Security for debugging of database sessions

Patent metadata

Field	Value
Publication number	US-9552387-B2
Application number	US-201414315608-A
Country	US
Kind code	B2
Filing date	Jun 26, 2014
Priority date	Nov 25, 2013
Publication date	Jan 24, 2017
Grant date	Jan 24, 2017

Abstract

A system includes reception of authorization information associated with one or more database server sessions of a first user, the authorization information associating the first user, a second user, and an authorization period, establishment of a first database server session of the first user, establishment of a second database server session of the second user, reception, from the second user, of a request to debug the first database server session, determination, based on the authorization information, that the second user is authorized to debug the first database server session, and, in response to the determination, attachment of the second database server session to the first database server session, and transmission of debugging information of the first database server session to the second user.

First claim

What is claimed is:

1. A system comprising: a memory storing processor-executable process steps; and a processor to execute the processor-executable process steps to cause the system to: receive authorization information associated with one or more database server sessions of a first user, a first database server session of a first user including database server-side application program code in a programming environment, the authorization information associating the first user, a second user, and an authorization period, wherein the authorization information authorizes the second user to debug the first database server session of the first user during the authorization period per the first user, and wherein the authorization period is defined by a start time when the second user is authorized to debug the database server-side application program code and an end time after which the second user is not authorized to debug the database server-side application program code; establish the first database server session of the first user at an application server; establish a second database server session of the second user at the application server; receive, from the second user, a request to debug the first database server session; determine, based on the authorization information, that the second user is authorized to debug the first database server session; in response to the determination, attach the second database server session to the first database server session; and transmit debugging information of the first database server session to the second user;
wherein the authorization information comprises a first token, wherein the processor is further to execute the processor-executable process steps to cause the system to:
receive a request from the first user to establish the first database server session, the request comprising a second token, and
wherein determination that the second user is authorized to debug the first database server session comprises determination that the first token is identical to the second token.

2. A system according to claim 1 , wherein the processor is further to execute the processor-executable process steps to cause the system to:
store the authorization information in a database as an instance of a database object.

3. A system according to claim 1 , wherein the processor is further to execute the processor-executable process steps to cause the system to:
establish a third database server session of a third user;
receive, from the third user, a second request to debug the first database server session;
determine, based on the authorization information, that the third user is authorized to debug the first database server session, wherein the authorization information associates the first user, the third user, and a second authorization period;
in response to the determination that the third user is authorized to debug the first database server session, attach the third database server session to the first database server session; and
transmit second debugging information of the first database server session to the third user.

4. A system according to claim 3 , wherein the authorization information comprises a first token,
wherein the processor is further to execute the processor-executable process steps to cause the system to:
receive a request from the first user to establish the first database server session, the request comprising a second token,
wherein determination that the second user is authorized to debug the first database server session comprises determination that the first token is identical to the second token, and
wherein determination that the third user is authorized to debug the first database server session comprises determination that the first token is identical to the second token.

5. A system according to claim 4 , wherein the third database server session and the second database server session are attached to the first database server session during at least one common time period.

6. A system according to claim 3 , attach the third database server session to the first database server session during at least one common time period.

7. A computer-implemented method comprising:
receiving authorization information associated with one or more database server sessions of a first user, a first database server session of a first user including database server-side application program code in a programming environment, the authorization information associating the first user, a second user, an authorization period, and a first token, wherein the authorization information authorizes the second user to debug the first database server session of the first user during the authorization period per the first user, and wherein the authorization period is defined by a start time when the second user is authorized to debug the database server-side application program code and an end time after which the second user is not authorized to debug the database server-side application program code;
receive a request from the first user to establish the first database server session, the request comprising a second token,
establishing the first database server session of the first user at an application server;
establishing a second database server session of the second user at the application server;
receiving, from the second user, a request to debug the first database server session;
determining, based on the authorization information, that the second user is authorized to debug the first database server session, the determination comprising a determination that the first token is identical to the second token;
in response to the determination that the second user is authorized to debug the first database server session, attaching the second database server session to the first database server session; and
transmitting debugging information of the first database server session to the second user.

8. A computer-implemented method according to claim 7 , further comprising:
storing the authorization information in a database as an instance of a database object.

9. A computer-implemented method according to claim 7 , further comprising:
establishing a third database server session of a third user;
receiving, from the third user, a second request to debug the first database server session;
determining, based on the authorization information, that the third user is authorized to debug the first database server session, wherein the authorization information associates the first user, the third user, and a second authorization period;
in response to the determination that the third user is authorized to debug the first database server session, attaching the third database server session to the first database server session; and
transmitting second debugging information of the first database server session to the third user.

10. A computer-implemented method according to claim 9 , wherein determination that the third user is authorized to debug the first database server session comprises determination that the first token is identical to the second token.

11. A computer-implemented method according to claim 10 , wherein the third database server session and the second database server session are attached to the first database server session during at least one common time period.

12. A computer-implemented method according to claim 9 , attach the third database server session to the first database server session during at least one common time period.

13. A non-transitory computer-readable medium storing program code, the program code executable by a computer system to cause to the computer system to: re

Assignees

• Foebel Florian
• Friedmann Bjoern
• Gruschko Boris
• Mohr Christian
• Strenge Martin
• Zorn Sascha
• Sap Se

Inventors

• Foebel Florian
• Friedmann Bjoern
• Gruschko Boris
• Mohr Christian
• Strenge Martin
• Zorn Sascha

Classifications

• G06F16/951

  Indexing; Web crawling techniques · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06F16/2365 Primary

  Ensuring data consistency and integrity · CPC title

• G06F16/215

  Improving data quality; Data cleansing, e.g. de-duplication, removing invalid entries or correcting typographical errors · CPC title

• G06F16/21

  Design, administration or maintenance of databases · CPC title