Database security protection method, device, system, storage medium and electronic device

Abstract

The embodiments of the present application provide a database security protection method, device, system, storage medium and electronic device, and the database security protection method includes: receiving a database access request sent by an application server; wherein the database access request carries target five-tuple information related to the target user device, and the target five-tuple information is five-tuple information of access data from the target user device to the application server; detecting whether there is an attack behavior in the database access request; if it is determined that there is an attack behavior in the database access request, extracting the target five-tuple information from the database access request, and sending the target five-tuple information to the application server protection system, so that the application server protection system can block the target user device from accessing the database according to the target five-tuple information. With the help of the above technical solution, the embodiments of the present application can achieve accurate blocking of threatening user devices, and thus can also improve the security of the database.

Description

Technical Field

[0001] The present application relates to the field of database security technology, and in particular to a database security protection method, device, system, storage medium and electronic device. Background Art

[0002] In the Internet environment, databases can store business information, and users can send database operation requests to the database through user devices, such as information query requests or information modification requests. After receiving the operation request, the database executes the database operation steps corresponding to the operation request, and obtains the operation result and returns it to the user.

[0003] However, some malicious programs can carry out network attacks on the database in order to illegally obtain business information from the database. One specific means of network attack is that the malicious program exploits the vulnerability of the user device and injects malicious database operation statements into the access data sent by the user device. When the database processes the operation request, it will execute the maliciously injected database operation statement, thus suffering from network attack.

[0004] Therefore, a database security protection method is needed to prevent the database from being attacked by network attacks, thereby improving the security of the database. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a database security protection method, device, system, storage medium and electronic device to achieve accurate blocking of threatening user devices.

[0006] In the first aspect, an embodiment of the present application provides a database security protection method, which is applied to a database firewall in a database security protection system. The database security protection system includes a database, a target user device, an application server, an application server protection system and a database firewall. The database security protection method includes: receiving a database access request sent by an application server; wherein the database access request carries target five-tuple information related to the target user device, and the target five-tuple information is five-tuple information of access data from the target user device to the application server; detecting whether there is an attack behavior in the database access request; if it is determined that there is an attack behavior in the database access request, extracting the target five-tuple information from the database access request, and sending the target five-tuple information to the application server protection system, so that the application server protection system blocks the target user device from accessing the database according to the target five-tuple information.

[0007] Therefore, in an embodiment of the present application, the application server obtains the target five-tuple information of the access data from the target user device to the application server, and adds the target five-tuple information to the database access request. Then, when it is determined through the database access request that there is an attack behavior, the target five-tuple information is sent to the application server protection system, so that the application server protection system can block the target user device's access to the database based on the target five-tuple information. Compared with the existing solution of blocking the entire connection pool, it can achieve accurate blocking of threatening user devices, and thus improve the security of the database.

[0008] In a possible embodiment, the database security protection method further includes: performing attack tracing based on the target quintuple information to obtain an attack tracing result.

[0009] In the second aspect, an embodiment of the present application provides a database security protection method, which is applied to an application server protection system in a database security protection system. The database security protection system includes a database, a target user device, an application server, a database firewall and an application server protection system. The database security protection method includes: receiving target five-tuple information sent by the database firewall; wherein the target five-tuple information is extracted from the database access request by the database firewall when it is determined that there is an attack behavior in the database access request, and the target five-tuple information is five-tuple information of access data from the target user device to the application server; according to the target five-tuple information, blocking the target user device from accessing the database.

[0010] In a possible embodiment, blocking the target user equipment from accessing the database according to the target five-tuple information includes: searching for sessions related to the target user equipment according to the target five-tuple information; and blocking sessions related to the target user equipment.

