Information protection method and system based on automatic checking of user rights

Abstract

The present invention relates to an information protection method and system based on automatic checking of user rights, which obtains historical user authorization records to match the latest sensitive information keywords to revise the user authorization scope; by anchoring the sensitive information keywords updated in real time, the rights of illegally authorized users can be adjusted in time, so as to achieve the effect of pre-data access rights detection and pre-control. The present invention obtains historical user authorization records of the database regularly and automatically, and recovers unreasonable historical authorizations of database users in combination with real-time updated sensitive information. It checks and controls from the source by checking user rights rather than user access requests, and can deal with users who may cause data leakage in advance, solve the problem of illegal tampering and leakage of sensitive information, and thus improve data protection capabilities.

Description

Technical Field

[0001] The present invention relates to the technical field of data security protection, and in particular to an information protection method and system based on automatic checking of user rights. Background Art

[0002] As the development of informatization continues to deepen, more and more personalized and customized services require the use of large amounts of data for calculation. For some specific industries, such as banking and finance, the data involved may contain highly sensitive information. During use, it is necessary to fully verify whether the data request is legal to ensure the security of sensitive information and prevent tampering or leakage.

[0003] The existing data security technologies usually include database hidden user detection, database statements, database user usage specifications, system external user authorization and other links. For example, technologies focusing on database user security include detection of hidden users in kernel intrusion, obtaining a database user list through normal channels, using underlying methods to obtain a database user list, comparing the user list obtained through normal channels with the user list obtained through underlying methods, and finding out the database user list that cannot be obtained through normal channels to identify illegal users; or technologies focusing on database statement auditing, parsing the audit data collected by the database statement auditing module to obtain SQL statements, and testing the obtained SQL statements to detect the database security status; there are also technologies focusing on database user behavior, after the server logs in to the user authentication, account, authorization and audit 4A system, it extracts the access operations performed by the database, and uses the legality of the access operation range as the basis for judgment to determine whether the operation behavior is legal; or the operation instruction acquisition module obtains the operation instruction input by the user, the operation instruction analysis module, analyzes the obtained operation instruction, uses the legality judgment module to determine whether the instruction operation range exceeds the allowed operation range of the user's current operation, and uses the operation instruction forwarding module to trigger the database to intercept illegal operation instructions.

[0004] In the field of data security, although existing technologies cover database user security, database user use, data operations and other aspects, they are obviously post-control technologies or based on security detection of users themselves. Their detection and control means mostly rely on the response to user requests, and cannot achieve the most ideal effect of pre-control in terms of data protection. In addition, existing technologies do not consider the control means associated with users' actual use and sensitive information, and there is no associated control technology, which makes it difficult for existing control means to adjust in time with changes in the data system, which is prone to misjudgment. Summary of the invention

[0005] In order to address the deficiencies of the prior art, the present invention proposes an information protection method and system based on automatic checking of user permissions, which obtains the user's historical authorization records to match the latest sensitive information keywords to revise the user's authorization scope; by anchoring the sensitive information keywords updated in real time, the permissions of illegally authorized users can be adjusted in a timely manner, thereby achieving the effect of permission detection before data access and prior control.

[0006] To achieve the above objectives, the technical solutions adopted by the present invention include:

[0007] An information protection method based on automatic checking of user rights, characterized by comprising:

[0008] Batch obtain the list of existing users in the database;

[0009] Get the database authorization records of users in the existing user list;

[0010] Mark the authorization level of users in the existing user list;

[0011] Analyze database authorization records based on authorization levels to obtain a list of potential non-compliant users;

[0012] Execute pre-defined security processing actions based on the list of potential non-compliant users.

[0013] Furthermore, the authorization level of the user in the existing user list is marked as follows:

[0014] Convert the specified information in the database authorization record into a database user authorization list in csv text format, and identify the user authorization level in the database user authorization list;

[0015] For specific databases, users who do not have the permission to query sensitive information are marked as low authorization levels;

[0016] For a specific database, users who have permission to query sensitive information but not to modify sensitive information are marked as medium authorization level;

[0017] For specific databases, users with sensitive information query permissions and sensitive information modification permissions are marked as high authorization levels.

[0018] Further, analyzing the database authorization records according to the authorization level includes:

[0019] For database authorization records at a high authorization level, an illegal global authorization check is performed; the illegal global authorization check includes checking other database operation permissions except for a specific database;

[0020] For database authorization records at the medium authorization level, perform illegal global authorization checks and non-query authorization checks; the non-query authorization checks include checking sensitive information modification permissions;

[0021] For database authorization records at low authorization levels, illegal global authorization checks, non-query authorization checks, and query authorization checks are performed; the query authorization check includes comparing the database authorization records with the currently valid database sensitive information map.

[0022] Furthermore, the batch acquisition of the existing database user list includes using a first calling script to automatically acquire the existing database user list; the acquisition of database authorization records of users in the existing user list includes using a second calling script to automatically query the database system table based on the existing database user list and acquire historical user authorization records in the database.

