Database security management and control system based on storage encryption

Abstract

The invention discloses a database security management and control system based on storage encryption, which relates to the technical field of storage encryption and comprises a user access control module, an authority management module, a data encryption module, a data decryption module, a key access control module and a backup recovery module. The user access control module is responsible for verifying a user identity; through the data encryption module and the key access control module, in combination with an asymmetric encryption technology, sensitive data in a database are ensured to be always in an encrypted state in a storage process, the sensitive data are encrypted by adopting an RSA algorithm, and the data cannot be read even if being stolen in the storage process, so that the security of the data is ensured. According to the method, the system periodically turns keys and high-strength management of the keys, the keys are prevented from being leaked or abused, data are effectively protected from being accessed by unauthorized users, and the life cycle management of the keys, including generation, use, rotation and destruction operations, is performed through an AWSKMS tool, so that high-strength protection of the keys is ensured.

Description

Technical Field

[0001] The present invention relates to the field of storage encryption technology, and in particular to a database security management and control system based on storage encryption. Background Art

[0002] In the financial, medical, government and other industries, the leakage and abuse of sensitive data may lead to serious legal, economic and reputational losses. In order to meet these challenges, database security control has become the core part of information security management. Existing database security protection measures mainly focus on access control, data encryption, audit logs and other aspects. Traditional encryption methods often focus on encryption protection during transmission, and pay less attention to encryption and control during the data storage stage. To address this problem, a database security control system based on storage encryption has emerged. The core concept of this system is to encrypt the stored data to ensure that even if the data is accessed or stolen by unauthorized personnel; Although existing encryption technologies are used to protect sensitive data in storage, they rely on traditional symmetric encryption or simple access control mechanisms, which makes the system vulnerable to security risks when facing advanced persistent threats; In view of the above technical defects, a solution is now proposed. Summary of the invention

[0003] In view of the deficiencies of the prior art, the present invention provides a database security management and control system based on storage encryption.

[0004] To achieve the above objectives, the present invention is implemented through the following technical solutions: a database security management and control system based on storage encryption, including a user access control module, a permission management module, a data encryption module, a data decryption module, a key access control module and a backup and recovery module; The user access control module is responsible for verifying the user's identity. The user logs in with an account and password, and the user's identity is verified according to the preset identity authentication rules. After the authentication is passed, the module assigns different pages according to the user's role; The permission management module is responsible for assigning database access rights to different users based on business needs. The module supports dynamic adjustment of permissions and limits user access rights through fine-grained permission control. The data encryption module is responsible for encrypting and protecting sensitive data. The module uses the OpenSSL encryption library to generate a pair of asymmetric keys, including a public key and a private key. The public key is used to encrypt data, and the private key is authorized to specific personnel and stored in the key access control module. The data decryption module is responsible for calling the private key to decrypt when the encrypted file needs to be read, and restoring the encrypted data to the original data format. The module uses the private key to decrypt the ciphertext and restores the plaintext data through the decryption formula; The key access control module manages keys through the AWS KMS tool. The module provides advanced encryption protection for key storage and has strong identity authentication and permission management functions. It manages key access permissions through roles and access control lists and rotates keys regularly according to preset cycles. The backup and recovery module performs database backup operations regularly according to the preset time and provides backup and recovery functions. The module uses QuartzScheduler for task scheduling and supports user-defined backup time.

[0005] The user access control module is responsible for verifying the user's identity. The user logs in with an account and password and is verified according to the preset identity authentication rules. After the authentication is passed, different pages are assigned according to different user roles. The user's identity information and permissions will be retrieved during the authentication process, and different users will be assigned operating functions that match their role permissions.

[0006] The permission management module is responsible for assigning different user permissions to different users, and supports dynamic adjustment of permissions based on business needs. Through fine-grained permission control, users can only access data and functions related to their responsibilities. Further refinement of access control sets access permissions for a column in a specific table based on different data categories and user positions. Use ACL to set different operating permissions for different users. Permission allocation includes reading, modifying, and deleting different operating permissions. At the same time, it monitors and records user access to system resources. When a user no longer needs to access certain resources, his permissions are revoked. The permissions of users who have left the company are revoked and a log of permission recovery is generated.

