A timing database auditing method and system
By decomposing and extracting features from the mirrored data traffic of the time-series database, and using the field attribute mapping of the relational database to generate audit event logs, the problem of wasted audit fields in the time-series database is solved, achieving more efficient security and more accurate audit results.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING TOPSEC NETWORK SECURITY TECH
- Filing Date
- 2023-01-09
- Publication Date
- 2026-05-29
AI Technical Summary
Existing auditing systems require the design of dedicated audit fields for time-series databases, resulting in wasted fields.
By acquiring mirrored data traffic from client access to the time-series database, we can disassemble application-layer data information, extract features, determine data parsing rules, and use the field attributes of relational databases for mapping and concatenation to generate audit event logs, thus avoiding the need to design dedicated audit fields for time-series databases.
It improves the utilization rate of audit fields, reduces field waste, enhances the security of time-series database systems, and makes audit results more accurate.
Smart Images
Figure CN116010480B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and more specifically, to a time-series database auditing method and system. Background Technology
[0002] In the era of the Internet of Things (IoT), the amount of data generated by the Industrial Internet of Things (IIoT) is thousands or even tens of thousands of times greater than that of traditional information systems. This data is collected in real-time, at high frequency and density, and its dynamic data model is constantly changing. Traditional databases struggle to handle the storage, querying, and analysis of this data, creating an urgent need for a database system specifically optimized for time-series data.
[0003] Currently, research on database security mainly focuses on security aspects such as database design, strategies, and auditing, and the research results and technological applications are quite mature. However, due to the complexity of technology and the diversity of real-world business scenarios, database designs are constantly evolving. Therefore, the need for database auditing systems to analyze new database protocols is particularly important.
[0004] Although time-series databases have only recently gained widespread attention, their rapid expansion due to their broad application areas is a significant challenge. Most time-series databases were not designed with security as a primary focus. Users must rely on third-party tools or services to protect their data. However, existing auditing systems require the design of audit fields specifically for time-series databases, resulting in wasted audit fields. Summary of the Invention
[0005] The purpose of this application is to provide a time-series database auditing method and system to solve the problem that existing auditing systems need to design audit fields specifically for time-series databases, resulting in wasted fields.
[0006] This application provides a time-series database auditing method, including:
[0007] Obtain the mirrored data traffic of the client accessing the time-series database and decompose it to obtain application layer data information;
[0008] Feature extraction is performed on application layer data information to obtain the specified client connection tool, time series database protocol version, time series data compression method, and field attributes of the time series database;
[0009] The data parsing rules for the time series database are determined based on the client connection tool, the time series database protocol version, and the time series data compression method.
[0010] Data parsing rules are used to parse application layer data to obtain parsing results;
[0011] Obtain the mapping relationship between the field attributes of the time-series database and the field attributes of the relational database. Based on the mapping relationship, fill the parsed results into the corresponding field attributes of the relational database and concatenate them to obtain the audit event log.
[0012] In the above technical solution, by acquiring the mirrored data traffic of the client accessing the time-series database, the mirrored data traffic is decomposed into application-layer data information. Then, information such as the client connection tool, time-series database protocol version, and time-series data compression method used to determine the data parsing rules are extracted from the application-layer data information. Based on this information, the data parsing rules are determined, and the application-layer data information is parsed using the data parsing rules to obtain the parsing results. After mapping the field attributes of the time-series database in the parsing results to the corresponding field attributes of the relational database, they are concatenated to obtain the audit event log. Therefore, there is no need to design audit fields specifically for the time-series database. Instead, the field functions of the relational database can be reused, which improves the utilization rate of audit fields and avoids the waste of fields caused by designing more fields in the audit system. In this embodiment, the field attributes of the time-series database and the field data of the relational database are linked, which also facilitates the subsequent analysis and querying by the database administrator, reduces the situation of field confusion, and makes the audit results more accurate.
