A database encryption protection method of a safe operation and maintenance audit system

Abstract

The application relates to the technical field of database encryption, in particular to a database encryption protection method of a safe operation and maintenance audit system. The method comprises the following steps: for a data table in a database, extracting table structure metadata of the data table, including attributes and corresponding data types and foreign key constraint information; executing different correlation analysis strategies through the combination form of data types of any two attributes to obtain the correlation degree of any two attributes; extracting SQL statements of the data table from operation logs of the database to determine the instruction frequent weight of any two attributes and obtain the grouping priority of any two attributes; dividing all the attributes into multiple encrypted attribute groups; and selecting different strength encryption strategies for the encrypted attribute groups according to the proportion of attributes containing foreign key constraint information in the encrypted attribute groups to perform encryption protection. The application can ensure the safety of relational data while significantly reducing the decryption delay of multi-table association query.

Description

Technical Field

[0001] This application relates to the field of database encryption technology, specifically to a database encryption protection method for a security operation and maintenance audit system. Background Technology

[0002] As enterprises deepen their digital transformation, security operations and auditing systems have become a critical infrastructure for ensuring the security of core IT assets. These systems continuously collect and store massive amounts of identity information, asset data, session logs, and operation instructions, building a relational database containing a large amount of sensitive information.

[0003] Traditional database encryption schemes primarily employ a uniform encryption strategy for all attributes across the entire data table, neglecting the complex business logic and data relationships between attributes. This results in related attributes being encrypted in a fragmented manner. Attackers can then use the relationships between attributes to perform reasoning attacks by collecting some plaintext information or large amounts of ciphertext information, rendering the encryption protection ineffective. Furthermore, they fail to detect the high-frequency co-occurrence patterns of certain attributes in database access operations, making it difficult to prevent access pattern-based attacks and thus limiting the effectiveness of database encryption. Secondly, foreign key attributes are prevalent in databases and frequently participate in query operations. This necessitates encryption and decryption operations for all queries involving foreign keys in complex query scenarios, severely impacting database performance and response efficiency. Summary of the Invention

[0004] To address the aforementioned technical issues, a database encryption protection method for a security operation and maintenance audit system is provided to resolve existing problems.

[0005] The solution to the technical problem in this application is to provide a database encryption protection method for a security operation and maintenance audit system, including the following steps:

[0006] For a data table in a database, extract its table structure metadata, including attributes, their corresponding data types, and foreign key constraint information;

[0007] By combining the data types of any two attributes, different association analysis strategies are executed to evaluate the association between the two attributes at the value level in the data table, and the degree of association between any two attributes is obtained.

[0008] Extract the SQL statements of the data tables from the database operation log, analyze the co-occurrence frequency of two attributes in the statements at the operation level, determine the instruction frequency weight of any two attributes, and combine the correlation to obtain the grouping priority of any two attributes.

[0009] A weighted undirected graph is constructed using attributes in the data table as nodes and grouping priority as the edge weight between nodes. The graph is then clustered to divide all attributes into multiple encrypted attribute groups. Based on the proportion of attributes containing foreign key constraint information in the encrypted attribute groups, different encryption strategies with different strengths are selected for encryption protection.

[0010] Preferably, obtaining the correlation degree between any two attributes includes: if the two attributes are numeric and character respectively, then a first correlation analysis strategy is executed to calculate the correlation degree; if the two attributes are both character, then a second correlation analysis strategy is executed to calculate the correlation degree; if the two attributes are both numeric, then a third correlation analysis strategy is executed to calculate the correlation degree.

[0011] Preferably, the first association analysis strategy is as follows: when the two attributes are a numeric attribute and a character attribute, the records in which the character attribute has the same value in all records are grouped into record classes; the dispersion of the value of all records in each record class under the numeric attribute is calculated; the sum of the dispersion of the numeric attribute under all record classes is calculated and negatively mapped to it as the association degree between the numeric attribute and the character attribute.

[0012] Preferably, the second association analysis strategy includes:

[0013] When both attributes are character type attributes, match all record classes of the two character type attributes to obtain all matching pairs; count the total number of records contained in the record class corresponding to each character type attribute in the matching pair; for each record class corresponding to each character type attribute in the matching pair, count the number of records whose values ​​under the other character type attribute are equal to the value of the record class of the other character type attribute in the matching pair under that attribute, and use this as the same number of records for each character type attribute in the matching pair; the difference between the total number of records and the same number is used as the different number, and the ratio of the same number to the different number is recorded as the relative comparison.

