`
`US007437362Bl
`
`(12) United States Patent
`Ben-Natan
`
`(10) Patent No.:
`(45) Date of Patent:
`
`us 7,437,362 81
`Oct. 14, 2008
`
`(54) SYST EM AND METHODS FOR
`NONINTRUSIVE DATABASE SECURITY
`
`(75)
`
`Inventor: Ron Ben-Natan , Lexington, MA (US)
`
`(73) Assignee: Guardlum, Inc., Waltham, MA (US)
`
`(*)
`
`Notice:
`
`Subject to any disclaimer, the term of this
`patent is e~:tended or adjusted under 35
`U.S.C. 154(b) by 337 days.
`
`(21)
`
`Appl. No.: 10n 23,521
`
`(22) Filed:
`
`Nov. 26, 2003
`
`(51)
`
`(52)
`(58)
`
`(56)
`
`Int. Cl.
`(2006.01)
`G06F 7100
`(2006.0 1)
`G06F 17130
`.................................... 707/9; 707/3; 707/6
`U.S. C t .
`Field of Classification Search
`...... 707/2,
`707/9; 709/223
`See application file for complete search history.
`
`References Cited
`
`U.S. PATENT DOCUMENTS
`
`4,451,916 A
`6,085,191 A •
`6,205,475 Bl
`6,332,163 B1
`6,366,952 B2
`6,505,241 B2
`6,529,948 Bl
`6,539,396 Bl
`6,550,057 Bl
`6,578,068 Bl
`6,581,052 Bl *
`6,601,192 Bl
`
`................. 370/ 16
`5/1984 Casper et al.
`7/2000 Fisher et al .................... 707/9
`3/200 I Pitts ........................... 709/218
`12/2001 Bowman-Amuah ......... 709/231
`4/2002 Pitts ........................... 709/217
`1/2003 Pitts ........................... 709/218
`3/2003 Bowman-Amuah ......... 709/217
`3/2003 Bowman-Amuah ..... 707/ 103 R
`412003 Bowman-Amuah ......... 717/ 126
`612003 Bowman-Amuah ......... 709/203
`6/2003 Slutz ............................. 707/2
`7/2003 Bowman-Amuah .......... 714/38
`
`6,606,660 B I
`6,615,253 B1
`6,636,585 82
`6,678,355 B2
`6,820,082 Bl •
`7,043,541 Bl •
`2002/0078384 AI •
`
`812003 Bowman-Amuah ......... 709/227
`912003 Bowman-Amuall ......... 709/219
`I 012003 Salzberg et al. ............... 3~9122
`112004 Eringis et al .
`................. 3~9122
`lJ/2004 Cook et aJ ..................... ~07/9
`5/2006 Bechtolsheim el al ....... 709/223
`612002 Hippelaioen ........ ........ 713/201
`
`* cited by examiner
`Primary Examiner- Etienne P LeRoux
`Assistant Examiner-Paul Kim
`(74) Attorney, Agent, or Firm-Chapin IP Law, LLC
`
`(57)
`
`ABSTR ACT
`
`Typical conventional database security scheme mechanisms
`are integrated in either the application or database. Mainte(cid:173)
`mmce of the security scheme, there tore, such as changeo and
`modifications, impose changes to the application and/or data(cid:173)
`base. Configurations of the invention employ a security 'liter
`for intercepting database streams, such as data access trans(cid:173)
`actions, between an application and the a data repository, ;uch
`as a relational database. A security filter deployed between
`the application and database inspects the stream of trarosac(cid:173)
`tions between the application and. the database. The security
`filter, by nonintmsively interrogating the transactions, pro(cid:173)
`vides a content-aware capability for seamlessly and nonde(cid:173)
`structively enforcing data level security. A security pclicy,
`codifying security requirements for the users and table of the
`database, employs mles concerning restricted data items. 'The
`filter intercepts transactions and. determines if the transaction
`triggers nlles of the security policy. If the transactions contain
`restricted data items, the security filter modifies the transac(cid:173)
`tion to eliminate the restricted data items.