[0011] In a third aspect, an embodiment of the present application provides a database security protection device, which is applied to a database firewall in a database security protection system. The database security protection system includes a database, a target user device, an application server, an application server protection system and a database firewall. The database security protection device includes: a first receiving module, used to receive a database access request sent by the application server; wherein the database access request carries target five-tuple information related to the target user device, and the target five-tuple information is five-tuple information of access data from the target user device to the application server; a detection module, used to detect whether there is an attack behavior in the database access request; a sending module, used to extract the target five-tuple information from the database access request if it is determined that there is an attack behavior in the database access request, and send the target five-tuple information to the application server protection system, so that the application server protection system can block the target user device from accessing the database according to the target five-tuple information.

[0012] In a possible embodiment, the database security protection device further includes: an attack tracing module, which is used to perform attack tracing based on the target quintuple information to obtain an attack tracing result.

[0013] In a fourth aspect, an embodiment of the present application provides a database security protection device, which is applied to an application server protection system in a database security protection system. The database security protection system includes a database, a target user device, an application server, a database firewall and an application server protection system. The database security protection device includes: a second receiving module, used to receive target five-tuple information sent by the database firewall; wherein the target five-tuple information is extracted from the database access request by the database firewall when it is determined that there is an attack behavior in the database access request, and the target five-tuple information is five-tuple information of access data from the target user device to the application server; a blocking module, used to block the target user device's access to the database according to the target five-tuple information.

[0014] In a possible embodiment, the blocking module is specifically configured to: search for sessions related to the target user equipment according to the target five-tuple information; and block the sessions related to the target user equipment.

[0015] In a fifth aspect, an embodiment of the present application provides a storage medium having a computer program stored thereon, and the computer program is executed by a processor to execute the method described in the first aspect or any optional implementation of the first aspect.

[0016] In a sixth aspect, an embodiment of the present application provides a storage medium having a computer program stored thereon, and the computer program is executed by a processor to execute the method described in the second aspect or any optional implementation of the second aspect.

[0017] In the seventh aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory and a bus, the memory storing machine-readable instructions executable by the processor, when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the method described in the first aspect or any optional implementation method of the first aspect is performed.

[0018] In an eighth aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the method described in the second aspect or any optional implementation method of the second aspect is performed.

[0019] In a ninth aspect, the present application provides a computer program product, which, when executed on a computer, enables the computer to execute the method in the first aspect or any possible implementation of the first aspect.

[0020] In a tenth aspect, the present application provides a computer program product, which, when running on a computer, enables the computer to execute the method in the second aspect or any possible implementation of the second aspect.

[0021] In order to make the above-mentioned objectives, features and advantages to be achieved by the embodiments of the present application more obvious and understandable, the following specifically cites preferred embodiments and describes them in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 A schematic diagram showing an application scenario provided by an embodiment of the present application is shown;

[0024] Figure 2 A flowchart of a database security protection method provided by an embodiment of the present application is shown;

[0025] Figure 3 A structural block diagram of a database security protection device provided in an embodiment of the present application is shown;

[0026] Figure 4A structural block diagram of another database security protection device provided in an embodiment of the present application is shown;

[0027] Figure 5 A structural block diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0029] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0030] In the Internet era, the behavioral data, portrait data, and information data generated in the process of interaction between people and society are growing exponentially, and the value and importance of data are self-evident. As a carrier of data, database products and technologies are becoming more and more mature, and database security has become particularly important.

[0031] The security of the database refers to protecting the database from data leakage, modification or damage caused by illegal use. In addition, whether the security protection measures are effective is the main technical indicator of the database, and data security is like a barrel. Whether the entire protection system is strong depends entirely on the weak link. Therefore, even if the security protection of the network layer and the operating system is relatively complete, if the database storing the core information is not properly protected, it will also cause a more serious data security crisis.

[0032] In addition, database firewalls are a type of data security protection device specifically designed for data databases, following traditional network firewalls, next-generation firewalls and other security protection devices. Database firewalls are a type of database security protection device that targets abnormal data access on the application side, and they generally use active defense mechanisms, define risk strategies through behavior modeling, and combine database virtual patches, injection rules and application-related protection mechanisms to achieve control of database access behaviors, high-risk blocking and suspicious behavior auditing.