[0013] In some alternative implementations, the mirrored data traffic includes: operation data for accessing the time-series database, and response data returned by the time-series database.
[0014] In the above technical solution, the data traffic generated by the client accessing the time-series database includes the data of operations such as adding, deleting, modifying, and querying data performed by the client on the time-series database, as well as the response data returned by the time-series database to the client in response to the operation data. Therefore, the mirrored data traffic obtained in this embodiment also includes the operation data of accessing the time-series database and the response data returned by the time-series database.
[0015] In some alternative implementations, the parsed result includes at least one of the following: table name, operation type, data operation, and result set.
[0016] In some alternative implementations, the mapping relationship includes at least one of the following:
[0017] The metric fields in a time-series database are associated with the table fields in a relational database;
[0018] In a time-series database, the data point field is associated with the row field in a relational database;
[0019] In time-series databases, the field values are associated with the column fields in relational databases;
[0020] In time-series databases, the timestamp field is associated with the row primary key field in relational databases;
[0021] The label field in a time-series database is associated with the index field in a relational database;
[0022] In a time-series database, buckets or organizations are associated with the username field in a relational database.
[0023] In the above technical solutions, time series databases (such as InfluxDB time series databases) refer to data that records system and device changes in chronological order. Time series databases have the following time series dimensions:
[0024] Measurement / Metric: A metric that is associated with a table in a relational database;
[0025] Data point: A data point that is associated with a row in a relational database;
[0026] value / field: Field value, which is associated with a column in a relational database;
[0027] Timestamp: A unique identifier for a time series, which is associated with the row primary key in a relational database;
[0028] tag: A label that is associated with an index in a relational database;
[0029] bucket / organization: A bucket / organization is a user. An organization can have multiple buckets, which are associated with usernames in a relational database.
[0030] This application provides a time-series database auditing system, comprising:
[0031] The disassembly module is used to obtain the mirrored data traffic of the client accessing the time-series database and disassemble it to obtain application layer data information.
[0032] The feature extraction module is used to extract features from application layer data information to obtain the specified client connection tool, time series database protocol version, time series data compression method, and field attributes of the time series database.
[0033] The rule determination module is used to determine the data parsing rules of the time series database based on the client connection tool, the time series database protocol version, and the time series data compression method.
[0034] The parsing module is used to parse application layer data information using data parsing rules to obtain the parsing results;
[0035] The conversion module is used to obtain the mapping relationship between the field attributes of the time series database and the field attributes of the relational database. Based on the mapping relationship, the parsed results are filled into the corresponding field attributes of the relational database and concatenated to obtain the audit event log.
[0036] In the above technical solution, the audit system audits the entire process of all user access to the database using a bypass monitoring method. This includes: using a disassembly module to obtain mirrored data traffic from client access to the time-series database and disassembling the mirrored data traffic to extract application-layer data information; using a feature extraction module to extract information such as the client connection tool, time-series database protocol version, and time-series data compression method from the application-layer data information to determine data parsing rules; using a rule determination module to determine data parsing rules based on information such as the client connection tool, time-series database protocol version, and time-series data compression method; using a parsing module to parse the application-layer data information according to the data parsing rules to obtain the parsing results; and using a conversion module to map the field attributes of the time-series database in the parsing results to the corresponding field attributes of the relational database, and then concatenating them to obtain the audit event log. The auditing system in this embodiment monitors and audits database access operations, enhancing the security of the time-series database system. Furthermore, it eliminates the need to design audit fields specifically for time-series databases; instead, it utilizes the field reuse functionality of relational databases, improving the utilization rate of audit fields and avoiding the waste caused by designing more fields in the auditing system. Linking the field attributes of the time-series database with the field data of the relational database also facilitates subsequent analysis and querying by database administrators, reduces field confusion, and makes the audit results more accurate.
[0037] In some alternative implementations, the mirrored data traffic includes: operation data for accessing the time-series database, and response data returned by the time-series database.
