# US 2019/0319969 A1 · Man-in-the-middle (MITM) checkpoint in a cloud database service environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319969 A1 - Document ID: US20190319969A1 - Status: Published application - Kind: A1 - Application number: 15/953,132 - Filed: 2018-04-13 - Published: 2019-10-17 - Earliest claimed: 2018-04-13 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Leonid Rodniansky - Web page: https://patentgrep.com/patent/US20190319969A1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/101: {Access control lists [ACL]} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A technique to protect a cloud database located at a database server and accessible from a database client. In this approach, a communication associated with a database session is intercepted. A hostname or network address associated with the communication is then evaluated to determine whether such information can be found in or otherwise derived from data in a database protocol packet associated with the database session. The information typically is placed there unavoidably by the cloud database client and normally cannot be spoofed by a process that does not understand or speak the proper database protocol semantics. Upon a mismatch, the database session is flagged as being potentially associated with a man-in-the-middle (MITM), in which case a given action may then be taken with respect to the database session that is then active. The technique provides for a MITM checkpoint in a cloud database service environment. ## Claims ### Claim at position 1 1-7. (canceled) ### Claim 8 Apparatus to protect a cloud database located at a database server and accessible from a database client, wherein the database client communicates with the database server over a database protocol, comprising: a processor; computer memory holding computer program instructions executed by the processor, the computer program instructions configured to: intercept a communication associated with a database session, the database session being directed to the database server; evaluate whether a hostname or network address associated with the communication is located in or derivable from data in a database protocol packet associated with the database session; and when the hostname or network address associated with the session is not located in or derivable from the data in the database protocol packet, identify the database session as being potentially associated with a man-in-the-middle instead of the database client. ### Claim 9 (depends on 8) The apparatus as described in claim 8 wherein the communication is one of: a session request initiated by the database client; a response to the session request returned by the database server, and a session request initiated by the databased client together with the response to the session request returned by the database server. ### Claim 10 (depends on 8) The apparatus as described in claim 8 wherein the computer program instructions are further configured to: determine whether the hostname or the network address has been previously seen; upon a determination that the hostname or the network address has not been previously seen, enter a proxy mode of operation for a configurable number of login packets associated with the database session and perform the evaluate operation. ### Claim 11 (depends on 8) The apparatus as described in claim 8 wherein the computer program instructions are further configured to take an action with respect to the database session that has been determined to be potentially associated with a man-in-the-middle. ### Claim 12 (depends on 11) The apparatus as described in claim 11 wherein the action is one of: terminating the database session, allowing the database session to continue, issuing a notification, throttling the database session, and forwarding the database session for further evaluation. ### Claim 13 (depends on 8) The apparatus as described in claim 8 wherein the computer program instructions are further configured to add the hostname or network address to a list of potentially suspect hostnames or network addresses. ### Claim 14 (depends on 8) The apparatus as described in claim 8 wherein the database client is located within a private network, and the database server and the cloud database are accessible at a third party network. ### Claim 15 A computer program product in a non-transitory computer readable medium for use in a data processing system, the data processing system configured to protect a cloud database located at a database server and accessible from a database client, and wherein the database client communicates with the database server over a database protocol, the computer program product holding computer program instructions that, when executed by the data processing system, are configured to: intercept a communication associated with a database session, the database session being directed to the database server; evaluate whether a hostname or network address associated with the communication is located in or derivable from data in a database protocol packet associated with the database session; and when the hostname or network address associated with the session is not located in or derivable from the data in the database protocol packet, identify the database session as being potentially associated with a man-in-the-middle instead of the database client. ### Claim 16 (depends on 15) The computer program product as described in claim 15 wherein the communication is one of: a session request initiated by the database client; a response to the session request returned by the database server, and a session request initiated by the databased client together with the response to the session request returned by the database server. ### Claim 17 (depends on 15) The computer program product as described in claim 15 wherein the computer program instructions are further configured to: determine whether the hostname or the network address has been previously seen; upon a determination that the hostname or the network address has not been previously seen, enter a proxy mode of operation for a configurable number of login packets associated with the database session and perform the evaluate operation. ### Claim 18 (depends on 15) The computer program product as described in claim 15 wherein the computer program instructions are further configured to take an action with respect to the database session that has been determined to be potentially associated with a man-in-the-middle. ### Claim 19 (depends on 18) The computer program product as described in claim 18 wherein the action is one of: terminating the database session, allowing the database session to continue, issuing a notification, throttling the database session, and forwarding the database session for further evaluation. ### Claim 20 (depends on 15) The computer program product as described in claim 15 wherein the computer program instructions are further configured to add the hostname or network address to a list of potentially suspect hostnames or network addresses.