A database command line filtering and blocking audit method and device

Abstract

The present invention provides a database command line filtering and audit blocking method and device. The method and device comprise: an audit engine is configured to send database operation events to a special structured query language (SQL) statement parse module; the SQL statement operation of the database events is subjected to real-time capture, identification and classification; the key information data packet of the SQL statement is sent to a detection module; the detection module is configured to compare the key information data packet of the SQL statement pre-defined blocking strategy in an audit strategy generation module; illegal key information and legal key information in the key information data packet of the SQL statement are detected; the illegal key information is sent to the data packet modification module for modification, and the legal key information is sent to a forwarding module for forwarding; and the illegal key information is modified to legal key information and then is sent to the data packet forwarding module for forwarding. The database command line filtering and audit blocking method and device are able to ensure the blocking of a special SQL statement and cannot disconnect the whole link.

Description

technical field [0001] The invention relates to a database firewall service in the technical field of information security, in particular to a database command line filtering and blocking audit method and device. Background technique [0002] Existing border defense security products and solutions all adopt passive defense technology, which cannot fundamentally solve the security threats and risks faced by the database data of various organizations. Solving database data security requires dedicated database security equipment to fundamentally solve data security problems. As a result, the database firewall, a database security active defense technology, emerged as the times require. The system is deployed between the application server and the database, and users must pass through the system to access or manage the database. The active defense technology adopted by the database firewall can proactively monitor, identify, alarm, and block external data attacks that bypass the...

AI Technical Summary

Problems solved by technology

The patent (publication number: CN103778185A) "A SQL statement parsing method and system for database auditing system" provides an audit based on the key information in the SQL statement, but does not include resource accounts in sessions, client hosts, database Name and other important information, and failed to block illegal operations

In addition, in some existing database audit methods, dangerous SQL statements are blocked, but the session is closed, so that other legal SQL statements of the user cannot be executed. A database audit method that blocks operations without interrupting session connections

Images