Intercepter-based auditing method and device, computer device and storage medium

Abstract

The application discloses an interceptor-based auditing method and device, computer equipment and a storage medium. The method comprises the following steps: when it is monitored that data of an application database is subjected to a change operation, data change information of the application database is acquired; an application identifier, a change operation type and data before and after the change are parsed from the data change information; the application identifier is used to represent application software to which the application database belongs; a change auditing table corresponding to the change operation type is acquired, and the application identifier and the data before and after the change are recorded in the change auditing table; and the application realizes standardized auditing of application databases of different application software.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to an auditing method, apparatus, computer equipment, and storage medium based on an interceptor. Background Technology

[0002] To maintain the secure operation of application software, staff need to record data changes in the application database and generate audit logs. These audit logs allow for security audits of the application database, enabling timely detection of various data changes and maintaining data security. However, due to the large number of existing application software types, and the different business logics used by different application databases to generate audit logs, the recording methods, data formats, and content specifications of the audit logs for each application database vary, introducing unnecessary complexity to the auditing work.

[0003] Therefore, how to standardize the auditing of application databases of different application software has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] The purpose of this invention is to provide an auditing method, apparatus, computer equipment, and storage medium based on interceptors, which enables standardized auditing of application databases of different application software.

[0005] According to one aspect of the present invention, an interceptor-based auditing method is provided, applied to an interceptor that interfaces with multiple application databases, the method comprising the following steps:

[0006] When a data change operation is detected in the application database, the data change information of the application database is obtained;

[0007] The application identifier, change operation type, and data before and after the change are obtained by parsing the data change information; wherein, the application identifier is used to identify the application software to which the application database belongs;

[0008] Obtain the change audit table corresponding to the change operation type, and record the application identifier and the data before and after the change in the change audit table.

[0009] Optionally, when a data change operation is detected in the application database, obtaining the data change information of the application database includes:

[0010] Establish a connection between a preset interface and each application database; wherein, the preset interface is an interface with added change annotations for monitoring whether data changes have occurred in the application database;

[0011] The data in each application database is monitored. When the application database undergoes data changes such as adding, deleting, or updating, the change statement is obtained through the preset interface.

[0012] The data change information is obtained by parsing the change statement.

[0013] Optionally, after recording the application identifier and the data before and after the change in the change audit table, the method further includes:

[0014] The user ID and data change time are parsed from the data change information, and the user ID and the data change time are recorded in the change audit table;

[0015] Based on a preset user permission table, determine whether the user ID has the permission to make data changes to the application database corresponding to the change operation type;

[0016] When the user ID does not have the permission to make the change, the audit data corresponding to the user ID in the change audit table is marked as sensitive audit data, and the sensitive audit data is sent to the audit component for auditing.

[0017] Optionally, after recording the application identifier and the data before and after the change in the change audit table, the method further includes:

[0018] Based on a preset time period, new audit data with a target application identifier in the change audit table are used to generate audit logs, and the target application identifier is used as a tag for the audit logs.

[0019] The audit logs are sent to the audit component so that the audit component can audit the audit logs.

[0020] Optionally, after recording the application identifier and the data before and after the change in the change audit table, the method further includes:

[0021] A hash algorithm is used to calculate the hash value of the data change information, and the hash value is used as the digest information of the data change information.

[0022] Obtain the audit data corresponding to the data change information from the change audit table;

[0023] The summary information and the audit data are stored in the blockchain cluster according to the blockchain storage rules.

[0024] To achieve the above objectives, the present invention also provides an apparatus for an interceptor-based auditing method, the apparatus specifically comprising the following components:

[0025] The acquisition module is used to acquire data change information of the application database when a data change operation is detected in the application database.

[0026] The parsing module is used to parse the application identifier, change operation type, and data before and after the change from the data change information; wherein, the application identifier is used to identify the application software to which the application database belongs;

[0027] The recording module is used to obtain the change audit table corresponding to the change operation type, and record the application identifier and the data before and after the change in the change audit table.

[0028] Optionally, the device is also used for:

[0029] Establish a connection between a preset interface and each application database; wherein, the preset interface is an interface with added change annotations for monitoring whether data changes have occurred in the application database;

[0030] The data in each application database is monitored. When the application database undergoes data changes such as adding, deleting, or updating, the change statement is obtained through the preset interface.

[0031] The data change information is obtained by parsing the change statement.

