Call location based access control of query to database
The present disclosure is directed to protecting data stored at a database in a manner that increases data protection minimizing performance reductions. Apparatus and methods consistent with the present disclosure may collect information from user devices from which user inputs are received when collecting data that may be used to protect database data. Methods consistent with the present disclosure may identify code paths traversed, pages of program code where actions were initiated, and functions associated with those actions. This information may be cross-referenced with a set of data, constraints, rules, or command parameters when data associated with a database query is initially associated with an “allow” action or a “deny” action. This information may also be used to evaluate whether newly generated database queries should be allowed to be sent to a database server or to identify whether a database request should be blocked.
1. A method for identifying data stored at database servers, the method comprising:
collecting a set of inputs over a communication network from a computing device, wherein the set of inputs is collected in association with a set of credentials sent by the computing device;
authenticating the computing device as a part of a predetermined set of computing devices allowed to access the database server in accordance with a set of rules based on the set of credentials;
generating a database query to a database server based on the set of inputs;
identifying one ore more parameters including at least one of code location data of an origin of the database query before the database query is sent to the database server;
applying, in response to the identification of the at least one code location data, the set of rules to the authenticated computing device for access to the database server, wherein applying the set of rules includes cross-referencing the identified parameters of the origin of the database query with one or more query origin locations of the set of rules, the identifying that the set of inputs corresponds to known denied queries when the set of inputs corresponds to data associated with a deny action that prevents the database query from being sent to the database server based on the cross-referenced parameters; and
blocking the database query from being sent to the database server based on the deny action identified by the application of the set of rules.
2. The method of claim 1 , further comprising receiving a set of access control information associated with the database request, the set of access control information comprising the set of rules.
3. The method of claim 2 , further comprising updating the set of access control information that includes information for a new rule, and enforcing the new rule by allowing the database query to be generated in accordance with the new rule.
4. The method of claim 1 , further comprising identifying whether the set of inputs corresponds to known allowed queris or the known denied queries based on execution of a set of program code at a program code page.
5. The method of claim 1 , wherein the set of rules are included in an access control list identifying that a first set of database queries is permitted to be processed by the database server and that a second set of database queries is prevented from being processed by the database server.
6. The method of claim 1 , wherein the collected set of inputs includes collected information regarding the computing device.
7. The method of claim 6 , further comprising:
storing the collected information regarding the computing device in a memory with information that identifies that the computing device is a suspicious device;
receiving a second set of inputs; and
identifying that the suspicious device provided the second set of inputs.
8. The method of claim 7 , further comprising preventing a second database request from being generated from the second set of inputs based on the identification that the suspicious device provided the second set of inputs.
9. A non-transitory computer-readable storage medium having embodied thereon a program for implementing a method for identifying data stored at database servers, the method comprising:
collecting a set of inputs over a communication network from a computing device, wherein the set of inputs is collected in association with a set of credentials sent by the computing device;
authenticating the computing device as a part of a predetermined set of computing devices allowed to access the database server in accordance with a set of rules based on the set of credentials;
generating a database query to a database server based on the set of inputs;
identifying one or more parameters including at least one of code location data of an origin of the database query before the database query is sent to the database server;
applying, in response to the identifiction of the at least one code location data, the set of rules to the authenticated computing device for access to the database server, wherein applying the set of rules includes cross-referencing the identified parameters of the origin of the database query with one or more query origin locations of the set of rules, and identifying that the set of inputs corresponds to known denied queries when the set of inputs corresponds to data associated with a deny action that prevents the database query from being sent to the database server based on the cross-referenced parameters; and
blocking the database query from being sent to the database server based on the deny action identified by the application of the set of rules.
10. The non-transitory computer-readable storage medium of claim 9 , further comprising instructions executable to receive a set of access control information associated with the database request, the set of access control information comprising the set of rules.
11. The non-transitory computer-readable storage medium of claim 10 , further comprising instructions executable to update the set of access control information that includes information for a new rule, and enforcing the new rule by allowing the database query to be generated in accordance with the new rule.
12. The non-transitory computer-readable storage medium of claim 9 , further comprising instructions executable to identify whether the set of inputs corresponds to known allowed queries or the known denied queries based on execution of a set of program code at a program code page.
13. The non-transitory computer-readable storage medium of claim 9 , wherein the set of rules are included in an access control list identifying that a first set of database queries is permitted to be processed by the database server and that a second set of database queries is prevented from being processed by the database server.
14. The non-transitory computer-readable storage medium of claim 9 , wherein the collected set of inputs includes collected information regarding the computing device.
15. The non-transitory computer-readable storage medium of claim 14 , further comprising instructions executable to:
store the collected information regarding the computing device in a memory with information that identifies that the computing device is a suspicious device;
receive a second set of inputs; and
identify that the suspicious device provided the second set of inputs.
16. The non-transitory computer-readable storage medium of claim 15 , further comprising instructions executable to prevent a second database request from being generated from the second set of inputs based on the identification that the suspicious device provided the second set of inputs.
17. A system for identifying data stored at database servers, the system comprising:
a communication interface that communicates over a communication network with a computing device, wherein the communication interface collects a set of inputs in association with a set of credentials sent by the computing device; and
a processor that executes instructions stored in memory, wherein the processor executes the instructions to:
authenticate the computing device as a part of a predetermined set of computing devices allowed to access the database server in accordance with a set of rules based on the set of credentials;
generate a database query to a database server based on the set of inputs;
identify one or more parameters including at least one of code location data of an origin of the database query before the database query is sent to the database server;
apply, in response to the identifiction of the at least one code location data, the set of rules to the authenticated computing device for access to the database, wherein applying the set of rules includes cross-referencing the identified parameters of the origin of the database query with one or more query origin locations of the set of rules, and identifying that the set of inputs corresponds to known denied queries when the set of inputs corresponds to data associated with a deny action that prevents the database query from being sent to the database server based on the cross-referenced parameters; and
block the database query from being sent to the database server based on the deny actions identified by the application of the set of rules.