A session audit method and device based on long session

Abstract

The purpose of this application is to provide a session audit method and device based on long sessions. Compared with the prior art, this application determines whether there is login information in the session initiated by the client and the server; if there is no login information, it is determined that the session is a long session that has timed out and logged out, and based on the identification information of the long session, the corresponding login cache information is searched in the session cache, wherein the login cache information is the login information saved in the session cache when the client and the server initially establish the long session connection; the login cache information is determined as the login information of the long session; and the session audit is performed based on the determined long session. This method saves the session information in the session cache, so that after the long session is timed out and logged out, the login information of the long session can be obtained from the session cache, so that the audit can still be performed based on the complete long session, ensuring the accuracy of database auditing based on the long session.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a session auditing technology based on long sessions. Background Art

[0002] At present, database session auditing technology audits database protocols through bypass monitoring technology. When a client and server connection is audited, a new session is established until the client disconnects the database connection, indicating the end of a session. As the number of database session connections increases, the resource usage of the audit system will also increase. For this reason, each session has a timeout mechanism. After a certain period of time, if there is no database operation in the session, the session will be logged out to release system resources.

[0003] In actual application scenarios, there are many database connections that are connected for a long time. Since the audit system has a session timeout mechanism, it will cancel long sessions that have no database operations within the preset timeout period. As a result, the subsequent database operations of the long session will not have session information such as the login name and database name, which will have an adverse impact on the accuracy of existing database auditing technology. Summary of the invention

[0004] The purpose of this application is to provide a session audit method and device based on long sessions.

[0005] According to one aspect of the present application, a session audit method based on a long session is provided, wherein the method comprises:

[0006] Determine whether there is login information for the session initiated by the client and the server;

[0007] If no login information exists, determining that the session is a long session that has timed out and logged out, and searching for corresponding login cache information in the session cache based on the identification information of the long session, wherein the login cache information is the login information stored in the session cache when the client and the server initially establish the long session connection;

[0008] Determine the login cache information as the login information of the long session;

[0009] A session audit is performed based on the determined long session.

[0010] Further, the searching corresponding login cache information in the session cache based on the identification information of the long session includes:

[0011] Matching a session block corresponding to the long session in the session cache based on the identification information;

[0012] The login cache information corresponding to the long session is searched in the session block.

[0013] Furthermore, wherein the session block includes content information of the corresponding long session and session start time, after determining the login cache information as the login information of the long session, the method further includes:

[0014] Determine whether the session block contains the same content information as the long session; if not, determine the content information of the long session as the content information of the corresponding session block, and determine the start time of the long session as the session start time of the corresponding session block; or

[0015] If it exists, only the start time of the long session is determined as the session start time of the corresponding session block.

[0016] Optionally, after performing session audit based on the determined long session, the method further includes:

[0017] When the total amount of session blocks in the session cache reaches a preset session cache threshold, the session block with the earliest session start time is deleted from the session cache.

[0018] Optionally, after performing session audit based on the determined long session, the method further comprises: when the client of the long session is disconnected from the server, deleting the session block corresponding to the long session from the session cache.

[0019] Furthermore, the identification information includes an IP address and a port pair of the client and the server corresponding to the long session.

[0020] Furthermore, the login cache information includes tool information and account information of the client for logging into the database.

[0021] According to another aspect of the present application, a computer-readable medium is provided, on which computer-readable instructions are stored. The computer-readable instructions can be executed by a processor to implement the operations of the aforementioned method.

[0022] According to another aspect of the present application, a session audit device based on a long session is also provided, wherein the device includes:

[0023] one or more processors; and

[0024] A memory storing computer readable instructions which, when executed, cause the processor to perform the operations of the above-described method.

