System and method for application route management

Patent metadata

Field	Value
Publication number	US-10505937-B2
Application number	US-201715421734-A
Country	US
Kind code	B2
Filing date	Feb 1, 2017
Priority date	Feb 1, 2017
Publication date	Dec 10, 2019
Grant date	Dec 10, 2019

Abstract

The unauthorized access of database nodes by application nodes within an electronic computing and communications system can be prevented using an access table that stores access table records indicating that at least some of the application nodes are authorized to access at least some of the database nodes. The access table records can be generated by identifying connections between application nodes and database nodes within a configuration management database. Responsive to receiving a request to access a database node sent from a first application node, the access table can be queried to determine whether an access table record indicating that the first application node is authorized to access the database node is stored in the access table. If that access table record is not stored in the access table, the request is denied. Otherwise, the request is allowed.

First claim

What is claimed is:

1. A system for preventing unauthorized access of database nodes by application nodes within an electronic computing and communications system, the system comprising:
at least one memory configured to store one or more processor-executable routines; and
at least one processor configured to communicate with the at least one memory and to execute the routines stored therein, wherein the routines, when executed, cause the system to:
store access table records within an access table in an application server hosting the application nodes, wherein the access table records are generated based at least in part on information stored in a configuration management database (CMDB), and wherein the access table records indicate that at least some of the application nodes are authorized to access at least some of the database nodes;
receive a request to access a database node of the database nodes of a database server, wherein the request is sent from a first application node of the application nodes of the application server;
determine, in the application server, that an access table record indicating that the first application node is authorized to access the database node is not stored in the access table;
in response to determining that the access table record indicating that the first application node is authorized to access the database node is not stored in the application server, query the CMDB to determine whether an authorized connection between the first application node and the database node exists in the CMDB;
in response to the query, receive a response from the CMDB indicating that no authorized connection exists between the first application node and the database node in the CMDB;
determine that the access table record indicating that the first application node is authorized to access the database node is not stored in an updated access table based at least in part on the response from the CMDB; and
in the application server, deny the request responsive to the determination that the first application node is not authorized to access the database node.

2. The system of claim 1 , wherein a generation of a first access table record of the access table records is based at least in part on:
identification of a connection between a first configuration item and a second configuration item of the CMDB, wherein the first configuration item corresponds to a first component of the electronic computing and communications system and the second configuration item corresponds to a second component of the electronic computing and communications system; and
identification of an IP address and at least one port of each of the first component and the second component based on information associated with the first configuration item and the second configuration item, respectively, wherein the first access table record indicates the connection of the IP address and the at least one port of each of the first component and the second component.

3. The system of claim 1 , wherein the routines to receive a request to access a database node, when executed, cause the system to:
identify, based on the request, an IP address of the first application node and an IP address and a port of the database node.

4. The system of claim 3 , wherein the routines to determine that the access table record indicating that the first application node is authorized to access the database node is not stored in the access table, when executed, cause the system to:
query the access table for the access table record indicating that the IP address of the first application node is authorized to access the IP address of the database node at the port of the database node.

5. The system of claim 1 , wherein the CMDB is populated with configuration items corresponding to respective application nodes of the application nodes and to respective database nodes of the database nodes based at least in part on a discovery operation to identify connections between the respective application nodes and the respective database nodes.

6. The system of claim 1 , wherein the first application node executes application software associated with a first customer of the electronic computing and communications system and the database node is a database associated with a second customer of the electronic computing and communications system.

7. The system of claim 1 , wherein the denied first request is not sent outside of the application server.

8. The system of claim 1 , wherein the first application node has not sent a previous request, prior to the request, to access the database node.

9. The system of claim 1 , wherein a subsequent request of the first application node to access the database node is denied without querying the CMDB.

10. A method for preventing unauthorized access of database nodes by application nodes within an electronic computing and communications system, the method comprising:
storing, in an application server, an access table of access table records generated based on information stored in a configuration management database (CMDB), wherein the access table records indicate that at least some of the application nodes are authorized to access at least some of the database nodes;
receiving a request to access a database node of the database nodes, wherein the request is sent from a first application node of the application nodes;
determining that a first access table record indicating that the first application node is authorized to access the database node is not stored in the access table;
denying the request responsive to determining that first access table record indicating that the first application node is authorized to access the database node is not stored in the access table;
receiving a second request to access the database node from a second application node of the application nodes of the application server;
determining, in the application server, that a second access table record indicating that the second application node is authorized to access the database node is not stored in the access table;
in response to determining that the second access table record indicating that the second application node is authorized to access the database node is not stored in the application server, querying the CMDB to determine whether an authorized connection between the second application node and the database node exists in the CMDB;
in response to the querying, receiving a response from the CMDB indicating that the authorized connection between the second application node and the database node exists in the CMDB;
updating the access table, based on the response from the CMDB, to indicate that the second application node is authorized to access the database node; and
determining that the second access table record indicating that the second application node is authorized to access the database node is stored in the updated access table; and
allowing the second request in response to determining that the second access table record indicating that the second application node is authorized to access the database node is stored in the updated access table.

11. The method of claim 10 , wherein the access table records are based at least in part on:
an identified connection between a first configuration item and a second configuration item of the CMDB, wherein the first configuration item corresponds to a first component of the electronic computing and communications system and the second configuration item corresponds to a second component of the electronic computing and communications system; and
a respective identified IP address and at least one respective port of each of the first component and the se

Assignees

• Servicenow Inc

Inventors

• Norris Jeremy
• Chan Antony
• Shah Siddharth

Classifications

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/101 Primary

  Access control lists [ACL] · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• G06F21/6227

  where protection concerns the structure of data, e.g. records, types, queries · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title