[0033] In addition, database firewalls usually implement database attack defense and event tracing by analyzing database application traffic through technologies such as database communication protocol analysis, blacklist and whitelist mechanisms, database vulnerability protection, and database application auditing. The following are the main ideas and functions of several protection methods:

[0034] (1) Analysis of database communication protocol

[0035] For database application data, according to different application types (such as MySQL, Oracle and PostgreSQL, etc.), the communication protocol of the database application data is parsed. The application layer data obtained by the analysis is the basis for the database firewall to protect against database risk behaviors and illegal operations. In addition, the more accurate the communication protocol parsing is, the more thorough and secure the database protection work will be.

[0036] (2) Blacklist and whitelist mechanism

[0037] In the process of database protection, in addition to using the information parsed by the data communication protocol to set up corresponding risk interception and illegal structured query language (SQL) operation predefined strategies, common protection methods also include building dynamic models through learning patterns and SQL syntax analysis to form SQL whitelists and SQL blacklists. The behavior model is combined with the blacklist and whitelist to set up strategies for the database through prohibition rules, warning rules, release rules, and a mixture of multiple mode rules, thereby protecting the database.

[0038] (3) Database vulnerability protection

[0039] In the process of database protection, in addition to limiting database login, intercepting malicious SQL operations, and protecting against batch data downloads and deletions, the potential safety hazards caused by some vulnerabilities in the database itself are also within the protection scope of the database firewall. Careful and rigorous protection against these risky behaviors is also a key point in the value of the database firewall. It is usually detected and defended through virtual patches. After detecting vulnerability threat data, the data message is discarded.

[0040] (4) Database application audit

[0041] It records database activities on the network in real time, conducts fine-grained audits on database operations, and issues real-time alerts on risky behaviors encountered by the database. In addition, by recording, analyzing, and reporting on database access behaviors, it helps users generate compliance reports and trace the source of accidents afterwards. At the same time, it provides efficient query audit reports through big data search technology to locate the cause of the event for future query, analysis, and filtering, thereby strengthening the monitoring and auditing of internal and external database network behaviors and improving data asset security.

[0042] Furthermore, the database firewall can be deployed between the application server and the database, and it can detect and identify database attacks and abnormal behaviors through black and white lists, SQL statement analysis, virtual patch detection, machine learning, big data analysis and other methods. After identifying database attacks and abnormal behaviors, it blocks database requests.

[0043] In addition, the database firewall can also record database activities on the network in real time and issue database audit reports for database administrators to analyze the database security status and adjust corresponding security policies.

[0044] In addition, the application server usually connects to the database deployed behind the application server through database connection or connection pool to obtain the data resources required for the application to run. However, at this time, there is no corresponding relationship between the connection from the user device to the application server and the connection from the application server to the database, and it is impossible to accurately defend against the attack behavior, and it is difficult to track the user device that actually launched the attack based on the attack behavior.

[0045] For example, when a user device connects to an application server through a connection pool and the database firewall determines that a user device in a connection pool has engaged in an attack, the database firewall cannot determine which user device in the connection pool has engaged in an attack. To ensure the security of the database, the database firewall can only block all user devices in the connection pool from accessing the database, thereby preventing user devices that normally access the database from working properly.

[0046] Based on this, an embodiment of the present application cleverly provides a database security protection method, which receives a database access request sent by an application server, wherein the database access request carries target five-tuple information related to a target user device, and the target five-tuple information is five-tuple information of access data from the target user device to the application server, and then detects whether there is an attack behavior in the database access request. Finally, if it is determined that there is an attack behavior in the database access request, the target five-tuple information is extracted from the database access request and sent to the application server protection system, so that the application server protection system can block the target user device from accessing the database according to the target five-tuple information.