[0038] In some alternative implementations, the parsed result includes at least one of the following: table name, operation type, data operation, and result set.
[0039] In some alternative implementations, the mapping relationship includes at least one of the following:
[0040] The metric fields in a time-series database are associated with the table fields in a relational database;
[0041] In a time-series database, the data point field is associated with the row field in a relational database;
[0042] In time-series databases, the field values are associated with the column fields in relational databases;
[0043] In time-series databases, the timestamp field is associated with the row primary key field in relational databases;
[0044] The label field in a time-series database is associated with the index field in a relational database;
[0045] In a time-series database, buckets or organizations are associated with the username field in a relational database.
[0046] An electronic device provided in this application includes a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and the machine-readable instructions, when executed by the processor, perform any of the methods described above.
[0047] This application provides a computer-readable storage medium storing a computer program, which is executed by a processor as described above. Attached Figure Description
[0048] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0049] Figure 1 A flowchart illustrating the steps of a time-series database auditing method provided in this application embodiment;
[0050] Figure 2 A schematic diagram of the network model of the audit system for bypass monitoring provided in this application embodiment;
[0051] Figure 3 A functional module diagram of a time-series database auditing system provided in this application embodiment;
[0052] Figure 4 A functional block diagram of an auditing system provided in another embodiment of this application;
[0053] Figure 5 This is a schematic diagram of a possible structure of an electronic device provided in an embodiment of this application.
[0054] Icons: 1-Disassembly module, 2-Feature extraction module, 3-Rule determination module, 4-Parsing module, 5-Conversion module, 61-Processor, 62-Memory, 63-Communication interface, 64-Communication bus. Detailed Implementation
[0055] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.
[0056] Please refer to Figure 1 , Figure 1 A flowchart of a time-series database auditing method provided in this application embodiment specifically includes:
[0057] Step 100: Obtain the mirrored data traffic of the client accessing the time-series database and decompose it to obtain application layer data information;
[0058] Step 200: Extract features from the application layer data information to obtain the specified client connection tool, time series database protocol version, time series data compression method, and field attributes of the time series database;
[0059] Step 300: Determine the data parsing rules for the time series database based on the client connection tool, the time series database protocol version, and the time series data compression method;
[0060] Step 400: Use data parsing rules to parse the application layer data information and obtain the parsing results;
[0061] Step 500: Obtain the mapping relationship between the field attributes of the time series database and the field attributes of the relational database. Based on the mapping relationship, fill the parsing results into the corresponding field attributes of the relational database and concatenate them to obtain the audit event log.
[0062] In the above technical solution, by acquiring the mirrored data traffic of the client accessing the time-series database, the mirrored data traffic is decomposed into application-layer data information. Then, information such as the client connection tool, time-series database protocol version, and time-series data compression method used to determine the data parsing rules are extracted from the application-layer data information. Based on this information, the data parsing rules are determined, and the application-layer data information is parsed using the data parsing rules to obtain the parsing results. After mapping the field attributes of the time-series database in the parsing results to the corresponding field attributes of the relational database, they are concatenated to obtain the audit event log. Therefore, there is no need to design audit fields specifically for the time-series database. Instead, the field functions of the relational database can be reused, which improves the utilization rate of audit fields and avoids the waste of fields caused by designing more fields in the audit system. In this embodiment, the field attributes of the time-series database and the field data of the relational database are linked, which also facilitates the subsequent analysis and querying by the database administrator, reduces the situation of field confusion, and makes the audit results more accurate.
[0063] In some optional implementations, the mirrored data traffic includes: operation data for accessing the time-series database and response data returned by the time-series database. In this embodiment, the data traffic generated by the client accessing the time-series database includes CRUD operations such as adding, deleting, modifying, and querying data from the client's access to the time-series database, as well as response data returned by the time-series database to the client in response to these operations. Therefore, the mirrored data traffic obtained in this embodiment also includes operation data for accessing the time-series database and response data returned by the time-series database.
