A system including a processor and a memory is described. The memory is coupled to the processor and configured to provide the processor with instructions. The processor is configured to receive from an identity provider a validation indication for a user as a proxy. The validation indication is for a database, the identity provider, and the user. The processor is also configured to configure a data flow between the database and a client corresponding to the user through the proxy using the validation indication.
The present application discloses a method, system, and computer system for obtaining responses to a query. The method includes: (a) receiving, at a sidecar, a communication for a data source, (b) determining, by the sidecar, a policy corresponding to the communication, the policy identifying a user-defined function (UDF) corresponding to the policy, the UDF being stored by the data source, and (c) invoking the UDF based on the policy using the sidecar.
G06F 21/53 - Contrôle des utilisateurs, des programmes ou des dispositifs de préservation de l’intégrité des plates-formes, p. ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade de l’exécution du programme, p. ex. intégrité de la pile, débordement de tampon ou prévention d'effacement involontaire de données par exécution dans un environnement restreint, p. ex. "boîte à sable" ou machine virtuelle sécurisée
A technique for intruder detection is described. Communications for a data source in an organization are intercepted and analyzed to identify an intruder detection signature. An intrusion is determined based on the intruder detection signature and an alarm generated based on the intrusion.
A method for accessing a data repository by a service is described. The method includes requesting an authenticator for credentials using a role-based identity. The services receives, from the authenticator, temporary data repository access credentials that are based on the role-based identity. The temporary data repository access credentials are abstracted from the credentials. The service accesses the data repository using the temporary data repository access credentials.
A method and system for performing at least one service are disclosed. The method and system include receiving a communication for a data source at a wrapper. The wrapper includes a dispatcher and at least one service. The dispatcher receives the communication and is data agnostic. The method and system also include providing the communication from the dispatcher to the data source and to the at least one service. The at least one service inspects the communication and may perform additional functions.
H04L 69/326 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche transport [couche OSI 4]
H04L 69/329 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche application [couche OSI 7]
A method for accessing a data repository by a service is described. The method includes requesting an authenticator for credentials using a role-based identity. The services receives, from the authenticator, temporary data repository access credentials that are based on the role-based identity. The temporary data repository access credentials are abstracted from the credentials. The service accesses the data repository using the temporary data repository access credentials.
A method and system for performing at least one service are disclosed. The method and system include receiving a communication for a data source at a wrapper. The wrapper includes a dispatcher and at least one service. The dispatcher receives the communication and is data agnostic. The method and system also include providing the communication from the dispatcher to the data source and to the at least one service. The at least one service inspects the communication and may perform additional functions.
H04L 69/326 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche transport [couche OSI 4]
H04L 69/329 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche application [couche OSI 7]
A method for accessing a data source is described. A communication for the data source is received from a proxy at a sidecar. The proxy mirrors the communication so that the communication is provided to the data source and the sidecar. The sidecar includes a dispatcher and service(s). The dispatcher receives the communication, is data agnostic, and provides the communication to the data source and service(s). The service(s) inspect the communication. In some embodiments, the dispatcher is an open systems interconnection (OSI) Layer 4 dispatcher and the service(s) include OSI Layer 7 service(s). The service(s) perform function(s) based on the communication.
A system for adapting to topology changes in a proxy is described. The system includes a processor and a memory coupled to the processor and configured to provide the processor with instructions. The processor is configured to intercept a plurality of communications and match a communication signature for a topology update in a communication. The processor is further configured to identify topology update information in the communication and update listener(s) based on the topology update information. The processor also translates the topology update information and sends the translated topology information to a client.
A method and system for anonymizing data are disclosed. The method and system include receiving, at the wrapper, a request to store data in a data source. The wrapper includes a dispatcher and at least one service. The dispatcher receives the communication and is data agnostic. The method and system also include providing the request from the dispatcher to the at least one service and anonymizing, at the service(s), the data to provide anonymized data.
H04L 69/326 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche transport [couche OSI 4]
H04L 69/329 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche application [couche OSI 7]
G06F 21/62 - Protection de l’accès à des données via une plate-forme, p. ex. par clés ou règles de contrôle de l’accès
A method is described. The method includes receiving, at an intermediary such as a sidecar, a request from an application for a computing resource. The request is authenticated using a sidecar credential. The sidecar credential is verified to authenticate the application to the sidecar. The request is sent from the sidecar to the computing resource. A response from the computing resource is received at the sidecar and relayed from the sidecar to the application.
A method for accessing a data source is described. A communication for the data source is received from a proxy at a sidecar. The proxy mirrors the communication so that the communication is provided to the data source and the sidecar. The sidecar includes a dispatcher and service(s). The dispatcher receives the communication, is data agnostic, and provides the communication to the data source and service(s). The service(s) inspect the communication. In some embodiments, the dispatcher is an open systems interconnection (OSI) Layer 4 dispatcher and the service(s) include OSI Layer 7 service(s). The service(s) perform function(s) based on the communication.