[0025] Compared with the prior art, the present application determines whether there is login information in the session initiated by the client and the server; if there is no login information, the session is determined to be a long session that has timed out and logged out, and the corresponding login cache information is searched in the session cache based on the identification information of the long session, wherein the login cache information is the login information stored in the session cache when the client and the server initially establish the long session connection; the login cache information is determined as the login information of the long session; and the session audit is performed based on the determined long session. This method saves the session information in the session cache, so that when the long session times out and is logged out, the login information of the long session can still be obtained from the session cache, so that the database audit can still be performed based on the complete long session, ensuring the accuracy of the database audit based on the long session. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0027] Figure 1 A flow chart of a session audit method based on a long session according to one aspect of the present application is shown;

[0028] Figure 2 A flow chart of a session audit method based on a long session according to a preferred embodiment of the present application is shown;

[0029] The same or similar reference numerals in the drawings represent the same or similar components. DETAILED DESCRIPTION

[0030] The present invention is further described in detail below in conjunction with the accompanying drawings.

[0031] In a typical configuration of the present application, the client, the device of the service network and the trusted party all include one or more processors (CPU), input / output interfaces, network interfaces and memories.

[0032] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0033] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include non-transitory media such as modulated data signals and carrier waves.

[0034] In order to further explain the technical means adopted by the present application and the effects achieved, the technical solution of the present application is clearly and completely described below in combination with the accompanying drawings and preferred embodiments.

[0035] Figure 1 A session audit method based on a long session is shown in one aspect of the present application, wherein the method comprises:

[0036] S11 determines whether there is login information for the session initiated by the client and the server;

[0037] S12: if no login information exists, determining that the session is a long session that has timed out and logged out, and searching the session cache for corresponding login cache information based on the identification information of the long session, wherein the login cache information is the login information stored in the session cache when the client and the server initially establish the long session connection;

[0038] S13 determines the login cache information as the login information of the long session.

[0039] The method steps involved in this application are executed by device 1, which is used to audit the operation of the client accessing the server database to prevent the client from performing illegal operations or unauthorized operations on the server database. Here, the device 1 can be set on the server that establishes a session relationship with the client, or the device 1 can establish a communication relationship with the server as an independent device. When the device 1 is an independent device, the device 1 includes but is not limited to a computer, a network host, a single network server, a plurality of network server sets or a cloud composed of multiple servers; here, the cloud is composed of a large number of computers or network servers based on cloud computing (Cloud Computing), wherein cloud computing is a kind of distributed computing, a virtual supercomputer composed of a group of loosely coupled computer sets. Among them, the server side that establishes a session relationship with the client is provided with a database, and when the client needs to access the database, it can establish a session connection with the server. Among them, the database software includes but is not limited to Oracle, SQL Server and DB2, and this application does not limit the specific types of database software.

[0040] When a client establishes a connection with the server database for the first time, a new session is established. Device 1 obtains and saves the client's login information through operation analysis. That is, during the entire life cycle of the session, device 1 only obtains login information once when establishing a connection. The database audit system of device 1 performs audits based on such sessions that have obtained login information.

[0041] Device 1 sets a timeout mechanism for the session, which is preferably implemented by the database audit system, but this application does not specifically limit the module that implements the timeout mechanism. When device 1 detects that there is no database operation in a session within a preset interaction time threshold, the session is logged out, that is, the session information saved by device 1 is deleted, and the deleted session information includes but is not limited to the login information of the session.

[0042] In this embodiment, in step S11, it is determined whether there is login information in the session initiated between the client and the server.

[0043] In this step, when the database audit system performs session audit, it first determines whether there is login information for the session initiated by the client and the server. Here, the login information includes the login tool and login account used by the client to log in to the server database. For example, the database software of the server is MySQL, and the client can access and operate the server database through the client software MySQL 5.5 Command Line Client that comes with MySQL. At this time, the login information records that the login tool of the client is MySQL 5.5 Command Line Client, and records the MySQL 5.5 Command Line Client account when the client accesses the database.

[0044] In this embodiment, in step S12, if no login information exists, it is determined that the session is a long session that has timed out and logged out, and the corresponding login cache information is searched in the session cache based on the identification information of the long session, wherein the login cache information is the login information saved in the session cache when the client and the server initially establish the long session connection.

[0045] In this step, the identification information includes the IP address and port pair of the client and server corresponding to the long session. The searching for the corresponding login cache information in the session cache based on the identification information of the long session includes: matching the session block corresponding to the long session in the session cache based on the identification information; searching for the login cache information corresponding to the long session in the session block.