[0023] Furthermore, obtaining database authorization records of users in the existing user list also includes using a second calling script to automatically read a database configuration file based on the database's existing user list and obtain database authorization records, global user authorization records, table user authorization records and / or column user authorization records of historical users.

[0024] Furthermore, the converting and outputting of the specified information in the database authorization record into a database user authorization list in a csv text format includes using a conversion script to convert the specified information including the user name, library name, table name and the permissions possessed by the user and outputting the result into a database user authorization list in a csv text format.

[0025] Furthermore, the currently valid database sensitive information map is established or updated through regularly acquired database sensitive fields.

[0026] Furthermore, the preset security processing operation includes one or more combinations of the following:

[0027] Alert non-compliant users;

[0028] Alert database security operations personnel;

[0029] Prompt a processing suggestion to the database security operation and maintenance personnel, wherein the processing suggestion includes adjusting the database permissions of the non-compliant user and / or revoking the database permissions of the non-compliant user;

[0030] Revoke database permissions from non-compliant users.

[0031] The present invention also relates to an information protection system based on automatic checking of user rights, characterized in that it comprises:

[0032] The scheduling module is used to execute a first calling script to batch obtain a list of existing users in the database, and execute a second calling script to obtain database authorization records of users in the existing user list;

[0033] Desensitization module, used to periodically obtain sensitive fields in the database;

[0034] The compliance check module is used to establish or update a database sensitive information map through database sensitive fields, and compare the database authorization records with the currently valid database sensitive information map to obtain a list of potential non-compliant users with sensitive information authorization;

[0035] A monitoring module is used to perform preset security processing operations based on the list of potential non-compliant users;

[0036] The transit server is used to execute the conversion script to convert the specified information including the user name, library name, table name and the user's permissions into a database user authorization list in csv text format and send it to the compliance check module.

[0037] The present invention also relates to a computer-readable storage medium, characterized in that a computer program is stored on the storage medium, and the computer program implements the above method when executed by a processor.

[0038] The beneficial effects of the present invention are:

[0039] The information protection method and system based on automatic checking of user permissions described in the present invention are applied to the security protection process of databases and data centers. It can provide a pre-monitoring function for data protection without affecting the existing post-security checking mechanism based on user requests. In particular, it can automatically check and maintain the rationality of database user authorization, and can effectively prevent potential risks of sensitive information leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 The figure is a flow chart of the information protection method based on automatic checking of user rights according to the present invention.

[0041] Figure 2 This is a schematic diagram of the structure of the information protection system based on automatic checking of user rights in the present invention. DETAILED DESCRIPTION

[0042] In order to more clearly understand the content of the present invention, it will be described in detail with reference to the drawings and embodiments.

[0043] like Figure 1 The figure is a flow chart of the information protection method based on automatic checking of user rights of the present invention, and the main steps include:

[0044] Use the first call script to automatically batch obtain the list of existing users in the database;

[0045] Using the second call script to obtain the database authorization records of users in the existing user list, in particular, including using the second call script to regularly and automatically query the database system table syscat.tabauth to obtain the historical user authorization records of the database, and also including using the second call script to read the configuration file to obtain the historical user database db authorization records, global global user authorization records, tables table user authorization records and column user authorization records;

[0046] Convert the specified information in the database authorization record into a database user authorization list in csv text format, especially use a conversion script to output the result into csv text according to the user name, library name, table name, and the permissions of the user. Preferably, use a scheduled task to periodically transmit the obtained database user authorization list for subsequent processing;

[0047] Identify the user authorization level in the database user authorization list; for a specific database, users who do not have sensitive information query permissions are marked as low authorization levels; for a specific database, users who have sensitive information query permissions but do not have sensitive information modification permissions are marked as medium authorization levels; for a specific database, users who have sensitive information query permissions and sensitive information modification permissions are marked as high authorization levels;

[0048] For database authorization records at a high authorization level, an illegal global authorization check is performed, and the illegal global authorization check includes checking other database operation permissions except for a specific database; for database authorization records at a medium authorization level, an illegal global authorization check and a non-query authorization check are performed, and the non-query authorization check includes checking sensitive information modification permissions; for database authorization records at a low authorization level, an illegal global authorization check, a non-query authorization check and a query authorization check are performed, and the query authorization check includes comparing the database authorization record with the currently valid database sensitive information map;

[0049] Establish or update the currently valid database sensitive information map through regularly obtained database sensitive fields;

[0050] Perform preset security processing operations based on the list of potential non-compliant users, such as alerting non-compliant users, alerting database security operation and maintenance personnel, providing processing suggestions to database security operation and maintenance personnel, and revoking database permissions of non-compliant users.

[0051] Preferably, the first calling script, the second calling script and the conversion script can be written in any suitable language and manner according to the actual operation needs of the database, or the first calling script, the second calling script and the conversion script can be combined and processed into an independent special script with all the necessary functions mentioned above as needed; the database sensitive information map marks the latest sensitive information keywords involved in the database and the authorization scope involved in the keywords, and by comparing the database user authorization list, users with abnormal authorization situations can be automatically obtained, and then ex ante management measures can be implemented, which can completely prohibit such requests from being responded to before actual data requests that may involve sensitive information leakage are issued, thereby effectively improving data protection capabilities.