`
`42 Claims, 12 Drawing Sheets
`
`PALO ALTO NETWORKS Exhibit 1005 Page 1
`
`
`
`10~
`
`14
`
`16
`
`RESULT DATA
`ACCESS TRANSACTION
`
`32~
`
`APPLICATION
`
`SECURITY
`POLICY
`
`30~
`
`DATA ACCESS
`TRANSACTION
`
`20
`
`~----~----~
`
`DATA ACCESS
`TRANSACTION
`30
`
`.6
`\ 32
`
`RESULT DATA
`ACCESS TRANSACTION
`
`Fig. 1
`
`PALO ALTO NETWORKS Exhibit 1005 Page 2
`
`
`
`U.S. Patent
`
`Oct.14, 2008
`
`Sheet 2 of 12
`
`US 7,437,362 Bl
`
`100
`INTERCEPT, IN A NONINTRUSIVE MANNER, A DATA ACCESS
`TRANSACTION BETWEEN A USER APPLICATION AND A DATA
`REPOSITORY HAVING DATA ITEMS
`
`101
`NONINTRUSIVE MANNER IS UNDETECTABLE TO THE USER
`APPLICATION AND UNDETECTABLE TO THE DATA REPOSITORY
`
`,,
`
`102
`DETERMINE IF THE INTERCEPTED DATA ACCESS TRANSACTION
`CORRESPONDS TO A SECURITY POLICY, THE SECURITY POLICY
`INDICATIVE OF RESTRICTED DATA ITEMS IN THE DATA REPOSITORY TO
`WHICH THE USER APPLICATION IS PROHIBITED ACCESS
`
`,,
`
`103
`LIMIT, BASED ON THE SECURITY POLICY, THE DATA ACCESS
`TRANSACTION
`
`~r
`104
`MODIFY T HE DATA ACCESS TRANSACTION SUCH THAT DATA
`INDICATIONS IN THE DATA ACCESS TRANSACTION CORRESPONDING
`TO RESTRICTED DATA ITEMS, ACCORDING TO THE SECURITY POLICY,
`ARE ELIMINATED FROM THE RESULTING DATA ACCESS TRANSACTION
`
`Fig. 2
`
`PALO ALTO NETWORKS Exhibit 1005 Page 3
`
`
`
`10~
`
`16
`
`14
`
`558
`
`53A..53N ..
`
`DATA
`
`./
`
`:~~::/··_ .... _·· - - - ' - - -20
`
`DATA
`ACCESS
`STATEMENT
`
`~ 22
`
`56A..5SN
`
`7C
`
`Fig. 3
`
`PALO ALTO NETWORKS Exhibit 1005 Page 4
`
`
`
`U.S. Patent
`
`Oct. 14, 2008
`
`Sheet 4 of 12
`
`US 7,437,362 Bl
`
`200
`INTERCEPT, IN A NONINTRUSIVE MANNER, A DATA ACCESS
`TRANSACTION BETWEEN A USER APPLICATION AND A DATA
`REPOSITORY HAVING DATA ITEMS
`
`202
`ESTABLISH A PROXY TO THE
`DATA REPOSITORY ON
`BEHALF OF THE USER
`
`203
`DETERMINE IF THE INTERCEPTED DATA ACCESS TRANSACTION
`CORRESPONDS TO A SECURITY POLICY, THE SECURITY POLICY INDICATIVE
`OF RESTRICTED DATA ITEMS IN THE DATA REPOSITORY TO WHICH THE USER
`APPLICATION IS PROHIBITED ACCESS
`
`204
`SECURITY POLICY HAS RULES, EACH OF THE RULES INCLUDING AN
`OBJECT, A SELECTION CRITERIA AND AN ACTION, THE ACTION
`INDICATIVE OF THE RESTRICTED DATA ITEMS
`
`206
`ALLOW
`ACCESS
`
`ALLOW
`
`207
`DENY
`ACCESS
`
`MODIFY +
`
`208
`IDENTIFY OAT A ITEMS CORRESPONDING TO THE ATTRIBUTES, EACH OF
`THE ATTRIBUTES ASSOCIATED W ITH AN OPERATOR AND AN OPERAND
`
`209
`226 APPLYING AN OPERA TOR SPECIFIED FOR THE DATA ITEM
`TO THE OPERAND SPECIFIED FOR THE DATA ITEM
`
`+
`
`+
`
`Fig. 4
`
`PALO ALTO NETWORKS Exhibit 1005 Page 5
`
`
`
`U.S. Patent
`
`Oct. 14, 2008
`
`Sheet 5 of 12
`
`US 7,437,362 Bl
`
`• 210
`
`DETERMINE, AS A RESULT OF APPLYING THE OPERATOR, WHETHER TO
`ELIMINATE THE IDENTIFIED DATA ITEM
`
`211