[0032] Optionally, the device is also used for:

[0033] The user ID and data change time are parsed from the data change information, and the user ID and the data change time are recorded in the change audit table;

[0034] Based on a preset user permission table, determine whether the user ID has the permission to make data changes to the application database corresponding to the change operation type;

[0035] When the user ID does not have the permission to make the change, the audit data corresponding to the user ID in the change audit table is marked as sensitive audit data, and the sensitive audit data is sent to the audit component for auditing.

[0036] To achieve the above objectives, the present invention also provides a computer device, which specifically includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the interceptor-based auditing method described above.

[0037] To achieve the above objectives, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the interceptor-based auditing method described above.

[0038] The interceptor-based auditing method, apparatus, computer equipment, and storage medium provided by this invention establish a connection between the interceptor and each application database. When a data change operation is detected in the application database, the interceptor intercepts and obtains the data change information, generates a uniformly formatted change audit table based on the data change information, and generates a uniformly formatted audit log based on the change audit table. This reduces the difficulty of auditing work for auditors. At the same time, due to the uniformity of the audit data format, the management efficiency of audit data by auditors is improved, and the audit difficulty is reduced. In addition, the audit component performs security audits of the application database regularly, which can monitor and discover the data status of the application database at any time, improving the data security and stability of the application database and enhancing the user experience. Attached Figure Description

[0039] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0040] Figure 1 A schematic diagram of an optional flow for the interceptor-based auditing method provided in Example 1;

[0041] Figure 2 A schematic diagram of an optional component structure for the interceptor-based auditing device provided in Example 2;

[0042] Figure 3 This is a schematic diagram of an optional hardware architecture for the computer device provided in Example 3. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0044] Example 1

[0045] This invention provides an interceptor-based auditing method, such as... Figure 1As shown, this method, applied to an interceptor that interfaces with multiple application databases, specifically includes the following steps:

[0046] Step S101: When a data change operation is detected in the application database, obtain the data change information of the application database.

[0047] The interceptor is a tool used to interface with the application databases of multiple application software programs. It intercepts SQL statements of preset change operation types through annotated interfaces. When a user performs operations such as adding, deleting, or modifying data in the application database, SQL statements are generated. The interceptor specifically intercepts these change-related SQL statements, obtains the data change information, and then uniformly records and manages the changes to the application database.

[0048] Preferably, the interceptor is a Mybatis interceptor.

[0049] Specifically, step S101 includes the following steps:

[0050] Step A1: Establish a connection between a preset interface and each application database; wherein, the preset interface is an interface with added change annotations for monitoring whether data changes have occurred in the application database.

[0051] Specifically, the preset interface is an interface for adding preset change annotations. These annotations are used to monitor whether data changes of a preset change operation type have occurred in the application database. The change annotations are manually set annotations used to intercept SQL statements that perform data change operations. The preset interface can transmit SQL statements that match the preset change annotations to the interceptor via the interface.

[0052] Step A2: Monitor the data in each application database. When the application database undergoes data changes such as adding, deleting, or updating, obtain the change statement through the preset interface.

[0053] The change statement is an SQL statement. After the interceptor obtains the change statement through the preset interface, it needs to parse the change statement to obtain the data change information that the interceptor can recognize and process.

[0054] Step A3: Parse the data change information from the change statement.

[0055] In this embodiment, the application database is the database corresponding to the application software. Since there are numerous types of existing application software, the types of application databases corresponding to each application software are also different. Furthermore, different people may set different auditing methods for different application databases. Therefore, when technicians want to audit application data, the recording method, data format, and content specifications of the audit logs will vary due to different auditing methods, adding unnecessary complexity to the auditing work. Therefore, in this embodiment, an external interceptor is connected to each application database. The interceptor intercepts the SQL statements generated by the application database due to data change operations, and then parses the SQL statements to record the audit data of the same change operation in the same change audit table, achieving a unified audit data format. In addition, since the interceptor establishes a connection with the application database through an interface, after a data change operation in the application database, the application database does not need to use its own original auditing method to record data change and generate audit logs. Instead, the interceptor obtains the change data information, avoiding intrusion into the application database to query audit logs. This solves the pain point of the strong intrusiveness of the original application database's audit logs and improves the stability and security of the application database.

[0056] Step S102: Parse the application identifier, change operation type, and data before and after the change from the data change information; wherein, the application identifier is used to characterize the application software to which the application database belongs.

[0057] Specifically, since the interceptor connects to multiple application databases, the application identifier is the application software to which the application database belongs, and the change operation types include: adding, deleting, or updating.

