US 11,949,676 B2
Query analysis using a protective layer at the data source
Manav Ratan Mital, Mountain View, CA (US); Srinivas Nageswarrao Vadlamani, San Jose, CA (US); and Pramod Chandraiah, Pleasanton, CA (US)
Assigned to Cyral Inc., Milpitas, CA (US)
Filed by Cyral Inc., Milpitas, CA (US)
Filed on Aug. 31, 2022, as Appl. No. 17/899,950.
Application 17/899,950 is a continuation of application No. 16/548,740, filed on Aug. 22, 2019, granted, now 11,470,084.
Claims priority of provisional application 62/840,847, filed on Apr. 30, 2019.
Claims priority of provisional application 62/758,223, filed on Nov. 9, 2018.
Claims priority of provisional application 62/733,013, filed on Sep. 18, 2018.
Prior Publication US 2023/0064206 A1, Mar. 2, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 16/2453 (2019.01); G06F 11/30 (2006.01); G06F 11/34 (2006.01); G06F 21/31 (2013.01); G06F 21/60 (2013.01); G06F 21/62 (2013.01); H04L 9/40 (2022.01); H04L 69/326 (2022.01); H04L 69/329 (2022.01); H04L 67/01 (2022.01)
CPC H04L 63/0884 (2013.01) [G06F 11/3006 (2013.01); G06F 11/3438 (2013.01); G06F 11/3476 (2013.01); G06F 16/24547 (2019.01); G06F 21/31 (2013.01); G06F 21/604 (2013.01); G06F 21/6227 (2013.01); G06F 21/6254 (2013.01); H04L 63/0281 (2013.01); H04L 63/101 (2013.01); H04L 63/102 (2013.01); H04L 63/104 (2013.01); H04L 63/105 (2013.01); H04L 63/1425 (2013.01); H04L 63/166 (2013.01); H04L 63/168 (2013.01); H04L 69/326 (2013.01); H04L 69/329 (2013.01); G06F 2221/2107 (2013.01); H04L 67/01 (2022.05); H04L 2463/082 (2013.01)] 17 Claims
OG exemplary drawing
 
1. A method, comprising:
receiving a query for a data source at a wrapper, the wrapper including a dispatcher and a service, the dispatcher receiving the query and being data agnostic;
providing the query from the dispatcher to the data source and to the service; and
analyzing the query using the service, comprising:
parsing the query;
providing a logical structure based on the query; and
analyzing the logical structure, comprising:
performing one or more of the following:
A) determining that the query adversely affects performance; and
in response to a determination that the query adversely affects performance, rewriting the query to remove an “OR” clause, a tautology, or both from the query; and/or
B) determining that the query is an attack, comprising:
determining that the query includes wildcards in users' names and/or tautologies in users' names; and
in response to a determination that the query includes wildcards in the users' names and/or tautologies in the users' names, determining that the query is the attack;
in response to a determination that the query is an attack, preventing access to the data source, comprising:
terminating a connection to a client from which the query originated.