`LIMIT, BASED ON THE SECURITY POLICY, THE DATA ACCESS TRANSACTION
`
`212
`MODIFY THE DATA ACCESS TRANSACTION SUCH THAT DATA
`INDICATIONS IN THE OAT A ACCESS TRANSACTION CORRESPONDING
`TO RESTRICTED DATA ITEMS, ACCORDING TO THE SECURITY POLICY,
`ARE ELIMINATED FROM THE RESULTING DATA ACCESS TRANSACTION
`
`,
`213
`DATA INDICATIONS ARE REFERENCES TO DATA ITEMS IN THE DATA
`REPOSITORY AND LIMITING FURTHER INCLUDES QUALIFYING THE
`REFERENCES TO GENERATE A MODIFIED REQUEST INDICATIVE OF
`UNRESTRICTED DATA ITEMS, SUCH THAT SUCCESSIVE RETRIEVAL
`OPERATIONS EMPLOYING THE QUALIFIED REFERENCES DO NOT
`RETRIEVE RESTRICTED DATA ITEMS
`
`+·
`
`214
`DATA ACCESS TRANSACTION IS A DATA ACCESS STATEMENT AND
`LIMITING FURTHER COMPRISES IDENTIFYING AT LEAST ONE RULE,
`ACCORDING TO THE SECURITY POLICY, CORRESPONDING TO THE
`DATA ACCESS STATEMENT, THE IDENTIFIED RULE RESTRICTING
`ACCESS TO AT LEAST ONE OF THE DATA ITEMS INDICATED BY THE
`DATA ACCESS STATEMENT
`
`~,
`
`. Ftg. 5
`
`PALO ALTO NETWORKS Exhibit 1005 Page 6
`
`
`
`U.S. Patent
`
`Oct. 14, 2008
`
`Sheet 6 of 12
`
`US 7,437,362 Bl
`
`t
`
`215
`CONCATENATE SELECTION QUALIFIERS TO THE DATA ACCESS STATEMENT
`CORRESPONDING TO THE IDENTIFIED RULE, THE SELECTION QUALIFIERS
`OPERABLE TO OMIT THE RESTRICTED DATA ITEMS FROM THE QUALIFIED
`REFERENCES OF THE DATA ACCESS STATEMENT
`
`216
`RECEIVE AN SQL QUERY AND LIMITING INCLUDES APPENDING
`CONDITIONAL SELECTION STATEMENTS TO THE SQL QUERY, THE
`CONDITIONAL SELECTION STATEMENTS COMPUTED FROM THE
`SECURITY POLICY, TO GENERATE THE RESULTING DATA ACCESS
`TRANSACTION
`
`,,
`217
`
`BUILD A PARSE TREE CORRESPONDING TO THE SQL
`QUERY
`
`,
`
`218
`ADD NODES IN THE PARSE TREE CORRESPONDING
`T O THE APPENDED CONDITIONAL SELECTION
`STATEMENTS
`
`,
`
`219
`REPROCESS THE PARSE TREE TO GENERATE THE
`RESULTING DATA ACCESS TRANSACTION
`
`•
`
`Fig. 6
`
`PALO ALTO NETWORKS Exhibit 1005 Page 7
`
`
`
`U.S. Patent
`
`Oct. 14, 2008
`
`Sheet 7 of 12
`
`US 7,437,362 Bl
`
`220
`
`RECEIVE A SET OF PACKETS, THE PACKETS
`ENCAPSULATING THE DATA ACCESS TRANSACTION
`ACCORDING TO LAYERED PROTOCOLS
`
`I
`
`221
`PROXY OR
`DIRECT?
`
`DIRECT ,,
`
`222
`GENERATE THE RESULTING DATA ACCESS TRANSACTION
`PRESERVING THE ENCAPSULATING LAYERED PROTOCOL
`ASSOCIATING THE PACKETS WITHOUT EMPLOYING A
`PROXY FOR REGENERATING THE SEQUENCE OF PACKETS
`
`223
`INTERROGATE AND MODIFY THE PACKETS IN A
`NONDESTRUCTIVE MANNER WITH RESPECT TO
`THE LAYERED PROTOCOLS
`
`224
`PAD THE PACKETS FOR ACCOMMODATING
`ELIMINATION OF THE RESTRICTED DATA ITEMS TO
`GENERATE THE RESULTING DATA ACCESS
`TRANSACTION
`
`PR6xY
`
`,,
`
`225
`RECEIVE DATA
`ACCESS
`TRASACTION
`STREAM VIA PROXY
`AND REGENERATE
`DATA ACCESS
`RESULT
`
`226
`FORWARD
`GENERATED
`RESULTING
`DATBASE ACCESS
`TRANSACTION
`STREAM VIA USER
`LOGIN
`
`L ..