[0046] Continuing in this step, the session cache is a specific module in device 1 that stores session audit objects. The session cache stores each session in the form of a session block, and uses the client IP address and port number and the server IP address and port number of the session as identification information, which is used to uniquely index a session block in the session cache, and store the login cache information, content information and session start time of the corresponding session in the session block. Among them, the login cache information is the login information stored in the session cache, that is, it includes the tool information and account information of the client logging into the database. The content information records the address, configuration, user and other information of the client and server, including but not limited to the client host name, port, address, user department information, user name, database port, name, type, address, error code, error message, etc. The session start time is the start time of the latest operation of the session.

[0047] Here, if there is no login information for a session in the session audit, it means that the session is a long session whose login information has been deleted because there is no database operation within the interaction time threshold. For such a long session, the corresponding login cache information is searched in the session cache through the flag information of the long session.

[0048] Continuing in this step, preferably, the session cache adopts a hash table structure, and the IP address and port number of the session client and the IP address and port number of the server are used as a set of IP-port pairs, and the IP-port pair is used as the hash key of the session cache. In this way, the hash address that stores the session login cache information, content information and session start time is indexed through the IP-port pair of a certain session. This method utilizes the low time complexity of hash table query, and can achieve more efficient session query compared to other data structures.

[0049] In this embodiment, in step S13, the login cache information is determined as the login information of the long session. In this step, since the login cache information stored in the session cache is the login information obtained when the client establishes a connection with the server, the indexed login cache information is directly determined as the login information of the long session.

[0050] In this embodiment, in step S14, session audit is performed based on the determined long session. In this step, since the determined long session has re-acquired the login information through the session cache, session audit can be performed based on the long session after the login information is re-determined.

[0051] This method improves the session audit with a timeout mechanism. By setting a session cache to save the session login information, when a long session performs data operations after the login information is deleted, the login information can still be re-determined. Therefore, the database audit system can perform normal session auditing based on the long session after the login information is determined.

[0052] In a preferred embodiment, see Figure 2 As shown, Figure 2 Steps S21, S22, S23 and S25 in Figure 1 Steps S11, S12, S13 and S14 in the embodiment are the same or substantially the same, so they are not described here in detail and are only included here by reference. Step S24 includes: determining whether the same content information as the long session exists in the session block, if not, determining the content information of the long session as the content information of the corresponding session block, and determining the start time of the long session as the session start time of the corresponding session block; or, if exists, determining only the start time of the long session as the session start time of the corresponding session block.

[0053] Here, according to the session block corresponding to the long session indexed in the session cache, continue to search whether there is the same content information as the current session operation. If there is the same content information, it means that the operation performed by the long session accessing the server database is the same as the last time, then the session start time is updated, and the start time of the latest database operation of the long session is recorded. If after retrieval, the same content information as the current long session operation does not exist in the session block, it means that the operation performed by the long session accessing the server database is different from the last time. In this case, the content information of the current long session is determined as the content information of the corresponding session block, and the session start time of the session block is updated, and the start time of the latest database operation of the long session is recorded. In this way, the update of the long session content information is realized, so that the session cache always saves the latest access database operation, so that the database audit system can always perform session audit based on the latest session content.

[0054] Preferably, after step S14 or step S25, the method further comprises: when the total amount of session blocks in the session cache reaches a preset session cache threshold, deleting the session block with the earliest session start time from the session cache.

[0055] Here, device 1 can preset a session cache threshold. When the total number of session blocks in the session cache reaches the preset session cache threshold, the session start time of all session blocks is compared, and the session block with the earliest session start time is searched. The long session corresponding to the session block is the long session with the longest idle time, and the session block is deleted from the session cache. For example, the session cache threshold can be set to one million. When the number of session blocks saved in the session cache exceeds one million, the session block with the earliest session start time is deleted. It should be clear that since databases are generally used within enterprises, under normal circumstances, setting the session cache threshold at the million level can meet the application scenarios of most database audits. Through this method, the impact of the continuous growth of the number of sessions on the efficiency of query operations is effectively reduced.

[0056] Preferably, after step S14 or step S25, the method further comprises: when the client of the long session is disconnected from the server, deleting the session block corresponding to the long session from the session cache.