[0014] The correlation between any two character attributes is positively correlated with their relative comparison.

[0015] Preferably, the process of obtaining the matching pair is as follows:

[0016] For the two character type properties, let them be denoted as follows: and , attributes All record classes constitute a record set ,in ; attributes All record classes constitute a record set ,in ;

[0017] from and Among all record classes, select the record class containing the most records as the target class. ;like Then the statistical target class All records within the attribute The values ​​listed below will be the most frequently occurring values. The corresponding record class within is used as the target class. Matching class; if Then the statistical target class All records within the attribute The values ​​listed below will be the most frequently occurring values. The corresponding record class within is used as the target class. Matching class;

[0018] and target class The matching class is defined as a matching pair; in the remaining unmatched record classes, the above steps are repeated until all record classes are matched to obtain all matching pairs.

[0019] Preferably, the third association analysis strategy includes: when both attributes are numeric, clustering the values ​​of all records in the data table under each numeric attribute, and replacing all values ​​in the same cluster with the same character code, thereby converting the two numeric attributes into two character attributes, and then executing the second association analysis strategy to calculate the association degree between any two numeric attributes.

[0020] Preferably, determining the instruction frequency weight for any two attributes includes:

[0021] Iterate through each SQL statement and take the set of attributes that the execution process accesses in the data table as a transaction of the data mining algorithm; define each attribute in the data table as an item, and take the set of all items as the itemset of the data mining algorithm; combine the transactions corresponding to all SQL statements into a transaction set and input it into the data mining algorithm; mine the transaction set based on the itemset to obtain the frequent itemsets that meet the preset minimum support and their support, and extract the frequent 1-itemsets from the frequent itemsets;

[0022] For any two attributes, select frequent itemsets that simultaneously contain both attributes from all frequent itemsets to form an association set; the difference between the support of each frequent itemset in the association set and the preset minimum support is taken as the relative difference.

[0023] The frequency weight of the instructions is positively correlated with the relative difference.

[0024] Preferably, obtaining the grouping priority of any two attributes includes: for any two attributes, if they both belong to frequent 1-itemsets, then the grouping priority of the two attributes is... The calculation process is as follows: Conversely, the grouping priority of any two attributes is the degree of association; where, For attributes and attributes The degree of correlation between them For attributes and attributes Normalized instruction frequency weights.

[0025] Preferably, the step of selecting encryption strategies of different strengths for encryption protection of the encrypted attribute groups includes: calculating the ratio of the number of attributes with foreign key constraints in the data table to the total number of attributes in the data table, as a constraint threshold; calculating the ratio between the number of attributes with foreign key constraints in each encrypted attribute group and the total number of attributes contained in the encrypted attribute group, as a constraint ratio; and assigning an encryption algorithm with corresponding encryption strength to each encrypted attribute group for encryption based on the comparison result of the constraint ratio and the constraint threshold.

[0026] Preferably, the step of assigning a corresponding encryption strength to each encryption attribute group and encrypting it includes: if the constraint ratio of each encryption attribute group is equal to 0, then the plaintext data of the attribute in the data table within the encryption attribute group is encrypted using a first encryption algorithm; if the constraint ratio of each encryption attribute group is greater than 0 and less than or equal to the constraint threshold, then the plaintext data of the attribute in the data table within the encryption attribute group is encrypted using a second encryption algorithm; if the constraint ratio of each encryption attribute group is greater than the constraint threshold, then the plaintext data of the attribute in the data table within the encryption attribute group is encrypted using a third encryption algorithm, wherein the encryption strength of the first encryption algorithm is less than the encryption strength of the second encryption algorithm, which is less than the encryption strength of the third encryption algorithm.