[0064] In some alternative implementations, the parsed result includes at least one of the following: table name, operation type, data operation, and result set.
[0065] In some optional implementations, the mapping relationship includes at least one of the following: a metric field of the time-series database is associated with a table field of the relational database; a data point field of the time-series database is associated with a row field of the relational database; a domain value field of the time-series database is associated with a column field of the relational database; a timestamp field of the time-series database is associated with a row primary key field of the relational database; a label field of the time-series database is associated with an index field of the relational database; and a bucket or organization of the time-series database is associated with a username field of the relational database.
[0066] In this embodiment of the application, time series data refers to data that records system and device changes in chronological order. The time series database has the following time series dimensions:
[0067] Measurement / Metric: A metric that is associated with a table in a relational database;
[0068] Data point: A data point that is associated with a row in a relational database;
[0069] value / field: Field value, which is associated with a column in a relational database;
[0070] Timestamp: A unique identifier for a time series, which is associated with the row primary key in a relational database;
[0071] tag: A label that is associated with an index in a relational database;
[0072] bucket / organization: A bucket / organization is a user. An organization can have multiple buckets, which are associated with usernames in a relational database.
[0073] Another embodiment of this application provides a time-series database auditing system, which implements a bypass monitoring auditing system. The network model of the bypass monitoring auditing system is as follows: Figure 2 As shown.
[0074] Time-series databases differ significantly from traditional databases in table structure and key field design. Adding new field types each time results in a significant waste of existing audit field types. Therefore, it is necessary to reuse relational database types of fields as much as possible to improve field utilization, categorize fields based on similar functions, and establish connections with traditional relational databases based on field attributes and table structure to reduce the complexity of the audit system's table structure by adding new field types.
[0075] Specifically, please refer to Figure 3 , Figure 3 The functional module diagram of a time-series database auditing system provided in this application embodiment specifically includes a decomposition module 1, a feature extraction module 2, a rule determination module 3, a parsing module 4, and a conversion module 5.
[0076] The system comprises the following modules: Decomposition Module 1, which acquires mirrored data traffic from client access to the time-series database and decomposes it to obtain application-layer data information; Feature Extraction Module 2, which extracts features from the application-layer data information to obtain the specified client connection tool, time-series database protocol version, time-series data compression method, and time-series database field attributes; Rule Determination Module 3, which determines the data parsing rules for the time-series database based on the client connection tool, time-series database protocol version, and time-series data compression method; Parsing Module 4, which uses the data parsing rules to parse the application-layer data information and obtain the parsing results; and Transformation Module 5, which obtains the mapping relationship between the field attributes of the time-series database and the field attributes of the relational database, fills the parsing results into the corresponding field attributes of the relational database according to the mapping relationship, and concatenates them to obtain the audit event log.
[0077] In this embodiment, the auditing system audits the entire process of all user access to the database using a bypass monitoring method. This includes: using a disassembly module to obtain mirrored data traffic from client access to the time-series database and disassembling the mirrored data traffic to extract application-layer data information; using a feature extraction module to extract information from the application-layer data information, such as the client connection tool, time-series database protocol version, and time-series data compression method, used to determine data parsing rules; using a rule determination module to determine data parsing rules based on the client connection tool, time-series database protocol version, and time-series data compression method; using a parsing module to parse the application-layer data information according to the data parsing rules to obtain parsing results; and using a conversion module to map the field attributes of the time-series database in the parsing results to the corresponding field attributes of the relational database, and then concatenating them to obtain the audit event log. The auditing system in this embodiment monitors and audits database access operations, enhancing the security of the time-series database system. Furthermore, it eliminates the need to design audit fields specifically for time-series databases; instead, it utilizes the field reuse functionality of relational databases, improving the utilization rate of audit fields and avoiding the waste caused by designing more fields in the auditing system. Linking the field attributes of the time-series database with the field data of the relational database also facilitates subsequent analysis and querying by database administrators, reduces field confusion, and makes the audit results more accurate.