[0007] The data encryption module is responsible for encrypting the files by category, and uses the encryption library OpenSSL to generate asymmetric keys including public keys and private keys. The public key is used to encrypt data and distribute it publicly, and the private key is used to decrypt data. The private key is authorized to designated personnel and is stored in the key management and control module. The data encryption module first classifies the data, identifies the sensitive data that needs to be encrypted, and determines whether the file is a sensitive file based on the file's access rights. Files accessed by specific management roles will be classified as sensitive files and encrypted. The data to be encrypted will be divided into multiple data blocks, and the maximum size of each data block is 265 bytes.

[0008] The data encryption module is encrypted by the public key of RSA. During the RSA encryption process, the data block is first padded with the OAEP padding scheme until the length of the encrypted data is consistent with the length of the key, and then each data block is encrypted using the public key. The encryption formula is:

[0009] Among them, C is the ciphertext, M is the original plaintext data block, e is the encryption exponent of the public key, and n is the modulus of the public key, which is determined when the key is generated; each data block is converted into ciphertext after encryption, and the output generated by the encryption algorithm is of fixed length. The encrypted data block is stored in the database together with the corresponding file metadata file name and encryption time. An encryption mark is added to each encrypted file to indicate that the file has been encrypted.

[0010] When the data decryption module needs to read the encrypted file, it calls the private key to decrypt the ciphertext and restores the encrypted data to the original data format. The decryption formula is:

[0011] Among them, C is the ciphertext, M is the decrypted plaintext, d is the decryption exponent of the private key, n is the modulus of the key, and the decrypted data is the original data, which users can access as needed.

[0012] The key access control module manages the keys through the AWS KMS tool, and the stored keys are protected by advanced encryption algorithms. The key access control module has strong identity authentication and permission management functions, and access permissions are managed based on roles and access control lists. Keys are rotated according to the preset rotation cycle, and all key configurations in the encryption system are updated after new keys are generated. The key data of the old keys are erased through multiple algorithms, and detailed logs of key operations are recorded in real time, including key generation, use, rotation and destruction activities. The logs include the timestamp of the operation, the operator, and the content of the operation. It supports the sharing and integration of keys in a multi-system environment, and is integrated with external systems or third-party key management platforms through encrypted channels and the standardized protocol JCE.

[0013] The backup and recovery module backs up the database according to the preset time, performs task scheduling through QuartzScheduler, supports user-defined backup time, and the specific backup time is configured through Cron expression. It supports incremental backup function and is used in combination with the rsync tool and incremental backup strategy to compare the modification time and content of the file to select the part that needs to be backed up. When restoring data, different recovery operations are performed according to specific recovery requirements. It supports full recovery and incremental recovery. When restoring the full data, the backup data is completely restored to the target database. When restoring the incremental data, only the changed data since the last backup is restored. The module also continuously records detailed logs of each backup and recovery operation, including the operator, operation time, operation content and operation results.

[0014] The present invention provides a database security management and control system based on storage encryption. Compared with the prior art, it has the following beneficial effects: The present invention uses a data encryption module and a key access control module, combined with asymmetric encryption technology, to ensure that sensitive data in the database is always encrypted during storage. Sensitive data is encrypted using the RSA algorithm to ensure that even if the data is stolen during storage, it cannot be interpreted. The system regularly rotates keys and manages keys with high intensity to prevent key leakage or abuse, effectively protecting data from unauthorized users. The AWS KMS tool is used to manage the life cycle of keys, including generation, use, rotation, and destruction operations, thereby ensuring high-intensity protection of keys. The present invention authorizes designated users to access data and functions related to their duties through a user access control module and a permission management module, and the administrator dynamically adjusts the user's access rights, including access control down to the level of a specific data table or table column, and strictly manages permissions based on user roles, identity authentication, and access control lists. Combined with fine-grained permission control, it ensures that the system can flexibly manage user access rights while protecting the security of sensitive data, effectively improving the security and operational efficiency of the database. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a schematic diagram of the principle framework of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] See also Figure 1 , the present application provides a database security management and control system based on storage encryption, including a user access control module, a permission management module, a data encryption module, a data decryption module, a key access control module and a backup and recovery module; The user access control module is responsible for verifying the user's identity. The user logs in with an account and password, and the user's identity is verified according to the preset identity authentication rules. After the authentication is passed, the module assigns different pages according to the user's role; The permission management module is responsible for assigning database access rights to different users based on business needs. The module supports dynamic adjustment of permissions and limits user access rights through fine-grained permission control. The data encryption module is responsible for encrypting and protecting sensitive data. The module uses the OpenSSL encryption library to generate a pair of asymmetric keys, including a public key and a private key. The public key is used to encrypt data, and the private key is authorized to specific personnel and stored in the key access control module. The data decryption module is responsible for calling the private key to decrypt when the encrypted file needs to be read, and restoring the encrypted data to the original data format. The module uses the private key to decrypt the ciphertext and restores the plaintext data through the decryption formula; The key access control module manages keys through the AWS KMS tool. The module provides advanced encryption protection for key storage and has strong identity authentication and permission management functions. It manages key access permissions through roles and access control lists and rotates keys regularly according to preset cycles. The backup and recovery module performs database backup operations regularly according to the preset time and provides backup and recovery functions. The module uses QuartzScheduler for task scheduling and supports user-defined backup time.