[0027] This application has at least the following beneficial effects:

[0028] This application calculates the correlation between any two attributes by using the data types corresponding to those attributes. Its advantages include: analyzing the correlation of attribute combinations across different data types; achieving precise quantification of static business relationships between attributes across data types; and comprehensively revealing the inherent relationships between attributes at the data level. It also determines the instruction frequency weight of any two attributes, which, by mining attributes in SQL statements, accurately captures dynamic access habits of the business, reflecting the frequent patterns of attribute co-occurrence in dynamic SQL statement instructions. This identifies frequently co-occurring attributes, ensuring that these operationally correlated attributes can be uniformly encrypted, effectively masking their access patterns and preventing side-channel analysis attacks based on access patterns. This reduces the risk of access pattern leakage while decreasing the number of decryption operations required for the data table, thus significantly reducing decryption computation overhead and optimizing database query performance. Finally, it obtains the grouping priority of any two attributes, which has the following advantages: By comprehensively assessing the static correlation characteristics between attributes at the value level and the dynamic correlation characteristics at the operational level, the association between two attributes is evaluated, forming a more comprehensive basis for grouping decisions. A weighted undirected graph is constructed and clustered to divide all attributes into multiple encrypted attribute groups. The beneficial effect is that, through spectral clustering, the attributes represented by nodes with high data correlation and operational co-occurrence characteristics can be grouped together. Based on the proportion of attributes containing foreign key constraint information in the encrypted attribute group, different encryption strategies with different strengths are selected for encryption protection. The beneficial effect is that, through the foreign key constraints existing in the attributes within the encrypted attribute group, the encryption strength of the encryption algorithm is dynamically adjusted, enabling differentiated encryption protection for encrypted attribute groups with different sensitivities. This solves the drawback of using a uniform encryption strategy for attributes with different sensitivities and access frequencies. While ensuring the security of relational data, it significantly reduces the decryption latency of multi-table join queries and improves the response efficiency of complex business scenarios. Attached Figure Description

[0029] The following section provides a more detailed description of a database encryption protection method for a security operation and maintenance audit system according to this application, with reference to the accompanying drawings.

[0030] Figure 1 A flowchart illustrating the steps of a database encryption protection method for a security operation and maintenance audit system provided in this application embodiment;

[0031] Figure 2 A flowchart illustrating the steps of a method for obtaining the instruction frequency weights of any two attributes provided in an embodiment of this application. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description, in conjunction with the accompanying drawings and implementation examples, provides a further detailed explanation of the database encryption protection method for a security operation and maintenance audit system proposed in this application. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit the scope of this application.

[0033] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0034] Please see Figure 1 The diagram illustrates a flowchart of a database encryption protection method for a security operation and maintenance audit system according to an embodiment of this application. The method includes the following steps:

[0035] Step 1: For the data tables in the database, extract their table structure metadata, including attributes, their corresponding data types, and foreign key constraint information.

[0036] A security operations and maintenance audit system, also known as a bastion host, protects IT systems from intrusion and damage by internal and external users. It enables users to monitor the entire operation and maintenance process of network devices, servers, and business systems, recording operational activities. Access control ensures that operations and maintenance personnel can only manage specific resources and cannot intrude into or damage other systems. However, its core database, as the storage medium for massive amounts of sensitive audit data, is vulnerable to breaches. A leak could lead to privacy violations and the leakage of trade secrets, and attackers could use it for correlation analysis to reverse engineer weaknesses in the entire operations and maintenance environment, triggering a chain reaction of security risks. Therefore, database encryption is necessary.

[0037] Secondly, security operation and maintenance auditing systems typically use relational databases to store and manage data, supporting powerful table query and analysis to generate statistical reports across various dimensions. As a highly structured data warehouse, a relational database stores several different types of tables, such as identity information tables, asset and resource tables, session log tables, and operation instruction tables. Data is stored in the tables in the form of rows (records) and columns (attributes). Each table has a fixed schema, defining table names, column names (attributes), data types, primary keys, foreign keys, indexes, and constraints. Data can be retrieved by executing SQL statements, and different tables are linked through relationships to form a complete relational database.

[0038] Specifically, the identity information table is a data table that stores the identity information of users or administrators with different permissions being audited; the asset resource table is a data table that records the managed assets such as enterprise servers, network devices, databases, and application systems; the session log table is a data table that records the start and end times, source IP addresses, protocols, and clients of each user or administrator login and operation session; and the operation instruction table is a data table that records the commands or operations executed by users or administrators in the session.

[0039] It should be noted that in an identity information table, each row contains information about all the attributes of a user, and each column (attribute) contains information about all users for the same attribute. Each row represents a record.

[0040] Therefore, for any data table in the relational database of the security operation and maintenance audit system, extract its table structure metadata, including attributes and their corresponding data types and foreign key constraint information; and read all records stored in the data table.