[0047] Therefore, in an embodiment of the present application, the application server obtains the target five-tuple information of the access data from the target user device to the application server, and adds the target five-tuple information to the database access request. Then, when it is determined through the database access request that there is an attack behavior, the target five-tuple information is sent to the application server protection system, so that the application server protection system can block the target user device's access to the database based on the target five-tuple information. Compared with the existing solution of blocking the entire connection pool, it can achieve accurate blocking of threatening user devices, and thus improve the security of the database.

[0048] See also Figure 1 , Figure 1 A schematic diagram of an application scenario provided by an embodiment of the present application is shown. Figure 1 As shown, the application scenario includes three user devices, an application server protection system, an application server, a database firewall and a database. Among them, the three user devices are connected to the application server protection system, and the application server protection system is connected to the application server and the database firewall respectively, and the database firewall is connected to the database.

[0049] It should be understood that the specific equipment of the user device, the specific equipment of the application server protection system, the specific equipment of the application server, the specific equipment of the database firewall and the specific equipment of the database can all be set according to actual needs, and the embodiments of the present application are not limited to this.

[0050] For example, the user device may be a mobile phone or a computer.

[0051] Specifically, the access data of the user device for requesting access to the database is sent from the user device to the application server, and the application server can extract the five-tuple information of the corresponding user device from the access data. In addition, the application server can add the five-tuple information of the corresponding user device to the database access request during the process of generating the database access request. Subsequently, the application server can send the generated database access request to the database firewall so that the database firewall can detect whether there is an attack in the database access request. If the database firewall determines that there is an attack, the database firewall can send the five-tuple information corresponding to the database access request to the application server protection system. Subsequently, the application server protection system can block the access of the user device under attack to the database based on the target five-tuple information.

[0052] It should be understood that although Figure 1 A specific application scenario is shown, but those skilled in the art should understand that they can also set the application scenario according to actual needs, and they are not limited thereto.

[0053] For example, although Figure 1 Three user equipments are shown, but the application scenario may also include more or fewer user equipments.

[0054] See also Figure 2 , Figure 2 A flowchart of a database security protection method provided by an embodiment of the present application is shown. Figure 2 The database security protection methods shown include:

[0055] Step S210: The application server receives access data sent by the target user equipment and may extract target five-tuple information from the access data, wherein the access data may be used to request access to a database.

[0056] In order to facilitate understanding of the embodiments of the present application, a description is given below using specific embodiments.

[0057] Specifically, after the application server receives the access data sent by the target user equipment, it can obtain the five-tuple information of the access data, wherein the five-tuple information may include the source IP address, the source port, the destination IP address, the destination port and the protocol type.

[0058] Step S220: The application server generates a database access request using the target quintuple information.

[0059] It should be understood that the specific method by which the application server generates a database access request using the target quintuple information can be set according to actual needs, and the embodiments of the present application are not limited thereto.

[0060] For example, the application server may add the target five-tuple information to the database access request in the form of a database request statement comment or a protocol reserved field.

[0061] It should also be understood that the database access request may include two sets of five-tuple information, where the source IP address in one set of five-tuple information may be the IP address of the application server, and the source IP address in the other set of five-tuple information may be the IP address of the target user device, etc.

[0062] That is to say, compared with the existing database access request, it can be considered that a field recording five-tuple information is added to the database access request, and the newly added five-tuple information is the five-tuple information of access data from the target user equipment to the application server.

[0063] Step S230: the application server sends a database access request to the database firewall. Correspondingly, the database firewall receives the database access request sent by the application server.

[0064] Step S240: The database firewall detects whether there is any attack behavior in the database access request.

[0065] If it is determined through detection that an attack behavior exists, step S250 is executed; if it is determined through detection that no attack behavior exists, step S270 is executed.

[0066] Specifically, the database firewall may analyze the database access request to determine whether there is any attack behavior in the database access request.