`
`227
`TRANSMIT RESULTING
`DATA ACCESS
`TRANSACTION
`
`Fig. 7
`
`PALO ALTO NETWORKS Exhibit 1005 Page 8
`
`
`
`U.S. Patent
`
`Oct. 14, 2008
`
`Sheet 8 of 12
`
`US 7,437,362 Bl
`
`300
`
`INTERCEPT IN A NONINTRUSIVE MANNER, A DATA ACCESS
`TRANSACTION BETWEEN A USER APPLICATION AND A DATA
`REPOSITORY HAVING DATA ITEMS
`
`301
`ESTABLISH A PROXY TO THE DATA REPOSITORY ON
`
`BEHALF OF THE USER • 302
`• 303
`
`RECEIVE THE DATA ACCESS TRANSACTION AS A
`ROW SET UNDER THE PROXY
`
`REGENERATE THE RESULTING DATA ACCESS
`TRANSACTION AS A REDUCED ROW SET HAVING A
`SUBSET OF THE ROWS FROM THE PROXY ROW SET
`
`~
`
`304
`DETERMINE IF THE INTERCEPTED DATA ACCESS TRANSACTION
`CORRESPONDS TO A SECURITY POLICY, THE SECURITY POLICY
`INDICATIVE OF RESTRICTED DATA ITEMS IN THE DATA REPOSITORY TO
`WHICH THE USER APPLICATION IS PROHIBITED ACCESS
`
`305
`SECURITY POLICY HAS RULES, EACH OF THE RULES
`INCLUDING AN OBJECT, A SELECTION CRITERIA AND AN
`ACTION, THE ACTION INDICATIVE OF THE RESTRICTED DATA
`ITEMS
`
`+ 306
`
`ACTIONS ARE SELECTIVELY INDICATIVE OF MODIFICATIONS,
`THE MODIFICATIONS FURTHER COMPRISING ATTRIBUTES,
`OPERATORS, AND OPERANDS, THE LIMITING FURTHER
`COMPRISING
`IDENTIFYING DATA ITEMS CORRESPONDING TO THE
`ATTRIBUTES, EACH OF THE ATTRIBUTES ASSOCIATED WITH
`AN OPERATOR AND AN OPERAND
`
`+
`
`Fig. 8
`
`PALO ALTO NETWORKS Exhibit 1005 Page 9
`
`
`
`U.S. Patent
`
`Oct. 14, 2008
`
`Sheet 9 of 12
`
`US 7,437,362 Bl
`
`307
`FOR EACH ROW IN THE
`ROW SET
`
`308
`APPLY AN OPERATOR SPECIFIED FOR THE DATA ITE~ TO
`THE OPERAND SPECIFIED FOR THE DATA ITEM
`
`309
`228 DETERMINE, AS A RESULT OF APPLYING THE OPERATOR,
`WHETHER TO ELIMINATE THE IDENTIFIED DATA ITEM
`
`311
`IDENTIFY LIMITATIONS, BASED ON THE SECURITY POLICY, FOR THE DATA
`ACCESS TRANSACTION
`
`312
`MODIFY THE DATA ACCESS TRANSACTION SUCH THAT DATA
`INDICATIONS IN THE DATA ACCESS TRANSACTION CORRESPONDING
`TO RESTRICTED DATA ITEMS, ACCORDING TO THE SECURITY POLICY,
`ARE ELIMINATED FROM THE RESULTING DATA ACCESS TRANSACTION .