[0041] It should be noted that each attribute corresponds to only one data type, which may be numeric or character.

[0042] At this point, we have obtained the data table structure metadata and all the records stored therein.

[0043] Step 2: By combining the data types of any two attributes, different association analysis strategies are executed to evaluate the association between the two attributes at the value level in the data table, and the degree of association between any two attributes is obtained.

[0044] In database design, attributes within the same data table often have business logic constraints, and the values ​​of different attributes are highly likely to exhibit strong dependency relationships. For example, in an asset resource table that records managed assets such as enterprise servers, network devices, databases, and application systems, attributes like the device type and model of network devices are directly associated with attributes like manufacturer, uplink traffic, and downlink traffic. Furthermore, due to the different data types corresponding to attributes, the correlation analysis between any two attributes can be categorized into three types: numeric attributes with numeric attributes, numeric attributes with character attributes, and character attributes with character attributes. These analyses assess the dependency relationships between any two attributes and calculate the degree of correlation between them.

[0045] If any two attributes are numeric and character respectively, then the first association analysis strategy is executed to calculate the association degree;

[0046] If any two attributes are of type character, then the second association analysis strategy is executed to calculate the association degree;

[0047] If any two of the attributes are numerical, then the third association analysis strategy is executed to calculate the degree of association;

[0048] First, for any two attributes, their data types are numeric and character, respectively. Numeric attributes have continuous and computable values, while character attributes have discrete values ​​with semantic features. Different characters represent different attribute semantics. Therefore, when executing the first association analysis strategy, the association degree calculation process is as follows:

[0049] For numerical attributes, the maximum-minimum normalization method is used to normalize the value of the attribute across all records. The maximum-minimum normalization method is a well-known technique and will not be elaborated here.

[0050] For any numeric attribute and any character attribute in the data table, the records in which the value of the character attribute is the same in all records are grouped into record classes;

[0051] Calculate the dispersion of the values ​​of all records within each record class under any given numerical attribute;

[0052] In this embodiment, the degree of dispersion is measured by calculating the standard deviation of the values ​​of all records in each record class under any numerical attribute. As other implementation methods, implementers may also use other methods of the prior art, such as variance, etc. This embodiment does not impose any special restrictions on this.

[0053] Calculate the sum of the discreteness of any numeric attribute across all record classes, and perform a negative mapping on it, which serves as the correlation between any numeric attribute and any character attribute.

[0054] In this embodiment, the negative mapping process is as follows: the sum value is normalized, and the difference between the value 1 and the normalized sum value is taken as the result of the negative mapping. The maximum and minimum value normalization method is used to normalize the sum values ​​between all numeric attributes and character attributes. The maximum and minimum value normalization method is a well-known technique and will not be described in detail here.

[0055] It should be noted that the greater the degree of dispersion, the greater the fluctuation of the value of the numeric attribute under the same value of the character attribute, the worse the consistency, and the smaller the correlation. This indicates that the correlation between the numeric attribute and the character attribute is weak. Conversely, it indicates that the numerical distribution of the numeric attribute is highly dependent on the character classification of the character attribute, reflecting that there is a strong business logic constraint between the two.

[0056] Secondly, for any two attributes whose data type is character, the second association analysis strategy is applied, and the association degree is calculated as follows:

[0057] For any two character attributes in the data table, let them be denoted as follows: and Get the character type attributes respectively , For all corresponding record classes, the attribute All record classes constitute a record set, which is represented as Then the attribute All record classes constitute a record set, which is represented as M represents attribute The number of all record classes, N represents the attributes The number of all record classes;

[0058] from and Among all record classes, select the record class containing the most records as the target class. It should be noted that if there are multiple record classes with the most records, the most frequently recorded record class will be selected randomly.

[0059] like Then the statistical target class All records within the attribute The values ​​listed below will be the most frequently occurring values. The corresponding record class within is used as the target class. Matching class;

[0060] like Then the statistical target class All records within the attribute The values ​​listed below will be the most frequently occurring values. The corresponding record class within is used as the target class. Matching class, and target class Its matching class is defined as a matching pair;

[0061] For the remaining unmatched record classes, repeat the above steps until all record classes are matched to obtain all matching pairs;

[0062] Therefore, each record class corresponding to each character attribute is matched with the record class corresponding to another character attribute;

[0063] Count the total number of records contained in the record class corresponding to each character attribute in the matching pair;

[0064] For each character attribute in the matching pair, count the number of records in that record class that take the value of another character attribute. The number of records in the matching pair that take the value of the other character attribute is equal to the number of records in the matching pair that take the value of that other character attribute. This number is taken as the same number of each character attribute in the matching pair.

