# US 9,519,774 B2 · Systems and methods for SQL query constraint solving

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,519,774 B2
- Document ID: US9519774B2
- Status: Granted
- Kind: B2
- Application number: 14/599,978
- Filed: 2015-01-19
- Published: 2015-07-23
- Granted: 2016-12-13
- Earliest claimed: 2014-01-20
- Assignees: Prevoty, Inc.
- Applicants: Prevoty, Inc.
- Inventors: Kunal Anand; Joseph Rozner; Merritt Carl Vincent; Stephen Weinberg
- Web page: https://patentgrep.com/patent/US9519774B2

## CPC

- G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow}
- G06F 16/2365: {Ensuring data consistency and integrity}
- G06F 16/2452: Query translation
- G06F 16/24565: {Triggers; Constraints}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 2221/033: Test or assess software
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The present invention relates to systems and methods for analyzing SQL queries for constraint violations, which may indicate injection attacks. The systems and methods tokenize a SQL query to generate a token stream. Next, lexical nodes are generated by iterating over the token stream. Then, a parse tree can be constructed by iterating over the lexical nodes. The parse tree may be compared to a SQL schema and access configuration for a database in order to analyze the SQL query for constraint violations, including determining the number of queries in the parse tree, identifying invalid fields and table access, identifying invalid field type comparisons and pattern matches, and identifying early statement termination.

## Claims

### Claim 1

A computerized method for analyzing SQL queries for constraint violations comprising:
tokenizing a SQL query to generate a token stream;
generating lexical nodes by iterating over the token stream to chunk into SQL commands, SQL functions and field/table identifiers;
constructing a parse tree by iterating over the lexical nodes;
analyzing, using a processor, the parse tree for constraint violations by comparing the parse tree to a SQL schema and access configuration for a database, wherein the analyzing includes identifying invalid fields and table access, wherein identifying invalid fields and table access comprises identifying parse tree identifiers for fields or tables that do not exist or for which access is restricted; and
performing risk mitigation for SQL queries that are likely harboring an SQL injection attack.

### Claim 2 (depends on 1)

The method of claim 1, wherein the analyzing includes determining the number of queries in the parse tree.

### Claim 3 (depends on 2)

The method of claim 2, further comprising at least one of identifying multiple SQL statements, delineating by a query separator, and identifying sub-queries.

### Claim 4 (depends on 1)

The method of claim 1, wherein the analyzing includes identifying invalid field type comparisons and pattern matches.

### Claim 5 (depends on 4)

The method of claim 4, wherein identifying invalid field type comparisons and pattern matches comprises identifying where the field input mismatches the SQL query function, or where field are compared by the SQL query which are restricted from being compared by the access configuration.

### Claim 6 (depends on 1)

The method of claim 1, wherein the analyzing includes identifying early statement termination.

### Claim 7 (depends on 1)

The method of claim 1, further comprising outputting a report of the analysis.

### Claim 8

A system for analyzing SQL queries for constraint violations comprising:
a processor executing computer readable medium to:
tokenize a SQL query to generate a token stream;
generate lexical nodes by iterating over the token stream to chunk into SQL commands, SQL functions and field/table identifiers;
construct a parse tree by iterating over the lexical nodes;
analyze the parse tree for constraint violations by comparing the parse tree to a SQL schema and access configuration for a database, wherein the query constraint solver is further configured to identify invalid fields and table access, wherein identifying invalid fields and table access comprises identifying parse tree identifiers for fields or tables that do not exist or for which access is restricted; and
perform risk mitigation for SQL queries that are likely harboring an SQL injection attack.

### Claim 9 (depends on 8)

The system of claim 8, wherein the query constraint solver is further configured to determine the number of queries in the parse tree.

### Claim 10 (depends on 9)

The system of claim 9, the query constraint solver is further configured to identify multiple SQL statements, delineate by a query separator, and identify sub-queries.

### Claim 11 (depends on 8)

The system of claim 8, wherein the query constraint solver is further configured to identify invalid field type comparisons and pattern matches.

### Claim 12 (depends on 11)

The system of claim 11, wherein identifying invalid field type comparisons and pattern matches comprises identifying where the field input mismatches the SQL query function, or where field are compared by the SQL query which are restricted from being compared by the access configuration.

### Claim 13 (depends on 8)

The system of claim 8, wherein the query constraint solver is further configured to identify early statement termination.

### Claim 14 (depends on 8)

The system of claim 8, the query constraint solver is further configured to output a report of the analysis.