[0078] In some alternative implementations, the mirrored data traffic includes: operation data for accessing the time-series database, and response data returned by the time-series database.
[0079] In some alternative implementations, the parsed result includes at least one of the following: table name, operation type, data operation, and result set.
[0080] In some optional implementations, the mapping relationship includes at least one of the following: a metric field of the time-series database is associated with a table field of the relational database; a data point field of the time-series database is associated with a row field of the relational database; a domain value field of the time-series database is associated with a column field of the relational database; a timestamp field of the time-series database is associated with a row primary key field of the relational database; a label field of the time-series database is associated with an index field of the relational database; and a bucket or organization of the time-series database is associated with a username field of the relational database.
[0081] Please refer to Figure 4 , Figure 4This is a functional block diagram of an auditing system provided in another embodiment of this application. A time-series data processing module is added to the auditing system to parse the interactive data of the time-series database and perform security auditing, thereby improving the security capabilities of the time-series database. The time-series data processing module includes the decomposition module, feature extraction module, rule determination module, parsing module, and conversion module described in the above embodiments.
[0082] Time-series data acquisition module: It obtains mirrored data traffic accessing the database from the switch through network configuration and system interface, and performs preliminary filtering based on connection integrity and retransmitted data.
[0083] Time-series data processing module: This module performs protocol identification and time-series data parsing for time-series database protocols. Protocol identification distinguishes data traffic information based on the characteristic rules of the time-series database protocol before passing it to the data parsing module for processing. Data parsing involves decapsulating the acquired data packets. After decapsulation to the application layer, the data packets are analyzed in a targeted manner using the protocol parsing rules of the time-series database. Subsequently, the parsed data fields are correlated and integrated with relational database fields to form events, and then the event logs are sent to the next module for processing.
[0084] The strategy matching module provides users with an interface to set data parsing rules and applies these rules to the data analysis process. Data analysis refers to analyzing the parsed SQL statements according to pre-set data parsing rules, recording the date, time, type, and results of operation events, generating reports for administrators to use for evidence collection, querying, analysis, and issuing alerts for dangerous data.
[0085] Data storage module: Stores the event information results after data analysis and processing in the database for administrators to retrieve.
[0086] The system management module provides users with a visual interface, allowing them to easily set data parsing rules and configure the system. Auditors can use the management system to set audit strategies and query audit results.
[0087] Figure 5 This illustration shows a possible structure of an electronic device provided in an embodiment of this application. (Refer to...) Figure 5 The electronic device includes a processor 61, a memory 62, and a communication interface 63, which are interconnected and communicate with each other via a communication bus 64 and / or other forms of connection mechanism (not shown).
[0088] The memory 62 includes one or more (only one is shown in the figure), which may be, but is not limited to, Random Access Memory (RAM), Read Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), etc. The processor 61 and other possible components may access the memory 62 to read and / or write data therein.
[0089] Processor 61 includes one or more (only one is shown in the figure), which can be an integrated circuit chip with signal processing capabilities. The processor 61 can be a general-purpose processor, including a Central Processing Unit (CPU), a Microcontroller Unit (MCU), a Network Processor (NP), or other conventional processors; it can also be a special-purpose processor, including a Neural-network Processing Unit (NPU), a Graphics Processing Unit (GPU), a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. Furthermore, when there are multiple processors 61, some can be general-purpose processors and others can be special-purpose processors.
[0090] Communication interface 63 includes one or more (only one is shown in the figure) that can be used to communicate directly or indirectly with other devices for data exchange. Communication interface 63 may include interfaces for wired and / or wireless communication.
[0091] One or more computer program instructions may be stored in memory 62, and processor 61 may read and execute these computer program instructions to implement the methods provided in the embodiments of this application.