[0067] Step S250: the database firewall extracts the target five-tuple information from the database access request and sends the target five-tuple information to the application server protection system. Correspondingly, the application server protection system receives the target five-tuple information sent by the database firewall.

[0068] It should also be noted here that, when the database firewall determines that an attack behavior exists, the database firewall may record the attack behavior in addition to sending the target five-tuple information to the application server protection system.

[0069] In addition, the database firewall can also perform threat analysis and attack tracing based on the recorded target quintuple information to obtain attack tracing results.

[0070] For example, the database firewall can search for the corresponding source IP address from the target five-tuple information, and can determine the user device corresponding to the source IP address as the target user device of the attack database, so that the determined attack tracing result is the relevant information of the determined target user device.

[0071] Step S260: The application server protection system blocks the target user device from accessing the database according to the target five-tuple information.

[0072] It should be understood that the specific process of the application server protection system blocking the target user device's access to the database based on the target five-tuple information can be set according to actual needs, and the embodiments of the present application are not limited to this.

[0073] Optionally, the application server protection system may search for sessions related to the target user device based on the target five-tuple information, and may block sessions related to the target user device.

[0074] It should also be understood that the application server protection system can search for sessions related to the target user device based on the target five-tuple information, and the specific process can be set according to actual needs, and the embodiments of the present application are not limited to this.

[0075] For example, the application server protection system can search for the session between the target user device and the application server based on the source IP address, source port, destination IP address and destination port in the target five-tuple information.

[0076] It should also be understood that the specific process of the application server protection system blocking sessions related to the target user device can be set according to actual needs, and the embodiments of the present application are not limited to this.

[0077] For example, the application server protection system can terminate threatening access sessions by sending special messages or generating blacklist policies.

[0078] It should also be understood that the specific message format of the special message can be set according to actual needs, and the embodiments of the present application are not limited to this.

[0079] For example, the special message may be a reset (RESET, RST) message.

[0080] Step S270: The database firewall allows access.

[0081] Therefore, the embodiment of the present application detects attacks on the database through the five-tuple information of the access data from the target user device to the application server, thereby solving the problem that there is no corresponding relationship between the connection from the user device to the application server and the connection from the application server to the database, and the attack behavior cannot be accurately defended.

[0082] In addition, the newly added five-tuple information related to the target user device in the database access request serves as an important identity basis for database firewall audits. Combined with the risk event content, it can help security personnel quickly and accurately trace and hold accountable risk events.

[0083] It should be understood that the above database security protection method is only exemplary, and those skilled in the art can make various modifications based on the above method, and the modified or deformed content is also within the protection scope of this application.

[0084] See also Figure 3 , Figure 3The structural block diagram of a database security protection device 300 provided in an embodiment of the present application is shown. It should be understood that the database security protection device 300 corresponds to the above-mentioned method embodiment and can execute the various steps involved in the database firewall side in the above-mentioned method embodiment. The specific functions of the database security protection device 300 can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here. The database security protection device 300 includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the operating system (OS) of the database security protection device 300. Specifically, the database security protection device 300 includes:

[0085] The first receiving module 310 is used to receive a database access request sent by an application server; wherein the database access request carries target five-tuple information related to a target user device, and the target five-tuple information is five-tuple information of access data from the target user device to the application server;

[0086] A detection module 320 is used to detect whether a database access request contains any attack behavior;

[0087] The sending module 330 is used to extract the target five-tuple information from the database access request if it is determined that there is an attack behavior in the database access request, and send the target five-tuple information to the application server protection system, so that the application server protection system can block the target user device from accessing the database according to the target five-tuple information.

[0088] In a possible embodiment, the database security protection device 300 further includes: an attack tracing module (not shown), which is used to perform attack tracing based on the target quintuple information to obtain an attack tracing result.