`
`INTERCEPT THE DATA QUERY RESPONSE FROM THE DATA
`REPOSITORY AS THE DATA ACCESS TRANSACTION, THE DATA QUERY
`RESPONSE ENCAPSULATED AS A ROW SET HAVING ROWS FROM A
`RELATIONAL DATABASE QUERY
`
`• 313
`
`Fig. 9
`
`PALO ALTO NETWORKS Exhibit 1005 Page 10
`
`
`
`U.S. Patent
`
`Oct. 14, 2008
`
`Sheet 10 of 12
`
`US 7,437,362 Bl
`
`315
`DATA INDICATIONS ARE ROWS OF DATA RETRIEVED FROM THE
`DATA REPOSITORY, AND LIMITING INCLUDES
`IDENTIFYING ROWS HAVING RESTRICTED DATA ITEMS
`
`316
`ELIMINATE THE IDENTIFIED ROWS FROM THE DATA ITEM
`TRANSACTION SUCH THAT THE RESULTING DATA ACCESS
`TRANSACTION IS A MODIFIED QUERY RESPONSE INCLUDING
`ROWS WITHOUT RESTRICTED DATA ITEMS
`
`,,
`
`317
`DATA ACCESS TRANSACTION IS A DATA QUERY RESPONSE
`INCLUDING A ROW SET AND LIMITING FURTHER COMPRISES
`COMPARING EACH OF THE ROWS IN THE ROW SET TO THE
`RULES OF THE SECURITY POLICY
`
`,,
`
`318
`SELECTIVELY ELIMINATE ROWS IN THE ROW SET INCLUDING
`THE RESTRICTED DATA ITEMS, BASED ON THE COMPARING,
`TO GENERATE A MODIFIED QUERY RESPONSE INCLUDING A
`FILTERED ROW SET
`
`,,
`
`319
`TRANSMIT THE REDUCED ROW SET TO THE USER ON BEHALF
`OF THE PROXY
`
`Fig. 10
`
`PALO ALTO NETWORKS Exhibit 1005 Page 11
`
`
`
`NAME
`Olsen
`Edison
`Tesla
`Ford -
`Carnegie
`Gates
`
`ID REGION
`I
`NE
`NE
`2
`SE
`3
`NE
`4
`NE
`5
`sw
`6
`
`STATE PHONE
`MA
`555-1111
`RI
`555-2222
`FL
`555-3333
`NY
`555-4444
`NY
`555-5555
`CA
`555-6666
`
`160
`
`16 2
`
`. F1g. 11
`
`IPADR
`
`15:3
`
`~
`OBJECT
`CI\.1D
`
`.......
`TIME ACTION MODS
`
`·~~p
`DB
`USER
`53
`c~ ut
`---
`*
`*
`*
`192.168.0.0 *
`ALLOW
`53
`GUEST CONTACT SELECT *
`~U2 *
`MODIFY Al
`•
`./ •
`---
`*
`*
`I DENY
`"\
`U3
`iza
`~
`152Cj
`
`152
`
`20
`15
`
`1-
`
`Fig .
`
`12
`
`.. ~ AI
`
`AN
`
`CONDITION ATTRIBUTE OPERAND VALUE
`STATE
`"MA", "R1"
`1N
`L REGION
`"SW"
`.L NOTIN {
`,sL
`.L'
`
`1586
`
`\
`
`15BC
`
`~156
`
`.
`F1g. 13
`
`156A
`
`PALO ALTO NETWORKS Exhibit 1005 Page 12
`
`
`
`158
`
`~
`
`158'~
`
`174
`
`Fig. 14A
`
`Fig. 148
`
`··· ......................................... ··
`
`
`
`PALO ALTO NETWORKS Exhibit 1005 Page 13
`
`
`
`US 7,437,362 Bl
`
`1
`SYSTEM AND METHODS FOR
`NONINTRUSIVE DATABASE SECURITY
`
`BACKGROUND OF THE INVENTION
`
`30
`
`2
`level security mechanism implements security scheme
`changes via the database. The database, or more specifically,
`the database management system (DBMS) or server respon(cid:173)
`sible for coordinating such access, enables a particular user to
`access certain database portions, typically tables, fields or
`rows. Changes to the security scheme involve modifications
`to the access rights to database tables, thus requiring changes
`to the database. Further, conventional DBMSs typically
`employ a database login corresponding to an application, not
`1 o to a user invoking the application. Therefore, the user does not
`directly login to the database. In typical conventional appli(cid:173)
`cations, many users invoke the same application, and accord(cid:173)
`ingly, pursue the same application level login to the database.
`Granularity of control is therefore difficult to modifY in con-
`15 ventional database security approaches.
`Therefore, such conventional approaches to database secu(cid:173)
`rity involve changes to either the client application or to the
`database server in order to effect security scheme changes.
`Embodiments of the invention, therefore, provide a system
`20 and method to implement data level security between the
`application and the database. Such data level security of the
`invention implements a security policy independently of the
`application and the database, and therefore relieves the devel(cid:173)
`oper and implementer from modifying either the application
`25 or the database to reflect the security mechanism. Embodi(cid:173)
`ments of the invention scrutinize and modify database com(cid:173)
`munications, such as a transaction stream, between the appli(cid:173)
`cation and the database to remove references or add
`constraints on access to sensitive or restricted data items.
`Embodiments of the invention are based, in part, on the
`observation that typical conventional database security
`scheme mechanisms are integrated in either the application or
`database. Maintenance of the security scheme, such as
`changes and modifications to accessibility options, require
`changes to the application and/or database. Further, since the
`conventional security scheme is embedded in the application
`or the database, integrity of the conventional security scheme
`assumes accurate enumeration of each potential stream (ac(cid:173)
`cess path) from the application into the database. Much like
`40 the weakest link of a chain, overlooking an application access
`stream may impose vulnerability on the conventional security
`scheme.