A system for adapting to topology changes in a proxy is described. The system includes a processor and a memory coupled to the processor and configured to provide the processor with instructions. The processor is configured to intercept a plurality of communications and match a communication signature for a topology update in a communication. The processor is further configured to identify topology update information in the communication and update listener(s) based on the topology update information. The processor also translates the topology update information and sends the translated topology information to a client.
A method for protecting sensitive data is described. The method includes receiving a communication for data for a data source. The method includes rewriting the communication to generate a rewritten communication. The rewritten communication utilizes data masking resources at the data source. The rewritten communication is provided to the data source. Masked data is generated by the data masking resources in response to the rewritten communication.
A method is described. The method includes receiving a communication to a data source for a user in a group. User authentication is performed for the user based on the group in response to the communication being received. The method includes determining a current authorization for the user at the data source using a utility and in response to the user being authenticated based on the group. The user is granted time-based access to the data source in response to the user authentication and the current authorization both being successful. The time-based access has a specified termination time. The communication is provided to the data source in for the user being granted the time-based access.
A method is described. The method includes receiving a communication including a command for a data source accessed via an interface. The interface is a data source agnostic platform and is capable of decoupling execution of the commands for the data source from a current session. The method also includes generating an augmented communication including the command and dynamically injected code for enforcing at least one policy. The augmented communication is provided to the interface. The interface enforces policies in response to the dynamically injected code in the augmented communication being executed by the interface.
A method and system for performing query analysis are described. The method and system include receiving a query for a data source at a wrapper. The wrapper includes a dispatcher and a service. The dispatcher receives the query and is data agnostic. The method and system also include providing the query from the dispatcher to the data source and to the service as well as analyzing the query using the service.
H04L 69/326 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche transport [couche OSI 4]
H04L 69/329 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche application [couche OSI 7]
A method is described. The method includes receiving, from a service application having a protocol, a communication for a data source. The communication indicates a user of the service application and is consistent with the protocol, Thus, the user corresponds to the communication. The method also includes utilizing signatures that are dynamically updated from a control plane to determine the service application based on the communication and a corresponding signature. The user is identified based on the communication, the service application, and the protocol. Each of the signatures includes executable code for identifying features of the protocol of a corresponding service application and obtaining an identity of the user from a corresponding communication.
A method and system are disclosed. The method and system include receiving, at a wrapper, a communication and a context associated with the communication from a client. The communication is for a data source. The wrapper includes a dispatcher and a service. The dispatcher receives the communication and is data agnostic. The method and system also include providing the context from the dispatcher to the service. In some embodiments, the method and system use the service to compare the context to a behavioral baseline for the client. The behavioral baseline incorporates a plurality of contexts previously received from the client.
G06F 21/62 - Protection de l’accès à des données via une plate-forme, p. ex. par clés ou règles de contrôle de l’accès
H04L 69/326 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche transport [couche OSI 4]
H04L 69/329 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche application [couche OSI 7]
A method for providing connection between applications and a data repository is described. The method includes receiving a communication from an application for the data repository. The application is authenticated. In response to the application being authenticated, the credentials for the data repository are obtained from a data vault. The credentials are used to access the data repository while the application is free of the credentials.
A method for providing connection between applications and a data repository is described. The method includes receiving a communication from an application for the data repository. The application is authenticated. In response to the application being authenticated, the credentials for the data repository are obtained from a data vault. The credentials are used to access the data repository while the application is free of the credentials.
G06F 7/04 - Contrôle d'égalité, c.-à-d. pour valeurs égales ou non
G06F 15/16 - Associations de plusieurs calculateurs numériques comportant chacun au moins une unité arithmétique, une unité programme et un registre, p. ex. pour le traitement simultané de plusieurs programmes
G06F 17/30 - Recherche documentaire; Structures de bases de données à cet effet
H04L 29/06 - Commande de la communication; Traitement de la communication caractérisés par un protocole
G06F 21/45 - Structures ou outils d’administration de l’authentification
G06F 21/44 - Authentification de programme ou de dispositif
A technique for intruder detection is described. Communications for a data source in an organization are intercepted and analyzed to identify an intruder detection signature. An intrusion is determined based on the intruder detection signature and an alarm generated based on the intrusion.
A method and system for performing at least one service are disclosed. The method and system include receiving a communication for a data source at a wrapper. The wrapper includes a dispatcher and at least one service. The dispatcher receives the communication and is data agnostic. The method and system also include providing the communication from the dispatcher to the data source and to the at least one service. The at least one service inspects the communication and may perform additional functions.
H04L 69/326 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche transport [couche OSI 4]
H04L 69/329 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche application [couche OSI 7]
24.
Sidecar architecture for stateless proxying to databases
A mechanism for providing connection to a database is described. A connection to the database is intercepted. The connection is assigned to an instance of the database. A sidecar is configured to proxy the connection to the database. The sidecar is stateless and passes all communications for the connection to the instance of the database.
H04L 69/329 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche application [couche OSI 7]
H04L 69/326 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche transport [couche OSI 4]
25.
Federated identity management for data repositories
A method and system for performing federated identity management are described. The method and system include receiving a communication for a data source at a wrapper. The wrapper includes a dispatcher and a service. The dispatcher receives the communication and is data agnostic. The communication corresponds to end user credentials for an end user. The method and system include providing the communication from the dispatcher to the data source and to the service. The method and system also use the service to authenticate the end user based on the end user credentials and utilizing federated identity management.