[0089] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0090] See also Figure 4 , Figure 4The structural block diagram of another database security protection device 400 provided in an embodiment of the present application is shown. It should be understood that the database security protection device 400 corresponds to the above-mentioned method embodiment, and can execute the various steps involved in the application server protection system in the above-mentioned method embodiment. The specific functions of the database security protection device 400 can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here. The database security protection device 400 includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the operating system (OS) of the database security protection device 400. Specifically, the database security protection device 400 includes:

[0091] The second receiving module 410 is used to receive the target five-tuple information sent by the database firewall; wherein the target five-tuple information is extracted from the database access request by the database firewall when it is determined that the database access request has an attack behavior, and the target five-tuple information is five-tuple information of access data from the target user device to the application server;

[0092] The blocking module 420 is used to block the target user equipment from accessing the database according to the target five-tuple information.

[0093] In a possible embodiment, the blocking module 420 is specifically configured to: search for sessions related to the target user equipment according to the target five-tuple information; and block the sessions related to the target user equipment.

[0094] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0095] See also Figure 5 , Figure 5The structural block diagram of an electronic device 500 provided in an embodiment of the present application is shown. The electronic device 500 may include a processor 510, a communication interface 520, a memory 530 and at least one communication bus 540. Among them, the communication bus 540 is used to realize the direct connection and communication of these components. Among them, the communication interface 520 in the embodiment of the present application is used to communicate signaling or data with other devices. The processor 510 can be an integrated circuit chip with signal processing capabilities. The above-mentioned processor 510 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The disclosed methods, steps and logic block diagrams in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor 510 can also be any conventional processor, etc.

[0096] The memory 530 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The memory 530 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 510, the electronic device 500 may execute the corresponding steps in the above method embodiment.

[0097] The electronic device 500 may further include a storage controller, an input / output unit, an audio unit, and a display unit.

[0098] The memory 530, storage controller, processor 510, peripheral interface, input / output unit, audio unit, and display unit are electrically connected to each other directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other via one or more communication buses 540. The processor 510 is used to execute the executable modules stored in the memory 530.

[0099] The input and output unit is used to provide input data to the user to realize the interaction between the user and the server (or local terminal). The input and output unit can be, but is not limited to, a mouse and a keyboard.

[0100] The audio unit provides an audio interface to the user and may include one or more microphones, one or more speakers, and audio circuitry.

[0101] The display unit provides an interactive interface (e.g., a user operation interface) between the electronic device and the user or is used to display image data for the user's reference. In this embodiment, the display unit may be a liquid crystal display or a touch display. If it is a touch display, it may be a capacitive touch screen or a resistive touch screen that supports single-point and multi-point touch operations. Supporting single-point and multi-point touch operations means that the touch display can sense touch operations generated simultaneously from one or more locations on the touch display, and the sensed touch operations are handed over to the processor for calculation and processing.

[0102] Understandably, Figure 5 The structure shown is for illustration only. The electronic device 500 may also include Figure 5 More or fewer components as shown, or with Figure 5 Different configurations are shown. Figure 5 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0103] The present application also provides a storage medium, on which a computer program is stored. When a processor runs the computer program, the method described in the method embodiment is executed.

[0104] The present application also provides a computer program product, which, when executed on a computer, enables the computer to execute the method described in the method embodiment.

[0105] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system described above can refer to the corresponding process in the aforementioned method, and will not be elaborated here.

[0106] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0107] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0108] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0109] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk. It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0110] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application. It should be noted that similar numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0111] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A database security protection method, characterized in that: The database security protection method is applied to a database firewall in a database security protection system, wherein the database security protection system includes a database, a target user device, an application server, an application server protection system, and the database firewall. The database security protection method includes: receiving a database access request sent by the application server; wherein the database access request carries target five-tuple information related to the target user equipment, and the target five-tuple information is five-tuple information of access data from the target user equipment to the application server; Detecting whether the database access request contains attack behavior; If it is determined that the database access request contains an attack behavior, extract the target five-tuple information from the database access request, and send the target five-tuple information to the application server protection system, so that the application server protection system blocks the target user device from accessing the database according to the target five-tuple information; The application server is configured to add the five-tuple information corresponding to the user equipment to the database access request during the process of generating the database access request.