[0018] The user access control module is responsible for verifying the user's identity. The user logs in with an account and password and is verified according to the preset identity authentication rules. After the authentication is passed, different pages are assigned according to different user roles. The user's identity information and permissions will be retrieved during the authentication process, and different users will be assigned operation functions that match their role permissions. Specifically, the user provides an account and password when logging in, and the authentication process will perform detailed verification according to the preset identity authentication rules. These rules may include password strength requirements, account locking mechanisms, and multi-factor authentication. After the authentication is passed, pages suitable for the user's responsibilities will be further assigned according to the user's role and position.

[0019] The permission management module is responsible for assigning different user permissions to different users, and supports dynamic adjustment of permissions based on business needs. Through fine-grained permission control, users can only access data and functions related to their responsibilities. Further refinement of access control sets access permissions for a column in a specific table based on different data categories and user positions. Use ACL to set different operating permissions for different users. Permission allocation includes reading, modifying, and deleting different operating permissions. At the same time, it monitors and records user access to system resources. When a user no longer needs to access certain resources, his permissions are revoked. The permissions of users who have left the company are revoked and a log of permission recovery is generated.

[0020] The data encryption module is responsible for encrypting the files by category, and uses the encryption library OpenSSL to generate asymmetric keys including public keys and private keys. The public key is used to encrypt data and distribute it publicly, and the private key is used to decrypt data. The private key is authorized to designated personnel and is stored in the key management and control module. The data encryption module first classifies the data, identifies the sensitive data that needs to be encrypted, and determines whether the file is a sensitive file based on the file's access rights. Files accessed by specific management roles will be classified as sensitive files and encrypted. The data to be encrypted will be divided into multiple data blocks, and the maximum size of each data block is 265 bytes.

[0021] The data encryption module is encrypted by the public key of RSA. During the RSA encryption process, the data block is first padded with the OAEP padding scheme until the length of the encrypted data is consistent with the length of the key, and then each data block is encrypted using the public key. The encryption formula is:

[0022] Among them, C is the ciphertext, M is the original plaintext data block, e is the encryption exponent of the public key, and n is the modulus of the public key, which is determined when the key is generated; each data block is converted into ciphertext after encryption, and the output generated by the encryption algorithm is of fixed length. The encrypted data block is stored in the database together with the corresponding file metadata file name and encryption time. An encryption mark is added to each encrypted file to indicate that the file has been encrypted.

[0023] Specifically, during the OAEP padding process, the original data will first be randomly filled with a padding seed, which is a randomly generated string, and then the data will be further obfuscated through the hash function SHA-256 to ensure the integrity of the data and prevent any predictive or pattern analysis of the data during the encryption process. The length of the data block after OAEP padding will be extended to the length of the key, so that each data block can fully match the key length requirement during the encryption process, increasing the security of the encryption process.

[0024] When the data decryption module needs to read the encrypted file, it calls the private key to decrypt the ciphertext and restores the encrypted data to the original data format. The decryption formula is:

[0025] Among them, C is the ciphertext, M is the decrypted plaintext, d is the decryption exponent of the private key, n is the modulus of the key, and the decrypted data is the original data, which users can access as needed.

[0026] The key access control module manages the keys through the AWS KMS tool, and the stored keys are protected by advanced encryption algorithms. The key access control module has strong identity authentication and permission management functions, and access permissions are managed based on roles and access control lists. Keys are rotated according to the preset rotation cycle, and all key configurations in the encryption system are updated after new keys are generated. The key data of the old keys are erased through multiple algorithms, and detailed logs of key operations are recorded in real time, including key generation, use, rotation and destruction activities. The logs include the timestamp of the operation, the operator, and the content of the operation. It supports the sharing and integration of keys in a multi-system environment, and is integrated with external systems or third-party key management platforms through encrypted channels and the standardized protocol JCE.

