System and method for summarizing and reporting impact of database statements
View Patent ↗Embodiments of the present invention provide a system and method for summarizing and reporting the impact of database statements at a database appliance. The database appliance, according to one embodiment, can receive a database request and determine a set of information related to the request. Embodiments disclosed herein take in as input the database statement text and output multiple impact vectors, each containing both the name of an affected entity and a 32-bit “impact bitmap” for that entity. This concise and unambiguous output format can be computed using fast AND, OR, XOR, and NOT operations, allowing for highly efficient evaluation of database statements against user defined policies and finer policy granularity.
1. A database appliance comprising:
a processor; and
a memory means accessible by said processor and storing computer instructions executable by said processor to:
receive a database request from a database client coupled to said database appliance, wherein said database request from said database client is directed to a database server connected to said database appliance;
extract one or more database statements from said database request;
parse said one or mare database statements;
determine, at statement level, impact of said database request and database entities affected by said impact of said database request, wherein said one or more database statements have zero or more impacts at levels of a database hierarchy, including an entity level; and
for each of said database entities, generate an impact vector containing an entity name and a corresponding 32-bit impact bitmap with one or more bits set to 1, each representing an impact to said entity, wherein said impact vector comprises a first group of bits representing changes to actual database contents, a second group of bits representing changes in permissions granted to objects, and a third group of bits representing changes not covered by the first and second groups.
2. The database appliance of claim 1 , wherein said one or more database statements are Structured Query Language (SQL) statements.
3. The database appliance of claim 1 , wherein said computer instructions are further executable by said processor to generate a composite report on Data Manipulation Language (DML) impacts, Data Definition Language (DDL) impacts, and Access Control Language (ACL) impacts.
4. The database appliance of claim 3 , wherein each of said group of DML, DDL, and ACL impacts comprises a data access bit (A), a data insert bit (I), a data update bit (U), and a data delete bit (D).
5. The database appliance of claim 3 , wherein each of said group of DML, DDL, and ACL impacts comprises a weak data access bit (W), a strong data access bit (S), a data insert bit (I), a data update bit (U), and a data delete bit (D).
6. The database appliance of claim 3 , wherein said impact vector further comprises at least one legacy bit (E) indicating execution of a stored procedure.
7. The database appliance of claim 1 , wherein said computer instructions are further executable by said processor to aggregate individual impact vectors.
8. The database appliance of claim 1 , wherein said computer instructions are further executable by said processor to translate said impact vectors into a format acceptable by a policy engine.
9. A non-transitory computer readable medium carrying computer instructions executable by a processor of a database appliance of:
receive a database request from a database client coupled to said database appliance, wherein said database request from said database client is directed to a database server connected to said database appliance;
extract one or more database statements from said database request;
parse said one or mare database statements;
determine, at statement level, impact of said database request and database entities affected by said impact of said database request, wherein said one or more database statements have zero or more impacts at levels of a database hierarchy, including an entity level; and
for each of said database entities, generate an impact vector containing an entity name and a corresponding 32-bit impact bitmap with one or more bits set to 1, each representing an impact to said entity, wherein said impact vector comprises a first group of bits representing changes to actual database contents, a second group of bits representing changes in permissions granted to objects, and a third group of bits representing changes not covered by the first and second groups.
10. The non-transitory computer readable medium of claim 9 , wherein said computer instructions are further executable by said processor to generate a composite report on Data Manipulation Language (DML) impacts, Data Definition Language (DDL) impacts, and Access Control Language (ACL) impacts.
11. The non-transitory computer readable medium of claim 10 , wherein each of said group of DML, DDL, and ACL impacts comprises a data access bit (A), a data insert bit (I), a data update bit (U), and a data delete bit (D).
12. The non-transitory computer readable medium of claim 11 , wherein each of said group of DML, DDL, and ACL impacts comprises a weak data access bit (W), a strong data access bit (S), a data insert bit (I), a data update bit (U), and a data delete bit (D).
13. The non-transitory computer readable medium of claim 10 , wherein said impact vector further comprises at least one legacy bit (E) indicating execution of a stored procedure.
14. The non-transitory computer readable medium of claim 9 , wherein said computer instructions are further executable by said processor to aggregate individual impact vectors.
15. The non-transitory computer readable medium of claim 9 , wherein said computer instructions are further executable by said processor to translate said impact vectors into a format acceptable by a policy engine.
16. A method of reporting impacts of database statements at a database appliance, comprising:
receive a database request from a database client coupled to said database appliance, wherein said database request from said database client is directed to a database server connected to said database appliance;
extract one or more database statements from said database request;
parse said one or mare database statements;
determine, at statement level, impact of said database request and database entities affected by said impact of said database request, wherein said one or more database statements have zero or more impacts at levels of a database hierarchy, including an entity level;
for each of said database entities, generate an impact vector containing an entity name and a corresponding 32-bit impact bitmap with one or more bits set to 1, each representing an impact to said entity, wherein said impact vector comprises a first group of bits representing changes to actual database contents, a second group of bits representing changes in permissions granted to objects, and a third group of bits representing changes not covered by the first and second groups; and
aggregating individual impact vectors into a composite impact report.
17. The method according to claim 16 , further comprising translating said composite impact report into a format acceptable by a policy engine.
18. The method according to claim 16 , wherein said impact vector comprises impact bits for execution of stored procedures and database actions including entity-level access, insertion, update, and delete.