H04L 69/326 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche transport [couche OSI 4]
H04L 69/329 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche application [couche OSI 7]
A mechanism for providing connection to a database is described. A connection to the database is intercepted. The connection is assigned to an instance of the database. A sidecar is configured to proxy the connection to the database. The sidecar is stateless and passes all communications for the connection to the instance of the database.
A technique for intruder detection is described. Communications for a data source in an organization are intercepted and analyzed to identify an intruder detection signature. An intrusion is determined based on the intruder detection signature and an alarm generated based on the intrusion.
G06F 11/00 - Détection d'erreursCorrection d'erreursContrôle de fonctionnement
G06F 21/00 - Dispositions de sécurité pour protéger les calculateurs, leurs composants, les programmes ou les données contre une activité non autorisée
H04L 9/00 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité
A technique for intruder detection is described. Communications for a data source in an organization are intercepted and analyzed to identify an intruder detection signature. An intrusion is determined based on the intruder detection signature and an alarm generated based on the intrusion.
A mechanism for providing connection to a database is described. A connection to the database is intercepted. The connection is assigned to an instance of the database. A sidecar is configured to proxy the connection to the database. The sidecar is stateless and passes all communications for the connection to the instance of the database.
H04L 69/329 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche application [couche OSI 7]
H04L 69/326 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche transport [couche OSI 4]
30.
ARCHITECTURE HAVING A PROTECTIVE LAYER AT THE DATA SOURCE
A method and system for performing at least one service are disclosed. The method and system include receiving a communication for a data source at a wrapper. The wrapper includes a dispatcher and at least one service. The dispatcher receives the communication and is data agnostic. The method and system also include providing the communication from the dispatcher to the data source and to the at least one service. The at least one service inspects the communication and may perform additional functions.
A method and system are disclosed. The method and system include receiving, at a wrapper, a communication and a context associated with the communication from a client. The communication is for a data source. The wrapper includes a dispatcher and a service. The dispatcher receives the communication and is data agnostic. The method and system also include providing the context from the dispatcher to the service. In some embodiments, the method and system use the service to compare the context to a behavioral baseline for the client. The behavioral baseline incorporates a plurality of contexts previously received from the client.
H04L 69/326 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche transport [couche OSI 4]
H04L 69/329 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche application [couche OSI 7]
G06F 21/62 - Protection de l’accès à des données via une plate-forme, p. ex. par clés ou règles de contrôle de l’accès
A method and system for performing authentication are described. The method and system include receiving, from a client, a communication for a data source at a wrapper. The wrapper includes a dispatcher and a service. The dispatcher receives the communication and is data agnostic. The communication is provided from the dispatcher to the service. The service determines whether the client is authorized to access the data source utilizing multi-factor authentication.
H04L 69/326 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche transport [couche OSI 4]
H04L 69/329 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche application [couche OSI 7]
G06F 21/62 - Protection de l’accès à des données via une plate-forme, p. ex. par clés ou règles de contrôle de l’accès
A method and system for performing at least one service are disclosed. The method and system include receiving a communication for a data source at a wrapper. The wrapper includes a dispatcher and at least one service. The dispatcher receives the communication and is data agnostic. The method and system also include providing the communication from the dispatcher to the data source and to the at least one service. The at least one service inspects the communication and may perform additional functions.
H04L 69/326 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche transport [couche OSI 4]
H04L 69/329 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche application [couche OSI 7]
A method and system for anonymizing data are disclosed. The method and system include receiving, at the wrapper, a request to store data in a data source. The wrapper includes a dispatcher and at least one service. The dispatcher receives the communication and is data agnostic. The method and system also include providing the request from the dispatcher to the at least one service and anonymizing, at the service(s), the data to provide anonymized data.
H04L 69/326 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche transport [couche OSI 4]
H04L 69/329 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche application [couche OSI 7]
G06F 21/62 - Protection de l’accès à des données via une plate-forme, p. ex. par clés ou règles de contrôle de l’accès
A method and system for performing query analysis are described. The method and system include receiving a query for a data source at a wrapper. The wrapper includes a dispatcher and a service. The dispatcher receives the query and is data agnostic. The method and system also include providing the query from the dispatcher to the data source and to the service as well as analyzing the query using the service.
H04L 69/326 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche transport [couche OSI 4]
H04L 69/329 - Protocoles de communication intra-couche entre entités paires ou définitions d'unité de données de protocole [PDU] dans la couche application [couche OSI 7]
G06F 21/62 - Protection de l’accès à des données via une plate-forme, p. ex. par clés ou règles de contrôle de l’accès
A method and system for performing federated identity management are described. The method and system include receiving a communication for a data source at a wrapper. The wrapper includes a dispatcher and a service. The dispatcher receives the communication and is data agnostic. The communication corresponds to end user credentials for an end user. The method and system include providing the communication from the dispatcher to the data source and to the service. The method and system also use the service to authenticate the end user based on the end user credentials and utilizing federated identity management.
brevets