`Embodiments of the invention, such as the exemplary con(cid:173)
`figurations and segregation of duties depicted in further detail
`45 below, substantially overcome the deficiencies outlined
`above with respect to data level security in data management
`and retrieval environments, such as relational database man(cid:173)
`agement systems. Particular configurations of the invention
`employ a security filter for intercepting database streams,
`50 such as data access transactions, between an application and
`the a data repository, such as a relational database. Such an
`implementation deploys a security filter between the applica(cid:173)
`tion and database, and observes, or "sniffs" the stream of
`transactions between the application and the database. The
`55 exemplary security filter, by interrogating the transactions,
`provides a content-aware capability for seamlessly and non(cid:173)
`destructively enforcing data level security.
`A security policy, codifying security requirements
`between the users and the tables of the database, employs a
`60 plurality of rules concerning restricted and allowable data
`items. The security filter intercepts data access transactions
`and determines if the transaction triggers the rules of the
`security policy. If the "sniffed" transactions
`indicate
`restricted data items, the security filter modifies the transac-
`65 tion to eliminate only the restricted data items, and otherwise
`allows the transaction to pass with the benign data items. The
`modified transaction is receiv~hle hv the ~nnlic~tion or the
`
`Conventional applications in a data storage and retrieval
`environment typically operate with a data repository, such as
`a database, via a set of connections, or logical access streams,
`from the applications running in a user space into the data(cid:173)
`base. A user application employs a stream from among the
`available connections to perform data storage and retrieval
`operations. The connections, therefore, provide a mechanism
`for multiple users to access the conventional database via a
`suite of user applications or clients which the database sup(cid:173)
`ports.
`In a conventional data storage and retrieval environment, a
`conventional user application accesses the data repository for
`various data storage and retrieval operations. Such conven(cid:173)
`tional data manipulation operations typically occur via a data(cid:173)
`base management application accessible to the user applica(cid:173)
`tion via an Application Programming Interface (API) or other
`conventional access method. Often, in such a conventional
`data storage and retrieval environment, many users share
`access to the data objects, typically relational database tables,
`in the conventional data repository. Usually, it is neither nec(cid:173)
`essary nor desirable for every conventional user to have
`unlimited access to every data object, or table, in the data
`repository. Accordingly, conventional database driven stor(cid:173)
`age and retrieval environments attempt limit or restrict access
`to certain data objects to a particular user or users.
`Conventional database security techniques operate by
`associating database users with accessible data items.
`Accesses to the database cause the database server applica(cid:173)
`tion to invoke a check of the associations with the purported
`access, to determine if the user is allowed to access the 35
`requested data items. The database manager or other security
`mechanism implementing the security techniques either
`allow or deny access accordingly.
`
`SUMMARY
`
`Often, however, such conventional database access control
`techniques may lack granularity, such as defining users in
`terms of groups and defining the database according to global
`portions, such as groups of tables, for example. It may
`become problematic to distinguish individual users and indi(cid:173)
`vidual tables or sets in terms of a desirable or optimal security
`framework. Further, modifications to the conventional data(cid:173)
`base security scheme, such as for accommodating new users,
`applications, or access privileges, typically involve changes
`to either the conventional user or client application or data(cid:173)
`base server application, or both.
`In a conventional data storage and retrieval environment, a
`security mechanism typically takes the form of either an
`access control list (ACL) or a data level (DL) security mecha(cid:173)
`nism. The former strives to define pieces through which a user
`access the functionality for retrieving the data, and therefore
`designates which components of an application a user may
`employ. The latter approach, on the contrary, defines which
`data is visible to a particular user at the database, regardless of
`where the request emanates. The DL approach, therefore,
`allows a particular user to only "see" portions of the database
`permissible for access by the user.
`The conventional access control list allows manipulation
`of database security with reference to the access control list
`via the application. Changes to the security scheme mandate
`changes to the application. Conversely, the conventional data
`
`PALO ALTO NETWORKS Exhibit 1005 Page 14
`
`
`
`US 7,437,362 Bl
`
`3
`database by the same functions and methods which would
`have received the unmodified, unfiltered transaction stream,
`therefore allowing processing to continue unhindered by the
`security filter.