[0065] It should be noted that for a record class with a certain character attribute, since all records in the record class have the same value for that attribute, the matching pair attribute... All records within the record class are in the attribute The values ​​on the attributes are the same, assuming the value is A, the attribute All records within the record class are in the attribute If the values ​​are the same, and assuming the value is labeled B, then the statistical attribute... All records within the record class are in the attribute The value on is equal to the number of records in B; correspondingly, the statistical attribute All records within the record class are in the attribute The value on is equal to the number of records in A.

[0066] The difference between the total number of records and the same number is taken as the different number, and the ratio of the same number to the different number is recorded as the relative comparison;

[0067] In this embodiment, the difference between the total number of records and the same number is taken as the number of different records.

[0068] The correlation between any two character attributes is positively correlated with their relative ratio;

[0069] In this embodiment, the sum of the relative ratios of all character attributes in all matching pairs is calculated as the relevance; the calculation formula is as follows:

[0070]

[0071] in, Represents character type property and The degree of correlation, Indicates the character attribute in the matching pair The same quantity, To match the character attributes in the pair The corresponding total number of records, To match the character attributes in the pair The same quantity, To match the character attributes in the pair The corresponding total number of records, Represents character type property and The corresponding number of all matching pairs. This represents the parameter tuning factor, avoiding a denominator of 0. The parameter tuning factor's value range is... In this embodiment, the parameter tuning factor is set to 1. As a normalization function, in this embodiment, the maximum-minimum value normalization method is used to normalize the correlation between any two character attributes. The maximum-minimum value normalization method is a well-known technique and will not be described in detail here.

[0072] It should be noted that the larger the relative ratio, the stronger the co-occurrence relationship between the two attributes in the record class of the matching pair; the larger the correlation, the more significant the dependency relationship between the character attributes, reflecting the stronger correlation between the two attributes.

[0073] Furthermore, for any two attributes whose data type is numeric, the calculation process for the correlation degree is as follows when the third association analysis strategy is executed:

[0074] For any two numerical attributes, cluster the values ​​of all records in the data table under that attribute, and replace all values ​​in the same cluster with the same character code, thereby transforming the two numerical attributes into two character attributes. Then, according to the calculation process of the second association analysis strategy mentioned above, obtain the association degree of any two numerical attributes.

[0075] In this embodiment, the K-means clustering algorithm is used for clustering. The K-means clustering algorithm is a well-known technique and will not be described in detail here. The process for setting the number of clusters is as follows: obtain the character attribute corresponding to the maximum correlation between each numerical attribute and all character attributes, and count the total number of record classes corresponding to that attribute. Then the maximum number of clusters for each numerical attribute is the total number of clusters. The value is m times the value of 2, where m is set to 2. As for other implementation methods, the implementer can set this value according to the actual situation. Within the range, the elbow rule is used to determine the optimal number of clusters for each numerical attribute; the maximum value of the optimal number of clusters among any two numerical attributes is selected as the number of clusters for the two numerical attributes for clustering processing; as other implementation methods, implementers may use other methods of the prior art, such as the DBSCAN clustering algorithm, etc., and this embodiment does not impose any special restrictions on this.

[0076] It should be noted that if there are no character attributes in the data table, the number of clusters can be determined directly using the elbow rule.

[0077] Thus, the correlation between any two attributes can be obtained. The greater the correlation, the higher the consistency of the values ​​between the two attributes in the data table, and the more significant the co-occurrence model.

[0078] At this point, the correlation between any two attributes is obtained.

[0079] Step 3: Extract the SQL statements of the data tables from the database operation log, analyze the frequency of co-occurrence of the two attributes in the statements at the operation level, determine the instruction frequency weight of any two attributes, and combine the correlation to obtain the grouping priority of any two attributes.

