Granted Patent B2

US 12,423,455 · App. 18/611,327 · Granted Sep 23, 2025

Inventors: Manav Ratan Mital (Mountain View, CA); Srinivas Nageswarrao Vadlamani (San Jose, CA)

Assignee: Cyral Inc.

G06F21/6218G06F11/3006G06F11/3438G06F11/3476G06F16/24547G06F21/31G06F21/604G06F21/6227G06F21/6254H04L63/0281H04L63/0884H04L63/101H04L63/102H04L63/104H04L63/105H04L63/1425H04L63/166H04L63/168H04L69/326H04L69/329G06F2221/2107H04L2463/082

Abstract

Claims (55)

1. A method, comprising:

receiving a communication for a data source at a wrapper, the wrapper including a dispatcher and at least one service, the dispatcher receiving the communication and being data agnostic, the communication being generated at a client, the at least one service including an authentication service;

providing the communication from the dispatcher to the data source and to the at least one service, the at least one service inspecting the communication;

determining whether the client is authorized to access the data source using the authentication service; and

preventing access to the data source in the event that the client is not authorized to access the data source.

2. The method of claim 1 , wherein the dispatcher is an open systems interconnection (OSI) Layer 4 dispatcher, and wherein the at least one service includes at least one OSI Layer 7 service.

3. The method of claim 1 , further comprising:

performing at least one function by the at least one service based on the communication.

4. The method of claim 3 , wherein the at least one function includes at least one of authentication services, multifactor authentication, tokenization of data, encryption of data, query analysis, behavioral baselining, and federated identity management.

5. The method of claim 1 , wherein the providing of the communication further includes:

providing the communication to the data source only in the event that the authentication service determines the client is authorized to access the data source.

6. The method of claim 1 , wherein the providing of the communication further includes:

providing the communication to the data source from the dispatcher; and

recalling the communication before processing by the data source in the event that the authentication service determines the client is not authorized to access the data source.

7. The method of claim 1 , wherein the communication is generated at a client and includes a first communication, wherein the at least one service includes an authentication service, and wherein the dispatcher is in a step mode for the first communication from the client, the providing the communication to the data source and to the at least one service further including:

providing the first communication to the authentication service without forwarding the first communication to the data source;

determining, by the authentication service using the first communication, whether the client is authorized to access the data source;

preventing access to the data source by terminating a connection to the client in the event that the client is not authorized to access the data source;

forwarding the first communication from the dispatcher to the data source in the event that the client is authorized to access the data source;

placing the dispatcher in a stream mode in the event that the client is authorized to access the data source;

receiving at least one additional communication from the client at the dispatcher; and

automatically forwarding the at least one additional communication from the dispatcher to the data source in the event that the client is authorized to access the data source.

8. A system, comprising:

a processor configured to:

receive a communication for a data source at a wrapper, the wrapper including a dispatcher and at least one service, the dispatcher receiving the communication and being

data agnostic, the communication being generated at a client, the at least one service including an authentication service;

provide the communication from the dispatcher to the data source and to the at least one service, the at least one service inspecting the communication;

determine whether the client is authorized to access the data source using the authentication service; and

prevent access to the data source in the event that the client is not authorized to access the data source; and

a memory coupled to the processor and configured to provide the processor with instructions.

9. The system of claim 8 , wherein the dispatcher is an open systems interconnection (OSI) Layer 4 dispatcher, and wherein the at least one service includes at least one OSI Layer 7 service.

10. The system of claim 8 , wherein the processor is further configured to:

perform at least one function by the at least one service based on the communication.

11. A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

receiving a communication for a data source at a wrapper, the wrapper including a dispatcher and at least one service, the dispatcher receiving the communication and being data agnostic, the communication being generated at a client, the at least one service including an authentication service;

providing the communication from the dispatcher to the data source and to the at least one service, the at least one service inspecting the communication;

determining whether the client is authorized to access the data source using the authentication service; and

preventing access to the data source in the event that the client is not authorized to access the data source.

12. The computer program product of claim 11 , wherein the dispatcher is an open systems interconnection (OSI) Layer 4 dispatcher, and wherein the at least one service includes at least one OSI Layer 7 service.

13. The computer program product of claim 11 , wherein the computer instructions further include computer instructions for:

performing at least one function by the at least one service based on the communication.

14. The computer program product of claim 13 , wherein the at least one function includes at least one of authentication services, multifactor authentication, tokenization of data, encryption of data, query analysis, behavioral baselining, and federated identity management.

15. The computer program product of claim 11 , wherein the computer instructions for providing the communication further include computer instructions for:

providing the communication to the data source only in the event that the authentication service determines the client is authorized to access the data source.

16. The computer program product of claim 11 , wherein the computer instructions for providing the communication further include computer instructions for:

providing the communication to the data source from the dispatcher; and

recalling the communication before processing by the data source in the event that the authentication service determines the client is not authorized to access the data source.

17. The computer program product of claim 11 , wherein the communication is generated at a client and includes a first communication, wherein the at least one service includes an authentication service, wherein the dispatcher is in a step mode for the first communication from the client, and wherein the computer instructions for providing the communication to the data source and to the at least one service further include computer instructions for:

providing the first communication to the authentication service without forwarding the first communication to the data source;

determining, by the authentication service using the first communication, whether the client is authorized to access the data source;

preventing access to the data source by terminating a connection to the client in the event that the client is not authorized to access the data source;

forwarding the first communication from the dispatcher to the data source in the event that the client is authorized to access the data source;

placing the dispatcher in a stream mode in the event that the client is authorized to access the data source;

receiving at least one additional communication from the client at the dispatcher; and

automatically forwarding the at least one additional communication from the dispatcher to the data source in the event that the client is authorized to access the data source.

Continuity (6)

References Cited (287)