[0057] Here, when it is detected that the client of a long session is disconnected from the server, it means that the life cycle of the long session has ended, so the session block corresponding to the long session can be deleted from the session cache. Through this method, the ended long session that does not require session audit is deleted from the session cache, which effectively saves the storage space of the device 1 and also reduces the adverse effect of the continuous growth of session blocks on the query efficiency of the session cache.

[0058] Compared with the prior art, the present application determines whether there is login information in the session initiated by the client and the server; if there is no login information, the session is determined to be a long session that has timed out and logged out, and the corresponding login cache information is searched in the session cache based on the identification information of the long session, wherein the login cache information is the login information stored in the session cache when the client and the server initially establish the long session connection; the login cache information is determined as the login information of the long session; and the session audit is performed based on the determined long session. This method saves the session information in the session cache, so that after the long session is timed out and logged out, the login information of the long session can be obtained from the session cache, so that the audit can still be performed based on the complete long session, ensuring the accuracy of database auditing based on the long session.

[0059] In addition, an embodiment of the present application also provides a computer-readable medium on which computer-readable instructions are stored, and the computer-readable instructions can be executed by a processor to implement the aforementioned method.

[0060] The embodiment of the present application also provides a session audit device based on a long session, wherein the device includes:

[0061] one or more processors; and

[0062] A memory storing computer readable instructions which, when executed, cause the processor to perform the operations of the aforementioned method.

[0063] For example, when the computer-readable instructions are executed, the one or more processors are caused to: determine whether there is login information for the session initiated by the client and the server; if there is no login information, determine that the session is a long session that has timed out and logged out, and search for corresponding login cache information in the session cache based on the identification information of the long session, wherein the login cache information is the login information stored in the session cache when the client and the server initially establish the long session connection; determine the login cache information as the login information of the long session; and perform a session audit based on the determined long session.

[0064] It is obvious to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential features of the present invention. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-restrictive, and the scope of the present invention is defined by the appended claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any figure mark in the claims should not be regarded as limiting the claims involved. In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the device claim can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

Claims

1. A session audit method based on long sessions, wherein: The method is applied to a database audit system to perform session auditing, and the method comprises: Determine whether there is login information for the session initiated by the client and the server, wherein the login information includes tool information and account information for the client to log in to the database; If no login information exists, determining that the session is a long session that has timed out and been logged off, and searching for corresponding login cache information in the session cache based on the identification information of the long session, wherein the login cache information is the login information stored in the session cache when the client and the server initially establish the long session connection, and the long session that has timed out and been logged off includes a long session that has no database operation within a preset timeout period; Determine the login cache information as the login information of the long session; Performing session audit based on the determined long session; The searching for corresponding login cache information in the session cache based on the identification information of the long session includes: Matching a session block corresponding to the long session in the session cache based on the identification information; Searching the session block for login cache information corresponding to the long session; The session block includes content information of the corresponding long session and session start time. After determining the login cache information as login information of the long session, the method further includes: Determine whether the session block contains the same content information as the long session; if not, determine the content information of the long session as the content information of the corresponding session block, and determine the start time of the long session as the session start time of the corresponding session block; or If it exists, only the start time of the long session is determined as the session start time of the corresponding session block.

2. The method according to claim 1, wherein: After performing session audit based on the determined long session, the method further includes: When the total amount of session blocks in the session cache reaches a preset session cache threshold, the session block with the earliest session start time is deleted from the session cache.

3. The method according to any one of claims 1 to 2, wherein: After performing session audit based on the determined long session, the method further includes: when the client of the long session is disconnected from the server, deleting the session block corresponding to the long session from the session cache.

4. The method according to claim 1, wherein: The identification information includes an IP address and a port pair of the client and server corresponding to the long session.

5. A computer-readable medium having computer-readable instructions stored thereon, wherein the computer-readable instructions can be executed by a processor to implement the method according to any one of claims 1 to 4.

6. A session audit device based on a long session, wherein: The equipment includes: one or more processors; and A memory storing computer readable instructions which, when executed, cause the processor to perform the operations of the method as claimed in any one of claims 1 to 4.

Images