`The data access transaction, or transaction stream, may be
`either a data request from the application to the database, or a
`response from the database to the application. The security
`filter modifies a request by analyzing a query syntax conveyed
`in the transaction, such as a SQL (Structured Query Lan(cid:173)
`guage) operation, and determining additional SQL qualifiers
`to eliminate restricted data items from the data items pur(cid:173)
`ported to be retrieved by the transaction. The security filter
`modifies a response by analyzing data already retrieved, such
`as a row set corresponding to an SQL query, and identifying
`rows including restricted data items. The security filter elimi(cid:173)
`nates the rows having the restricted data items, and rebuilds
`the row set with a subset of only benign rows having unre(cid:173)
`stricted data items. The security filter then transports the
`filtered transaction to the user as the query response. There(cid:173)
`fore, the security filter provides data level security without
`changes to the applications or database (data schemas) by
`intercepting database requests and/or responses and modifY(cid:173)
`ing the transaction streams accordingly.
`In further detail, the system of the present invention teaches
`method of security enforcement for a persistent data reposi(cid:173)
`tory, such as a relational database, which intercepts a data
`access transaction between a user application and a data
`repository having a plurality of data items, i.e. tables (objects)
`containing rows of attributes. The security filter intercepts the 30
`data access transaction in a nonintrusive manner to determine
`if the intercepted data access transaction corresponds to the
`security policy. The nonintrusive manner of interception is
`undetectable to both the user application and the data reposi(cid:173)
`tory. The predefined security policy is indicative of restricted 35
`data items in the data repository to which the user/application
`is prohibited access. Based on the security policy, the security
`filter limits the data access transaction by modifying the data
`access transaction according to the security policy, such that
`data indications (i.e. retrieved fields and/or query values) in 40
`the data access transaction, corresponding to restricted data
`items, are modified or eliminated in the resulting data access
`transaction.
`The security policy employed for filtering the transactions
`has rules, in which each of the rules includes an object, a
`selection criteria of attributes, and an action indicative of the
`disposition of data items in the transaction. The actions are
`selectively indicative of modifications to the data access
`transaction, in which the modifications further include
`attributes, operators, and operands, such that limiting
`involves
`identifYing data
`items corresponding to
`the
`attributes, in which the attributes are each associated with an
`operator and an operand. By applying an operator specified
`for a particular data item to the operand specified for the data
`item, in relation to the data item sought, the security filter
`determines, as a result of applying the operator, whether to
`eliminate the identified data item.
`The data access transaction may, in a particular configura(cid:173)
`tion, be a data access statement operative to request data, in
`which limiting the transaction further includes identifYing at
`least one rule, according to the security policy, corresponding
`to the data access statement. The identified rule purports to
`restrict access to the data items indicated by the data access
`statement by concatenating selection qualifiers to the data
`access statement which triggers the identified rule. The selec(cid:173)
`tion qualifiers are therefore operable to omit the restricted
`data items from the data access statement.
`
`4
`Modification of a request in which the data indications in
`the data access transactions are references to data items in the
`data repository involves limiting the request (transaction) by
`qualifYing the references to generate a modified request
`indicative of only the unrestricted data items. The modified
`request is such that successive retrieval operations employing
`the qualified references do not retrieve restricted data items.
`In a particular arrangement, intercepting the data access
`statement includes receiving an SQL query and limiting the
`10 SQL query by appending conditional selection statements to
`the SQL query, in which the limiter computes conditional
`selection statements, derived from the security policy, to gen(cid:173)
`erate the resulting data access transaction. The modification
`of the SQL query involves manipulating a parse tree repre-
`15 sentation of the query, rather than modifYing a text string
`representation, by building a parse tree corresponding to the
`SQL query. The limiter then adds nodes in the parse tree
`corresponding to the appended conditional selection state(cid:173)
`ments, and reprocesses the parse tree to generate the resulting
`20 data access transaction as a modified parse tree operable to
`eliminate the restricted data items in the query.
`The data access transaction may also be, in another
`arrangement, a response, in which the data indications are
`rows of data (i.e. row set) retrieved from the data repository.
`25 In the case of such a response, limiting further includes iden(cid:173)
`tifYing rows having restricted data items, and eliminating the
`identified rows from the data access transaction such that the
`resulting data access transaction is a modified data query
`response including rows without restricted data items. In the
`aforementioned arrangement in which the data access trans(cid:173)
`action is a data query response including a row set, limiting
`further involves comparing each of the rows in the row set to
`the rules of the security policy, and selectively eliminating
`rows in the row set including the restricted data items, based
`on the comparing, to generate a modified query response
`including a filtered row set. Thus, the data query response
`modifications occur on whole rows of the row set embodied in
`the query response.