[0092] Understandable. Figure 5 The structure shown is for illustrative purposes only; the electronic device may also include structures that are more complex than those shown. Figure 5 The more or fewer components shown, or having the same Figure 5 The different structures shown. Figure 5 The components shown can be implemented using hardware, software, or a combination thereof. Electronic devices may be physical devices, such as PCs, laptops, tablets, mobile phones, servers, embedded devices, etc., or they may be virtual devices, such as virtual machines, virtualized containers, etc. Furthermore, electronic devices are not limited to a single device; they can also be a combination of multiple devices or a cluster of a large number of devices.
[0093] This application also provides a computer-readable storage medium storing computer program instructions. These computer program instructions are read and executed by a computer's processor to perform the method provided in this application. For example, the computer-readable storage medium can be implemented as follows: Figure 5 Memory 62 in electronic devices.
[0094] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.
[0095] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0096] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.
[0097] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.
[0098] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.
Claims
1. A time-series database auditing method, characterized in that, include: Obtain the mirrored data traffic of the client accessing the time-series database and decompose it to obtain application layer data information; Feature extraction is performed on the application layer data information to obtain the specified client connection tool, time series database protocol version, time series data compression method, and field attributes of the time series database; Based on the client connection tool, time series database protocol version, and time series data compression method, determine the data parsing rules for the time series database; The data parsing rules are used to parse the application layer data information to obtain the parsing results; Obtain the mapping relationship between the field attributes of the time series database and the field attributes of the relational database. Based on the mapping relationship, fill the parsing results into the corresponding field attributes of the relational database and concatenate them to obtain the audit event log. The mapping relationship includes at least one of the following: The metric fields in a time-series database are associated with the table fields in a relational database; In a time-series database, the data point field is associated with the row field in a relational database; In time-series databases, the field values are associated with the column fields in relational databases; In time-series databases, the timestamp field is associated with the row primary key field in relational databases; The label field in a time-series database is associated with the index field in a relational database; In a time-series database, buckets or organizations are associated with the username field in a relational database.
2. The method as described in claim 1, characterized in that, in, The mirrored data traffic includes: operation data for accessing the time-series database, and response data returned by the time-series database.
3. The method as described in claim 1, characterized in that, in, The parsing result includes at least one of the following: table name, operation type, data operation, and result set.
4. A time-series database auditing system, characterized in that, include: The disassembly module is used to obtain the mirrored data traffic of the client accessing the time-series database and disassemble it to obtain application layer data information. The feature extraction module is used to extract features from the application layer data information to obtain the specified client connection tool, time series database protocol version, time series data compression method, and field attributes of the time series database. The rule determination module is used to determine the data parsing rules of the time series database based on the client connection tool, the time series database protocol version, and the time series data compression method. The parsing module is used to parse application layer data information using the data parsing rules to obtain the parsing results; The conversion module is used to obtain the mapping relationship between the field attributes of the time series database and the field attributes of the relational database. Based on the mapping relationship, the parsing results are filled into the corresponding field attributes of the relational database and concatenated to obtain the audit event log. The mapping relationship includes at least one of the following: The metric fields in a time-series database are associated with the table fields in a relational database; In a time-series database, the data point field is associated with the row field in a relational database; In time-series databases, the field values are associated with the column fields in relational databases; In time-series databases, the timestamp field is associated with the row primary key field in relational databases; The label field in a time-series database is associated with the index field in a relational database; In a time-series database, buckets or organizations are associated with the username field in a relational database.
5. The system as described in claim 4, characterized in that, in, The mirrored data traffic includes: operation data for accessing the time-series database, and response data returned by the time-series database.
6. The system as described in claim 4, characterized in that, in, The parsing result includes at least one of the following: table name, operation type, data operation, and result set.
7. An electronic device, characterized in that, include: A processor and a memory, the memory storing machine-readable instructions executable by the processor, which, when executed by the processor, perform the method as described in any one of claims 1-3.
8. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that is executed by a processor to perform the method as described in any one of claims 1-3.