Reinforcing SQL transactions dynamically to prevent injection attacks
US11562095B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Jan 28, 2021 |
| Grant date | Jan 24, 2023 |
| Priority date | — |
| Expiry date | Mar 26, 2041 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F21/602
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
A database protection system (DPS) mitigates injection attacks. DPS receives an unrestricted database query, extract a syntax tree, and evaluates whether it recognizes the query. To this end, DPS applies a hash function over the extracted syntax tree, and then determines whether the resulting hash has been seen by DPS before. If so, DPS retrieves a previously-generated prepared statement associated with the syntax tree, and that prepared statement is then forward to the database server in lieu of sending the original query. If the syntax tree is not recognized, DPS creates a new prepared statement, generates a hash of the syntax tree, and stores the hash and the new prepared statement, and forwards the new prepared statement. The prepared statements are configured based on the native wire protocol used by the database server, and DPS includes additional functionality by which it can learn the semantics of this protocol if necessary.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.