device from which the user input was received.
7. The method of claim 6 , further comprising:
storing the computing device identifying information in a memory with information that identifies that the computing device is a suspicious device;
receiving a second user input; and
identifying that the suspicious device provided the second user input.
8. The method of claim 7 , further comprising preventing a second database request from being generated based on an identification that the suspicious device provided the second user input.
9. The method of claim 1 , wherein the database request is prevented from being sent from a web server to the database server in accordance with the deny action.
10. The method of claim 1 , further comprising disconnecting the computing device when the database request is prevented from being sent to the database server in accordance with the deny action.
11. The method of claim 1 , wherein collecting the information associated with the generation of the database request includes tracking flow of program code associated with the database request, and wherein the tracked flow of program code includes one or more of a program function performed or a program code page location accessed to generate the database request.
12. A non-transitory computer-readable storage medium having embodied thereon one or more sets of instructions executable by a program for implementing a method for protecting data stored at a database server, the method comprising:
receiving user input from a computing device;
allowing a database request to be generated based on the received user input;
collecting information associated with the generation of the database request when the database request is generated, the database request including a parameter;
comparing the collected information and the database parameter with reference information and a constraint before the database request is sent to the database server to identify a deny action that prevents the database request from being sent to the database server based on a condition associated with the reference information, the constraint, and the action; and
preventing the database request from being sent to the database server in accordance with the deny action when:
the collected information matches the reference information,
the constraint matches the database parameter, and
the condition corresponds to the reference information and the constraint, wherein the deny action prevents the database request from reaching the database server.
13. The non-transitory computer-readable storage medium of claim 12 , further comprising instructions executable to identify a program code location where a function associated with generating the database request is initiated.
14. The non-transitory computer-readable storage medium of claim 13 , further comprising instructions executable to store the program code location as data in an access control list.
15. The non-transitory computer-readable storage medium of claim 12 , further comprising instructions executable to identify a function that is associated with generating the database request.
16. The non-transitory computer-readable storage medium of claim 15 , further comprising instructions executable to store information that identifies the function in an access control list.
17. The non-transitory computer-readable storage medium of claim 12 , further comprising instructions executable to collect information that identifies the computing device from which the user input was received.
18. The non-transitory computer-readable storage medium of claim 17 , further comprising instructions executable to:
store the computing device identifying information in a memory with information that identifies that the computing device is a suspicious device;
receive a second user input; and
identify that the suspicious device provided the second user input.
19. The non-transitory computer-readable storage medium of claim 18 , further comprising instructions executable to prevent a second database request from being generated based on a identification that the suspicious device provided the second user input.
20. An apparatus for protecting data stored at a database server, the apparatus comprising:
a memory; and
a processor that executes instructions to:
prepare to generate a database request from received user input;
allowing the database request to be generated based on the received user input;
collect information associated with the generation of the database request when the database request is generated, the database request including a parameter;
compare the collected information and the database parameter with reference information and a constraint before the database request is sent to the database server to identify a deny action that prevents the database request from being sent to the database server based on a condition associated with the reference information, the constraint, and the action; and
prevent the database request from being sent to the database server in accordance with the deny action when:
the collected information matches the reference information,
the constraint matches the database parameter,
the condition corresponds to the reference information and a constraint the deny action prevents the database request from reaching the database server.