[0027] The backup and recovery module backs up the database according to the preset time, performs task scheduling through QuartzScheduler, supports user-defined backup time, and the specific backup time is configured through Cron expression. It supports incremental backup function and is used in combination with the rsync tool and incremental backup strategy to compare the modification time and content of the file to select the part that needs to be backed up. When restoring data, different recovery operations are performed according to specific recovery requirements. It supports full recovery and incremental recovery. When restoring the full data, the backup data is completely restored to the target database. When restoring the incremental data, only the changed data since the last backup is restored. The module also continuously records detailed logs of each backup and recovery operation, including the operator, operation time, operation content and operation results.

[0028] During full recovery, the system will completely restore all backup data to the target database to ensure that the database is restored to its complete state at the time of backup. During incremental recovery, the system will only restore the changed data since the last backup, thereby reducing recovery time and system burden. Incremental recovery is particularly suitable for scenarios where a small amount of changed data needs to be quickly restored, ensuring high availability and rapid recovery capabilities of the database.

[0029] Specific workflow: The user first authenticates by entering the account number and password, and verifies the user's identity according to the preset authentication rules. After the authentication is passed, different operation pages are assigned according to the user's role. The permission management module assigns database access rights to each user according to the user role and business needs. The administrator can dynamically adjust the permissions according to actual needs, continuously monitor the user's operations and record the user's access to system resources. When the user no longer needs to access certain resources, the system will revoke their permissions, revoke the operation permissions for the resigned employees, and generate a recovery log. The data encryption module classifies the files in the database and identifies the sensitive files that need to be encrypted. The data encryption module generates a pair of asymmetric keys, uses the RSA encryption algorithm to fill the data block with OAEP, and then uses the public key to encrypt each data block. The encrypted data block is stored in the database together with the file's metadata, file name, and encryption time, and the file is marked as encrypted. When the user needs to access the encrypted data, first confirm his permissions through the permission management module, and then obtain the key according to the permissions, and transfer the key to the data decryption module. The encrypted data is restored to the original data format for user access using the RSA decryption formula. The key access control module uses AWS The KMS tool manages keys, authorizes users to access keys based on the key access control list, rotates keys regularly according to preset cycles and generates new key configurations, erases old keys using multiple algorithms, and the backup and recovery module performs database backup operations according to preset times. When restoring data, the system performs different recovery operations based on demand.

[0030] Furthermore, the present invention uses a data encryption module and a key access control module in combination with asymmetric encryption technology to ensure that sensitive data in the database is always encrypted during storage. Sensitive data is encrypted using the RSA algorithm to ensure that the data cannot be deciphered even if it is stolen during storage. The system regularly rotates keys and manages keys with high intensity to prevent key leakage or abuse, effectively protecting data from unauthorized access. The AWS KMS tool is used to manage the lifecycle of keys, including generation, use, rotation, and destruction operations, thereby ensuring high-intensity protection of keys.

[0031] Furthermore, the present invention authorizes designated users to access data and functions related to their duties through the user access control module and the permission management module, and the administrator dynamically adjusts the user's access rights, including access control down to the level of specific data tables or table columns, and strictly manages permissions based on user roles, identity authentication, and access control lists. Combined with fine-grained permission control, it ensures that the system can flexibly manage user access rights while protecting the security of sensitive data, effectively improving the security and operational efficiency of the database.

[0032] Some of the data in the above formulas are numerically calculated by removing their dimensions. Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

[0033] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A database security management and control system based on storage encryption, characterized in that: include: User access control module, authority management module, data encryption module, data decryption module, key access control module and backup and recovery module; The user access control module is responsible for verifying the user's identity. The user logs in with an account and password, and the user's identity is verified according to the preset identity authentication rules. After the authentication is passed, the module assigns different pages according to the user's role; The permission management module is responsible for assigning database access rights to different users based on business needs. The module supports dynamic adjustment of permissions and limits user access rights through fine-grained permission control. The data encryption module is responsible for encrypting and protecting sensitive data. The module uses the OpenSSL encryption library to generate a pair of asymmetric keys, including a public key and a private key. The public key is used to encrypt data, and the private key is authorized to specific personnel and stored in the key access control module. The data decryption module is responsible for calling the private key to decrypt when the encrypted file needs to be read, and restoring the encrypted data to the original data format. The module uses the private key to decrypt the ciphertext and restores the plaintext data through the decryption formula; The key access control module manages keys through the AWS KMS tool. The module provides advanced encryption protection for key storage and has strong identity authentication and permission management functions. It manages key access permissions through roles and access control lists and rotates keys regularly according to preset cycles. The backup and recovery module performs database backup operations regularly according to the preset time and provides backup and recovery functions. The module uses QuartzScheduler for task scheduling and supports user-defined backup time.

