US 11,888,871 B2 · Man-in-the-middle (MITM) checkpoint in a cloud database service environment

Abstract

A technique to protect a cloud database located at a database server and accessible from a database client. In this approach, a communication associated with a database session is intercepted. A hostname or network address associated with the communication is then evaluated to determine whether such information can be found in or otherwise derived from data in a database protocol packet associated with the database session. The information typically is placed there unavoidably by the cloud database client and normally cannot be spoofed by a process that does not understand or speak the proper database protocol semantics. Upon a mismatch, the database session is flagged as being potentially associated with a man-in-the-middle (MITM), in which case a given action may then be taken with respect to the database session that is then active. The technique provides for a MITM checkpoint in a cloud database service environment.

Claims17

Dependent claims

A method of protecting a cloud database located at a database server and accessible from a database client, wherein the database client communicates with the database server over a database protocol, comprising:

receiving a communication associated with a database session, the database session being directed to the database server;
following receipt of the communication, switching from a first operating mode to a second operating mode;
evaluating whether a hostname or network address associated with the communication is located in or derivable from data in a database protocol packet, the database protocol packet associated with the database session;
and
when the hostname or network address associated with the database session is not located in or derivable from the data in the database protocol packet, identifying the database session as being potentially associated with a man-in-the-middle instead of the database client;
wherein the first operating mode is a transparent gateway operating mode, and wherein the second operating mode is a proxy operating mode.

3 more elements

Apparatus to protect a cloud database located at a database server and accessible from a database client, wherein the database client communicates with the database server over a database protocol, comprising:

a processor;
computer memory holding computer program instructions executed by the processor, the computer program instructions configured to:
receive a communication associated with a database session, the database session being directed to the database server;
following receipt of the communication, switch from a first operating mode to a second operating mode;
evaluate whether a hostname or network address associated with the communication is located in or derivable from data in a database protocol packet, the database protocol packet associated with the database session;
and
when the hostname or network address associated with the database session is not located in or derivable from the data in the database protocol packet, identify the database session as being potentially associated with a man-in-the-middle instead of the database client;
wherein the first operating mode is a transparent gateway operating mode, and wherein the second operating mode is a proxy operating mode.

5 more elements

A computer program product in a non-transitory computer readable medium for use in a data processing system, the data processing system configured to protect a cloud database located at a database server and accessible from a database client, and wherein the database client communicates with the database server over a database protocol, the computer program product holding computer program instructions that, when executed by the data processing system, are configured to:

receive a communication associated with a database session, the database session being directed to the database server;
following receipt of the communication, switch from a first operating mode to a second operating mode;
evaluate whether a hostname or network address associated with the communication is located in or derivable from data in a database protocol packet, the database protocol packet associated with the database session;
and
when the hostname or network address associated with the database session is not located in or derivable from the data in the database protocol packet, identify the database session as being potentially associated with a man-in-the-middle instead of the database client;
wherein the first operating mode is a transparent gateway operating mode, and wherein the second operating mode is a proxy operating mode.

3 more elements

Dependencies are inferred from the claim text.

Man-in-the-middle (MITM) checkpoint in a cloud database service environment

Life of this patent

Man-in-the-middle (MITM) checkpoint in a cloud database service environment

Life of this patent

Abstract

Claims17