[0080] In relational databases, a single SQL statement is considered a basic operation, including data querying, data manipulation, and data definition. To complete complex database operations, a single SQL statement may involve one or more attributes simultaneously. By using MySQL's command-line tools to obtain the SQL statements used to operate on the database, the co-occurrence of any two attributes in the SQL statement at the instruction operation level is calculated to determine the instruction frequency weight. The flowchart of the method for obtaining the instruction frequency weight of any two attributes provided in this application embodiment is shown below. Figure 2 As shown, it specifically includes:

[0081] Extract multiple SQL statements from each data table from the binary log of the relational database, traverse each SQL statement, and use the set of attributes accessed by the data table during its execution process as a transaction for the data mining algorithm.

[0082] Each attribute in the data table is defined as an item, and the set of all items is used as the itemset for the data mining algorithm.

[0083] In this embodiment, 200 SQL statements from each data table are extracted. As for other implementation methods, implementers can set them according to their actual situation.

[0084] All transactions corresponding to SQL statements are grouped into a transaction set and input into a data mining algorithm. The transaction set is mined based on the itemset with a preset minimum support to obtain the frequent itemsets that meet the minimum support and their support, and the frequent 1-itemsets are extracted from the frequent itemsets.

[0085] In this embodiment, the data mining algorithm used is the Apriori algorithm, where the minimum support is set to... , The value is 0.1. H represents the total number of SQL statements, which is 200. The Apriori algorithm is a well-known technology and will not be described in detail here. As other implementation methods, implementers can use other methods of existing technology, such as the FP-growth algorithm. This embodiment does not impose any special restrictions on this.

[0086] For any two attributes, select frequent itemsets that simultaneously contain both attributes from all frequent itemsets to form an association set;

[0087] The difference between the support of each frequent itemset in the association set and the preset minimum support is taken as the relative difference;

[0088] The instruction frequency weight of any two attributes is positively correlated with the relative difference.

[0089] In this embodiment, the sum of the relative differences of all frequent itemsets in the association set is normalized and used as the instruction frequency weight of any two attributes; wherein, the normalization process is: the ratio of the sum to the total number of statements is used as the result of normalization.

[0090] It should be noted that the more frequently two attributes appear together in an SQL statement, the greater the statistical significance of the frequent itemset, and the greater the frequency weight of the resulting instruction. This indicates that SQL instructions often frequently and jointly manipulate the two attributes.

[0091] Furthermore, in database encryption, it's necessary to consider the SQL statement information. Frequently manipulated, highly correlated attributes should be grouped together for encryption. This ensures database security while reducing decryption resource consumption and improving query efficiency. Therefore, based on instruction frequency weight and correlation, grouping priority is determined as follows:

[0092] For any two attributes, if both belong to frequent 1-itemsets, then the grouping priority of these two attributes is... The calculation process is as follows: Conversely, the grouping priority of any two attributes is the degree of association.

[0093] in, For attributes and attributes The degree of correlation between them For attributes and attributes Normalized instruction frequency weights;

[0094] It should be noted that correlation reflects the static relationship between different attributes in a data table. It can measure the statistical correlation between attributes across data types. A high correlation indicates that different attributes in the data table are prone to correlation attacks. The two attributes should be placed in the same security group to ensure that they are protected simultaneously in encrypted form. Command frequency weight reflects the dynamic relationship between different attributes in a data table. A high command frequency weight indicates that SQL statements often frequently and jointly manipulate the two attributes. The two attributes should be placed in the same security group for encryption protection. When executing SQL statements, the decryption context environment is reused, which greatly reduces the encryption and decryption computation overhead and I / O latency, and improves query efficiency.

[0095] At this point, the grouping priority of any two attributes is obtained.

[0096] Step 4: Construct a weighted undirected graph using the attributes in the data table as nodes and the edge weights between nodes as the grouping priority, and then cluster the graph to divide all attributes into multiple encrypted attribute groups. Based on the proportion of attributes containing foreign key constraint information in the encrypted attribute groups, select different strength encryption strategies for encryption protection for the encrypted attribute groups.

[0097] Furthermore, based on grouping priority, different attributes in the data table are grouped as follows:

[0098] Abstract each attribute in the data table into a node, and abstract the grouping priority of any two attributes into the edge weight between nodes. Construct a weighted undirected graph, perform spectral clustering on it, and treat the attributes contained in the cluster as a group of encrypted attributes.

[0099] In this embodiment, the spectral clustering algorithm is a well-known technique and will not be described in detail here.