2. The database security protection method according to claim 1, characterized in that: The database security protection method also includes: Attack tracing is performed based on the target quintuple information to obtain an attack tracing result.

3. A database security protection method, characterized in that: The database security protection method is applied to an application server protection system in a database security protection system, wherein the database security protection system includes a database, a target user device, an application server, a database firewall, and the application server protection system, and the database security protection method includes: Receive the target five-tuple information sent by the database firewall; wherein the target five-tuple information is extracted from the database access request by the database firewall when determining that the database access request has an attack behavior, and the target five-tuple information is five-tuple information of access data from the target user device to the application server; According to the target quintuple information, blocking the target user equipment from accessing the database; The application server is configured to add the five-tuple information corresponding to the user equipment to the database access request during the process of generating the database access request.

4. The database security protection method according to claim 3, characterized in that: The blocking of the target user equipment from accessing the database according to the target quintuple information includes: According to the target five-tuple information, searching for a session related to the target user equipment; The session related to the target user equipment is blocked.

5. A database security protection device, characterized in that: The database security protection device is applied to a database firewall in a database security protection system. The database security protection system includes a database, a target user device, an application server, an application server protection system and the database firewall. The database security protection device includes: A first receiving module, configured to receive a database access request sent by the application server; wherein the database access request carries target five-tuple information related to the target user equipment, and the target five-tuple information is five-tuple information of access data from the target user equipment to the application server; A detection module, used to detect whether the database access request contains attack behavior; A sending module, configured to extract the target five-tuple information from the database access request if it is determined that the database access request contains an attack behavior, and send the target five-tuple information to the application server protection system, so that the application server protection system blocks the target user device from accessing the database according to the target five-tuple information; The application server is configured to add the five-tuple information corresponding to the user equipment to the database access request during the process of generating the database access request.

6. The database security protection device according to claim 5, characterized in that: The database security protection device also includes: The attack tracing module is used to perform attack tracing based on the target quintuple information to obtain attack tracing results.

7. A database security protection device, characterized in that: The database security protection device is applied to the application server protection system in the database security protection system, the database security protection system includes a database, a target user device, an application server, a database firewall and the application server protection system, and the database security protection device includes: a second receiving module, configured to receive target five-tuple information sent by the database firewall; wherein the target five-tuple information is extracted from the database access request by the database firewall when determining that the database access request has attack behavior, and the target five-tuple information is five-tuple information of access data from the target user device to the application server; A blocking module, used to block the target user equipment from accessing the database according to the target quintuple information; The application server is configured to add the five-tuple information corresponding to the user equipment to the database access request during the process of generating the database access request.

8. The database security protection device according to claim 7, characterized in that: The blocking module is specifically used to: search for sessions related to the target user equipment according to the target quintuple information; and block sessions related to the target user equipment.

9. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the database security protection method according to any one of claims 1 to 4 is executed.

10. An electronic device, characterized in that: The electronic device comprises: a processor, a memory and a bus, the memory stores machine-readable instructions executable by the processor, when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the database security protection method as described in any one of claims 1-4 is executed.

11. A database security protection system, characterized in that: include: The target user device is used to send access data to the application server; The application server is used to receive the access data, extract target five-tuple information from the access data, generate a database access request according to the target five-tuple information, and send the database access request to the database firewall; The database firewall is used to receive the database access request, detect whether the database access request contains attack behavior, and if it is determined that the database access request contains attack behavior, extract the target five-tuple information from the database access request, and send the target five-tuple information to the application server protection system; The application server protection system is used to receive the target five-tuple information and block the target user equipment from accessing the database according to the target five-tuple information; The application server is configured to add the five-tuple information corresponding to the user equipment to the database access request during the process of generating the database access request.

Images