[0052] Since the method of prior detection and control is adopted, there is no need to focus on the timeliness of the security monitoring response. Therefore, the data security detection using the method described in the present invention can be manually reviewed and processed by relevant operation and maintenance personnel at ease. For example, the list of potential non-compliant users identified by the method described in the present invention is manually reviewed by the operation and maintenance personnel and different operations are performed according to different situations. If it is judged to be legally authorized, the alarm can be ignored. If it is judged to be illegal, the user authorization scope can be adjusted or the user authorization can be directly revoked according to the risk of sensitive information leakage. For abnormal user authority issues identified during the detection process, such as the situation where the user authorization scope does not match the user level, the operation and maintenance personnel can be notified in time for manual review and processing, so that authorization errors can be discovered and resolved in time without waiting for risky data requests to occur before control.

[0053] The present invention also relates to a Figure 2 The information protection system based on automatic user authority checking of the structure shown includes:

[0054] The scheduling module is used to execute a first calling script to batch obtain a list of existing users in the database, and execute a second calling script to obtain database authorization records of users in the existing user list;

[0055] Desensitization module, used to periodically obtain sensitive fields in the database;

[0056] The transfer server is used to execute the conversion script to convert the specified information including the user name, library name, table name and the user's permissions into a database user authorization list in csv text format and send it to the compliance check module;

[0057] The compliance check module is used to establish or update a database sensitive information map through database sensitive fields, and compare the database authorization records with the currently valid database sensitive information map to obtain a list of potential non-compliant users with sensitive information authorization;

[0058] A monitoring module is used to perform preset security processing actions based on a list of potential non-compliant users.

[0059] Preferably, the monitoring module in the system may be further associated with an additional alarm module, and may send alarm information to pre-set associated persons based on the data security detection result.

[0060] The method of the present invention can be stored in any suitable computer-readable storage medium via a computer program, so that the method can be implemented by executing the computer program stored in the computer-readable storage medium.

[0061] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. An information protection method based on automatic user authority checking, characterized in that: include: Batch obtaining a list of existing users of the database includes automatically obtaining a list of existing users of the database using a first calling script; Obtaining the database authorization records of users in the existing user list includes using a second call script to automatically query the database system table based on the database existing user list and obtain historical user authorization records in the database; The obtaining of database authorization records of users in the existing user list further includes using a second call script to automatically read a database configuration file based on the database existing user list and obtain database authorization records, global user authorization records, table user authorization records and / or column user authorization records of historical users; The authorization levels of users in the existing user list are as follows: Convert the specified information in the database authorization record into a database user authorization list in csv text format, and identify the user authorization level in the database user authorization list; For specific databases, users who do not have the permission to query sensitive information are marked as low authorization levels; For a specific database, users who have permission to query sensitive information but not to modify sensitive information are marked as medium authorization level; For specific databases, users with sensitive information query permissions and sensitive information modification permissions are marked as high authorization levels; Analyze database authorization records based on authorization levels to obtain a list of potential non-compliant users; Analyzing the database authorization records according to the authorization level includes: For database authorization records at a high authorization level, an illegal global authorization check is performed; the illegal global authorization check includes checking other database operation permissions except for a specific database; For database authorization records at the medium authorization level, perform illegal global authorization checks and non-query authorization checks; the non-query authorization checks include checking sensitive information modification permissions; For database authorization records at low authorization levels, illegal global authorization checks, non-query authorization checks, and query authorization checks are performed; the query authorization check includes comparing the database authorization records with the currently valid database sensitive information map, and the currently valid database sensitive information map is established or updated through regularly obtained database sensitive fields; Execute pre-defined security processing actions based on the list of potential non-compliant users.

2. The method according to claim 1, characterized in that The converting and outputting the specified information in the database authorization record into a database user authorization list in a csv text format includes using a conversion script to convert the specified information including the user name, library name, table name and the user's permissions and outputting the result into a database user authorization list in a csv text format.

3. The method according to claim 1, characterized in that The preset security processing operation includes one or more combinations of the following: Alert non-compliant users; Alert database security operations personnel; Prompt a processing suggestion to the database security operation and maintenance personnel, wherein the processing suggestion includes adjusting the database permissions of the non-compliant user and / or revoking the database permissions of the non-compliant user; Revoke database permissions from non-compliant users.

4. An information protection system based on automatic checking of user rights, characterized in that: For executing the method according to claim 1, comprising: The scheduling module is used to execute a first calling script to batch obtain a list of existing users in the database, and execute a second calling script to obtain database authorization records of users in the existing user list; Desensitization module, used to periodically obtain sensitive fields in the database; The compliance check module is used to establish or update a database sensitive information map through database sensitive fields, and compare the database authorization records with the currently valid database sensitive information map to obtain a list of potential non-compliant users with sensitive information authorization; A monitoring module is used to perform preset security processing operations based on the list of potential non-compliant users; The transit server is used to execute the conversion script to convert the specified information including the user name, library name, table name and the user's permissions into a database user authorization list in csv text format and send it to the compliance check module.

5. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 3 is implemented.

Images