2. The database security management and control system based on storage encryption according to claim 1 is characterized in that: The user access control module is responsible for verifying the user's identity. The user logs in with an account and password and is verified according to the preset identity authentication rules. After the authentication is passed, different pages are assigned according to different user roles. The user's identity information and permissions will be retrieved during the authentication process, and different users will be assigned operating functions that match their role permissions.

3. The database security management and control system based on storage encryption according to claim 1 is characterized in that: The permission management module is responsible for assigning different user permissions to different users, and supports dynamic adjustment of permissions based on business needs. Through fine-grained permission control, users can only access data and functions related to their responsibilities. Further refinement of access control sets access permissions for a column in a specific table based on different data categories and user positions. Use ACL to set different operating permissions for different users. Permission allocation includes reading, modifying, and deleting different operating permissions. At the same time, it monitors and records user access to system resources. When a user no longer needs to access certain resources, his permissions are revoked. The permissions of users who have left the company are revoked and a log of permission recovery is generated.

4. The database security management and control system based on storage encryption according to claim 1 is characterized in that: The data encryption module is responsible for encrypting the files by category, and uses the encryption library OpenSSL to generate asymmetric keys including public keys and private keys. The public key is used to encrypt data and distribute it publicly, and the private key is used to decrypt data. The private key is authorized to designated personnel and is stored in the key management and control module. The data encryption module first classifies the data, identifies the sensitive data that needs to be encrypted, and determines whether the file is a sensitive file based on the file's access rights. Files accessed by specific management roles will be classified as sensitive files and encrypted. The data to be encrypted will be divided into multiple data blocks, and the maximum size of each data block is 265 bytes.

5. The database security management and control system based on storage encryption according to claim 1 is characterized in that: The data encryption module is encrypted by the public key of RSA. During the RSA encryption process, the data block is first padded with the OAEP padding scheme until the length of the encrypted data is consistent with the length of the key, and then each data block is encrypted using the public key. The encryption formula is: Among them, C is the ciphertext, M is the original plaintext data block, e is the encryption exponent of the public key, and n is the modulus of the public key, which is determined when the key is generated; each data block is converted into ciphertext after encryption, and the output generated by the encryption algorithm is of fixed length. The encrypted data block is stored in the database together with the corresponding file metadata file name and encryption time. An encryption mark is added to each encrypted file to indicate that the file has been encrypted.

6. The database security management and control system based on storage encryption according to claim 1 is characterized in that: When the data decryption module needs to read the encrypted file, it calls the private key to decrypt the ciphertext and restores the encrypted data to the original data format. The decryption formula is: Among them, C is the ciphertext, M is the decrypted plaintext, d is the decryption exponent of the private key, n is the modulus of the key, and the decrypted data is the original data, which users can access as needed.

7. The database security management and control system based on storage encryption according to claim 1 is characterized in that: The key access control module manages the keys through the AWS KMS tool, and the stored keys are protected by advanced encryption algorithms. The key access control module has strong identity authentication and permission management functions, and access permissions are managed based on roles and access control lists. Keys are rotated according to the preset rotation cycle, and all key configurations in the encryption system are updated after new keys are generated. The key data of the old keys are erased through multiple algorithms, and detailed logs of key operations are recorded in real time, including key generation, use, rotation and destruction activities. The logs include the timestamp of the operation, the operator, and the content of the operation. It supports the sharing and integration of keys in a multi-system environment, and is integrated with external systems or third-party key management platforms through encrypted channels and the standardized protocol JCE.

8. The database security management and control system based on storage encryption according to claim 1 is characterized in that: The backup and recovery module backs up the database according to the preset time, performs task scheduling through QuartzScheduler, supports user-defined backup time, and the specific backup time is configured through Cron expression. It supports incremental backup function and is used in combination with the rsync tool and incremental backup strategy to compare the modification time and content of the file to select the part that needs to be backed up. When restoring data, different recovery operations are performed according to specific recovery requirements. It supports full recovery and incremental recovery. When restoring the full data, the backup data is completely restored to the target database. When restoring the incremental data, only the changed data since the last backup is restored. The module also continuously records detailed logs of each backup and recovery operation, including the operator, operation time, operation content and operation results.

Images