[0100] Furthermore, foreign keys in relational databases are crucial constraints for establishing and strengthening relationships between two tables. Foreign keys ensure that values ​​in the child table must exist in the primary key or unique key of the parent table, defining the dependency relationship from the child table to the parent table. IT infrastructure and business systems are characterized by an expanding number of users and increasingly diverse database attribute types. Different roles have different access permissions to the database. Relational databases contain a large amount of metadata such as foreign key constraints and table structures. Attackers are highly likely to exploit the dependencies between table attributes and metadata to deduce unauthorized table information. Therefore, based on the foreign key constraint information of attributes in the data tables, differentiated encryption protection strategies are implemented for different encrypted attribute groups. These strategies specifically include:

[0101] The ratio of the number of attributes in a data table that have foreign key constraints to the total number of attributes in the data table is used as the constraint threshold.

[0102] The ratio of the number of attributes with foreign key constraints in each encrypted attribute group to the total number of attributes in that encrypted attribute group is used as the constraint percentage.

[0103] If the constraint ratio of each encrypted attribute group is equal to 0, then the plaintext data of the attribute in the data table is encrypted using the first encryption algorithm.

[0104] If the constraint ratio of each encrypted attribute group is greater than 0 and less than or equal to the constraint threshold, then the plaintext data of the attribute in the data table within that encrypted attribute group is encrypted using the second encryption algorithm.

[0105] If the constraint ratio of each encrypted attribute group is greater than the constraint threshold, then the plaintext data of the attribute in the data table within that encrypted attribute group will be encrypted using a third encryption algorithm.

[0106] Among them, the encryption strength of the first encryption algorithm is less than that of the second encryption algorithm, which is less than that of the third encryption algorithm.

[0107] In this embodiment, the first encryption algorithm is AES-128, the second encryption algorithm is AES-192, and the third encryption algorithm is AES-256. The encryption processes of AES-128, AES-192, and AES-256 are well-known technologies and will not be described in detail here.

[0108] It should be understood that, although Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0109] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0110] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application. Therefore, any simple modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of this application, without departing from the content of the technical solution of this application, shall fall within the protection scope of the technical solution of this application.

Claims

1. A database encryption protection method for a security operation and maintenance audit system, characterized in that, The method includes the following steps: For a data table in a database, extract its table structure metadata, including attributes, their corresponding data types, and foreign key constraint information; By combining the data types of any two attributes, different association analysis strategies are executed to evaluate the association between the two attributes at the value level in the data table, and the degree of association between any two attributes is obtained. Extract the SQL statements of the data tables from the database operation log, analyze the co-occurrence frequency of two attributes in the statements at the operation level, determine the instruction frequency weight of any two attributes, and combine the correlation to obtain the grouping priority of any two attributes. A weighted undirected graph is constructed using attributes in the data table as nodes and grouping priority as the edge weight between nodes. The graph is then clustered to divide all attributes into multiple encrypted attribute groups. Based on the proportion of attributes containing foreign key constraint information in the encrypted attribute groups, different encryption strategies with different strengths are selected for encryption protection.

2. The database encryption protection method for a security operation and maintenance audit system as described in claim 1, characterized in that, The process of obtaining the correlation between any two attributes includes: if the two attributes are numeric and character types respectively, then a first correlation analysis strategy is executed to calculate the correlation; if the two attributes are both character types, then a second correlation analysis strategy is executed to calculate the correlation; and if the two attributes are both numeric types, then a third correlation analysis strategy is executed to calculate the correlation.

3. The database encryption protection method for a security operation and maintenance audit system as described in claim 2, characterized in that, The first association analysis strategy is as follows: when the two attributes are a numeric attribute and a character attribute, the records with the same value for the character attribute in all records are grouped into record classes; the dispersion of the value of all records in each record class under the numeric attribute is calculated; the sum of the dispersion of the numeric attribute under all record classes is calculated and negatively mapped to it, which is used as the association degree between the numeric attribute and the character attribute.