`The above described limitation operation may occur via
`either a proxy setup and regeneration of a login stream, or by
`nonintrusive direct modification of the stream. In the case of
`a proxy login, intercepting the data access transaction
`involves first establishing a proxy to the data repository on
`behalf of the user, and receiving the data access transaction as
`45 a row set under the proxy, thus terminating the user login
`connection and initiating the proxy login connection. Limit(cid:173)
`ing then involves regenerating the resulting data access trans(cid:173)
`action as a reduced row set having a subset of the rows from
`the proxy row set, and transmitting the reduced row set to the
`50 user on behalf of the proxy.
`In the non-proxy, or direct modification configuration, lim(cid:173)
`iting the data access transaction further includes receiving a
`set of packets, in which the packets encapsulate the data
`access transaction according to layered protocols. The inter-
`55 rogation and modification of the packets occurs in a nonde(cid:173)
`structive manner with respect to the layered protocols. The
`security filter padding the packets for accommodating elimi(cid:173)
`nation of the restricted data items to generate the resulting
`data access transaction. Therefore, the generation of the
`60 resulting data access transaction preserves the encapsulating
`layered protocol associating the packets, and without
`employing a proxy for regenerating the sequence of packets.
`The security filter embodying the system of the present
`invention performs the intercepting in a data path between a
`65 source of the data access transaction and a destination of the
`resulting data access transaction, such that limiting occurs in
`a component separate from the srmrce ~nd destin~tion. there-
`
`PALO ALTO NETWORKS Exhibit 1005 Page 15
`
`
`
`US 7,437,362 Bl
`
`5
`fore relieving the requesting application and the database
`from the burden of modification. The nonintrusive manner of
`the security filter is such that the intercepting and limiting
`occurs undetectably to both the source and the destination.
`Therefore, the requesting application and the receiving data(cid:173)
`base operate on the SQ L request or row set response expected
`in the absence of the security filter. Further, the component
`embodying the security filter may be separate from the source
`and destination in a separate network device than the compo(cid:173)
`nents corresponding to the source and destination (i.e. appli- 10
`cation and database).
`In another arrangement, the system of the present invention
`teaches a method for nonintrusive implementation of data
`level security enforcement by defining a security policy hav(cid:173)
`ing rules, in which the rules further specify attributes and 15
`conditions, as in a typical SQL query. In this configuration,
`the interceptor in the security filter intercepts a data retrieval
`request, and compares the data retrieval request to the security
`policy. The interceptor determines if the data retrieval request
`corresponds to at least one of the rules of the security policy, 20
`and identifies, via a parse tree, selectivity operators indicative
`of the allowable data items to be retrieved. The limiter then
`modifies the parse tree according to the corresponding rule to
`generate a modified data retrieval request, and forwards the
`modified data retrieval request to the data repository for sub(cid:173)
`sequent retrieval and transport to the requesting user.
`The invention as disclosed above is described as imple(cid:173)
`mented on a computer having a processor, memory, and inter(cid:173)
`face operable for performing the steps and methods for pro(cid:173)
`viding nonintrusive database security as disclosed herein.
`Other embodiments of the invention include a computerized
`device such as a computer system, central processing unit,
`microprocessor, controller, electronic circuit, application(cid:173)
`specific integrated circuit, or other hardware device config(cid:173)
`ured to process all of the method operations disclosed herein 35
`as embodiments of the invention. In such embodiments, the
`computerized device includes an interface (e.g., for receiving
`data or more segments of code of a program), a memory (e.g.,
`any type of computer readable medium), a processor and an
`interconnection mechanism connecting the interface, the pro- 40
`cessor and the memory. In such embodiments, the memory
`system is encoded with an application having components
`that when performed on the processor, produces a process or
`processes that causes the computerized device to perform any
`and/or all of the method embodiments, steps and operations 45
`explained herein as embodiments of the invention to allow
`execution of instructions in a computer program such as a
`Java, HTML, XML, C, or C++ application. In other words, a
`computer, processor or other electronic device that is pro(cid:173)
`grammed to operate embodiments of the invention as 50
`explained herein is itself considered an embodiment of the
`invention.
`
`BRIEF DESCRIPTION OF THE DRAWINGS
`
`The foregoing and other objects, features and advantages
`of the invention will be apparent from the following more
`particular description of preferred embodiments of the inven(cid:173)
`tion, as illustrated in the accompanying drawings in which
`like reference characters refer to the same parts throughout
`the different views. The drawings are not necessarily to scale,
`with emphasis instead being placed upon illustrating the
`embodiments, principles and concepts of the invention.
`FIG. 1 is a block diagram of a data storage and retrieval
`environment suitable for use with the present invention;
`FIG. 2 is a fl