# US 7,590,630 B2 · Managing electronic information

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 7,590,630 B2
- Document ID: US7590630B2
- Status: Granted
- Kind: B2
- Application number: 10/736,001
- Filed: 2003-12-15
- Published: 2005-06-16
- Granted: 2009-09-15
- Earliest claimed: 2003-12-15
- Assignees: Electronic Data System Corporation
- Inventors: John D. Richter
- Web page: https://patentgrep.com/patent/US7590630B2

## CPC

- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Electronic information management includes techniques for developing and applying database security. In certain implementations, database access statements issued for applications in use are analyzed. Analyzing issued database access statements may include capturing the database access statements, normalizing the database access statements, and eliminating redundancies from the database access statements. A standardized set of issued database access statements may result from the analysis procedure. From the analyzed database access statements, the items accessed and types of access may be determined for an application, and a set of permissions may be determined from the determined items accessed and types of access for the application. A role associated with the application may be developed based on the permissions for the application. The role may be used to allow a user database access when associated with the application.

## Claims

### Claim 1

A method implemented by a computer, the method comprising:
analyzing a plurality of database access statements stored in a computer memory that were issued for an application during the application's use to determine previous accessed items and types of access for the application; and
developing a role for the application based on the previous accessed items and types of access for the application, wherein when the application is in use by a user, the developed role for the application allows the user database access.

### Claim 2 (depends on 1)

The method of claim 1 wherein analyzing the issued database access statements comprises:
capturing the plurality of database access statements;
normalizing the captured database access statements; and
eliminating redundancies in the normalized database access statements.

### Claim 3 (depends on 2)

The method of claim 2 wherein the database access statements comprise Structured Query Language (SQL) queries.

### Claim 4 (depends on 1)

The method of claim 1 wherein the previous accessed items and types of access include objects accessed and operations performed on the objects.

### Claim 5 (depends on 1)

The method of claim 1 wherein developing a role comprises determining permissions for the application based on the previous accessed items and types of access.

### Claim 6 (depends on 1)

The method of claim 1 further comprising determining which of a set of users are authorized to use the application.

### Claim 7 (depends on 1)

The method of claim 1 further comprising:
detecting a user request to establish an application session;
finding the role for the application; and
assigning the role to a user.

### Claim 8 (depends on 7)

The method of claim 7 wherein detecting a user request to establish an application session comprises determining if a user is authorized to use the application.

### Claim 9 (depends on 7)

The method of claim 7 further comprising:
detecting an end of the application session; and
if an end of the application session is detected, disabling the assigned role for the user.

### Claim 10

An article of manufacture comprising:
a machine-readable storage medium storing instructions configured to cause one or more machines to perform operations comprising:
analyzing a plurality of database access statements that were issued for an application during the application's use to determine previous accessed items and types of access for the application; and
developing a role for the application based on the previous accessed items and types of access for the application, wherein when the application is in use by a user, the developed role for the application allows the user database access.

### Claim 11 (depends on 10)

The article of claim 10, wherein analyzing the issued database access statements comprises:
determining whether the plurality of database access statements have been captured;
normalizing the captured database access statements; and
eliminating redundancies in the normalized database access statements.

### Claim 12 (depends on 10)

The article of claim 10 wherein the previous accessed items and types of access include objects accessed and operations performed on the objects.

### Claim 13 (depends on 10)

The article of claim 10 wherein developing a role comprises determining permissions for the application based on the previous accessed items and types of access.

### Claim 14 (depends on 10)

The article of claim 10 wherein the instructions are further configured to cause one or more machines to perform operations comprising determining which of a set of users are authorized to use the application.

### Claim 15 (depends on 10)

The article of claim 10 wherein the instructions are further configured to cause one or more machines to perform operations comprising:
determining whether a user request to establish an application session has been detected; finding the role for the application; and
assigning the role to a user.

### Claim 16 (depends on 15)

The article of claim 15 wherein determining whether a user request to establish an application session has been detected comprises determining if a user is authorized to use the application.

### Claim 17 (depends on 15)

The article of claim 15 wherein the instructions are further configured to cause one or more machines to perform operations comprising:
detecting an end of the application session; and if an end of the application session is detected, disabling the assigned role for the user.

### Claim 18

A database security analyzer comprising:
a communication interface configured to receive a plurality of database access statements that were issued for an application during the application's use;
a memory configured to store the issued database access statements; and
a processor configured to develop a role for the application based on the previously issued database access statements for the application, wherein when the application is in use by a user, the developed role for the application allows a user database access.

### Claim 19 (depends on 18)

The analyzer of claim 18 wherein developing a role comprises:
analyzing the database access statements to determine previous accessed items and types of access for the application;
determining permissions for the application based on the previous accessed items and types of access for the application; and
developing a role associated with the application based on the determined permissions.

### Claim 20 (depends on 19)

The analyzer of claim 19 wherein the previous accessed items and types of access include objects accessed and operations performed on the objects.

### Claim 21 (depends on 18)

The analyzer of claim 18 wherein developing a role comprises:
determining whether the received database access statements have been captured;
normalizing the captured database access statements; and
eliminating redundancies in the normalized database access statements.

### Claim 22 (depends on 18)

The analyzer of claim 18 wherein the memory comprises instructions, and the processor operates according to the instructions.

### Claim 23

A method implemented by a computer comprising:
capturing a plurality of database access statements that were issued for one or more applications during the application's use, wherein the database access statements comprise Structured Query Language (SQL) queries;
normalizing the captured database access statements;
eliminating redundancies in the normalized database access statements;
analyzing the normalized database access statements stored in a computer memory to determine previous accessed items and types of access for an application, wherein the previous accessed items and types of access include objects accessed and operations performed on the objects;
determining permissions for the application based on the previous accessed items and types of access for the application;
developing a role for the application based on the determined permissions;
determining which of a set of users are authorized to use the application;
detecting a user request to establish a session of the application;
determining if the user is authorized to use the application;
if the user is authorized to use the application, finding the role for the application;
assigning the role to the user;
detecting an end of the application session; and
if an end of the application session is detected, disabling the assigned role for the user.