4. The database encryption protection method for a security operation and maintenance audit system as described in claim 3, characterized in that, The second type of association analysis strategy includes: When both attributes are character type attributes, match all record classes of the two character type attributes to obtain all matching pairs; count the total number of records contained in the record class corresponding to each character type attribute in the matching pair; for each record class corresponding to each character type attribute in the matching pair, count the number of records whose values ​​under the other character type attribute are equal to the value of the record class of the other character type attribute in the matching pair under that attribute, and use this as the same number of records for each character type attribute in the matching pair; the difference between the total number of records and the same number is used as the different number, and the ratio of the same number to the different number is recorded as the relative comparison. The correlation between any two character attributes is positively correlated with their relative comparison.

5. The database encryption protection method for a security operation and maintenance audit system as described in claim 4, characterized in that, The process of obtaining the matching pair is as follows: For the two character type properties, let them be denoted as follows: and , attributes All record classes constitute a record set ,in ; attributes All record classes constitute a record set ,in ; from and Among all record classes, select the record class containing the most records as the target class. ;like Then the statistical target class All records within the attribute The values ​​selected below will include the most frequently occurring values. The corresponding record class within is used as the target class. Matching class; if Then the statistical target class All records within the attribute The values ​​listed below will be the most frequently occurring values. The corresponding record class within is used as the target class. Matching class; and target class The class that matches it is defined as a matching pair; in the remaining unmatched record classes, the above steps are repeated until all record classes are matched to obtain all matching pairs.

6. The database encryption protection method for a security operation and maintenance audit system as described in claim 2, characterized in that, The third association analysis strategy includes: when both attributes are numeric, clustering the values ​​of all records in the data table under each numeric attribute, and replacing all values ​​in the same cluster with the same character code, thereby converting the two numeric attributes into two character attributes, and then executing the second association analysis strategy to calculate the association degree between any two numeric attributes.

7. The database encryption protection method for a security operation and maintenance audit system as described in claim 1, characterized in that, The method for determining the frequency weight of instructions for any two attributes includes: Iterate through each SQL statement and take the set of attributes that the execution process accesses in the data table as a transaction of the data mining algorithm; define each attribute in the data table as an item, and take the set of all items as the itemset of the data mining algorithm; combine the transactions corresponding to all SQL statements into a transaction set and input it into the data mining algorithm; mine the transaction set based on the itemset to obtain the frequent itemsets that meet the preset minimum support and their support, and extract the frequent 1-itemsets from the frequent itemsets; For any two attributes, select frequent itemsets that simultaneously contain both attributes from all frequent itemsets to form an association set; the difference between the support of each frequent itemset in the association set and the preset minimum support is taken as the relative difference. The frequency weight of the instructions is positively correlated with the relative difference.

8. The database encryption protection method for a security operation and maintenance audit system as described in claim 7, characterized in that, Obtaining the grouping priority of any two attributes includes: for any two attributes, if they both belong to frequent 1-itemsets, then the grouping priority of the two attributes is... The calculation process is as follows: Conversely, the grouping priority of any two attributes is the degree of association; where, For attributes and attributes The degree of correlation between them For attributes and attributes Normalized instruction frequency weights.

9. The database encryption protection method for a security operation and maintenance audit system as described in claim 1, characterized in that, The step of selecting different strengths of encryption strategies for encryption protection of encrypted attribute groups includes: calculating the ratio of the number of attributes with foreign key constraints in the data table to the total number of attributes in the data table, as a constraint threshold; calculating the ratio between the number of attributes with foreign key constraints in each encrypted attribute group and the total number of attributes contained in that encrypted attribute group, as a constraint ratio; and assigning an encryption algorithm with corresponding encryption strength to each encrypted attribute group for encryption based on the comparison result of the constraint ratio and the constraint threshold.

10. The database encryption protection method for a security operation and maintenance audit system as described in claim 9, characterized in that, The method of assigning corresponding encryption strengths to each encryption attribute group and encrypting it includes: if the constraint ratio of each encryption attribute group is equal to 0, then the plaintext data of the attribute in the data table within the encryption attribute group is encrypted using a first encryption algorithm; if the constraint ratio of each encryption attribute group is greater than 0 and less than or equal to the constraint threshold, then the plaintext data of the attribute in the data table within the encryption attribute group is encrypted using a second encryption algorithm; if the constraint ratio of each encryption attribute group is greater than the constraint threshold, then the plaintext data of the attribute in the data table within the encryption attribute group is encrypted using a third encryption algorithm, wherein the encryption strength of the first encryption algorithm is less than the encryption strength of the second encryption algorithm, which is less than the encryption strength of the third encryption algorithm.

Images