Method for monitoring stored procedures
A method for monitoring stored procedures is disclosed. The method performs on-line and inline monitoring of stored procedures for detecting table access operations performed by the procedures. This allows the enforcing of access control policies, correlation rules and audit rules on stored procedures. The monitoring is performed using mapping information gathered about each stored procedure that can be executed by a database server. The method comprises parsing an incoming transaction submitted by a client; determining whether the incoming transaction includes an invocation of a stored procedure; obtaining a query group corresponding to the stored procedure; applying an access control policy on the query group; and asserting an unauthorized event if the query group is not compliant with the access control policy.
1. A method for monitoring activity and detecting unauthorized access to database tables, the method comprising:
parsing an incoming transaction submitted by a client;
determining whether the incoming transaction includes an invocation of a stored procedure;
obtaining a query group data structure corresponding to the stored procedure;
applying an access control policy on the query group data structure; and
asserting an unauthorized event if the query group data structure is not compliant with the access control policy;
wherein the access to database tables is indirectly performed using the stored procedure.
2. The method of claim 1 , further comprising:
upon asserting the unauthorized event, blocking the transaction.
3. The method of claim 2 , wherein the detection of an unauthorized access is performed inline and online by a secure gateway installed between the client and a database server.
4. The method of claim 3 , wherein the query group data structure includes at least one pair of a table and an operation performed on the table.
5. The method of claim 3 , wherein the query group data structure includes at least one privileged operation executed by the stored procedure.
6. The method of claim 5 , further comprising: distinguishing between transactions in which a table is directly accessed by the client and transactions in which a table is indirectly accessed using the stored procedure to access the table.
7. The method of claim 6 , wherein applying the access control policy on the query group further comprising: applying on the query group data structure at least one of correlation rules and audit rules associated with the client.
8. method of claim 7 , wherein the stored procedure includes at least one of: a user defined function, a database trigger, a database view.
9. A computer program product for monitoring activity and detecting unauthorized access to database tables, the computer program product having computer instructions on a tangible computer readable medium, the instructions being adapted to enable a computer system to perform operations comprising:
parsing an incoming transaction submitted by a client;
determining whether the incoming transaction includes an invocation of a stored procedure;
obtaining a query group data structure corresponding to the stored procedure;
applying an access control policy on the query group data structure; and
asserting an unauthorized event if the query group data structure is not compliant with the access control policy;
wherein the access to database tables is indirectly performed using the stored procedure.
10. The computer program product of claim 9 , further comprising:
upon asserting the unauthorized event, blocking the transaction.
11. The computer program product of claim 10 , wherein the detection of an unauthorized access is performed inline and online by a secure gateway installed between the client and a database server.
12. The computer program product of claim 11 , wherein the query group data structure includes at least one pair of a table and an operation performed on the table.
13. The computer program product of claim 11 , wherein the query group data structure includes at least one privileged operation executed by the stored procedure.
14. The computer program product of claim 13 , further comprising:
distinguishing between transactions in which a table is directly accessed by the client and transactions in which a table is indirectly accessed using a stored procedure to access the table.
15. The computer program product of claim 14 , wherein applying the access control policy on the query group further comprising:
applying on the query group data structure at least one of correlation rules and audit rules associated with the client.
16. The computer program product of claim 15 , wherein the stored procedure includes at least one of: a user defined function, a database trigger, a database view.