[0058] When the change operation type is "add", the data before the change is zero, and the data after the change is the newly added field value obtained from the data change information; when the change operation type is "delete", the data before the change is the field value obtained from the data change information, and the data after the change is zero; when the change operation type is "update", the data before the change is the field value before the change obtained from the data change information, and the data after the change is the modified field value obtained from the data change information.

[0059] In this embodiment, a separate change audit table is preset for each type of change operation, such as an add audit table, a delete audit table, and an update audit table. The added data, deleted data, and data before and after updates in the data change information of different application databases are recorded in the corresponding change audit table for the change operation type. The application identifier is used as the identifier for the data before and after the change, ensuring that the audit data for all application databases is in the same format, so as to generate audit logs for the audit component to perform auditing.

[0060] Step S103: Obtain the change audit table corresponding to the change operation type, and record the application identifier and the data before and after the change in the change audit table.

[0061] Furthermore, after step S103, the method further includes the following steps:

[0062] Step B1: Parse the user ID and data change time from the data change information, and record the user ID and data change time in the change audit table.

[0063] The user ID is used to identify the user who logs into the application database and performs data change operations, and the data change time is the timestamp in the SQL statement intercepted by the interceptor. Recording the user ID and data change time in the change audit table helps to trace and manage user change operations.

[0064] Step B2: Based on the preset user permission table, determine whether the user ID has the permission to make data changes to the application database corresponding to the change operation type.

[0065] Since some application databases are at risk of database intrusion, by identifying the change permissions of users logging into the application database, change operations by unauthorized users are marked as sensitive audit data for timely processing, reducing the risk of application database intrusion. It also allows for timely tracing of users who generate sensitive audit data and interception of their subsequent change operations.

[0066] Step B3: When the user ID does not have the change permission, mark the audit data corresponding to the user ID in the change audit table as sensitive audit data, and send the sensitive audit data to the audit component for auditing.

[0067] Furthermore, after step S103, the method further includes the following steps:

[0068] Step C1: Based on a preset time period, generate audit logs from the newly added audit data with the target application identifier in the change audit table, and use the target application identifier as the tag of the audit logs.

[0069] The audit log is used to record data change operations that occur in the application database of the target application software within a preset time period, and to analyze and organize the audit data generated in the audit data table for auditing by the audit component to maintain the security of the application database.

[0070] In addition to the preset time period, a preset number of new audit entries can be set according to the characteristics of the application software. When the number of new entries with the target application identifier in the audit data table reaches the preset number, the newly added audit data is used to generate an audit log for the audit component to audit the audit log. No specific limitations are made in this embodiment.

[0071] Step C2: Send the audit log to the audit component so that the audit component can audit the audit log.

[0072] Furthermore, after step S103, the method further includes the following steps:

[0073] Step D1: Calculate the hash value of the data change information using a hash algorithm, and use the hash value as the digest information of the data change information.

[0074] Preferably, the hash algorithm includes one or more of the following algorithms: MD5 encryption algorithm, SHA encryption algorithm, and HMAC encryption algorithm.

[0075] Step D2: Obtain the audit data corresponding to the data change information from the change audit table.

[0076] Step D3: Store the summary information and the audit data in the blockchain cluster according to the blockchain storage rules.

[0077] In this embodiment, by establishing a connection between the interceptor and each application database, when a data change operation is detected in the application database, the interceptor intercepts and obtains the data change information. Based on the data change information, a uniformly formatted change audit table is generated, and a uniformly formatted audit log is generated according to the change audit table. This reduces the difficulty of the audit work for auditors. At the same time, due to the uniformity of the audit data format, the management efficiency of audit data is improved, and the audit difficulty is reduced. The audit component performs security audits of the application database regularly, which can monitor and discover the data status of the application database at any time. When a sensitive change operation is detected, the user ID and data change time in the change audit table can be queried in a timely manner to trace the user who performed the sensitive change operation, improve the efficiency of security prevention, enhance the data security and stability of the application database, and improve the user experience. At the same time, the audit data in the change audit table is uploaded to the blockchain, which improves the capacity of audit data, so as to view and store audit data in a timely manner.

[0078] Example 2

[0079] Based on the interceptor-based auditing method provided in Embodiment 1 above, this embodiment provides an interceptor-based auditing device, specifically, Figure 2An optional structural block diagram of the interceptor-based auditing device is shown. This device is divided into one or more program modules, which are stored in a storage medium and executed by one or more processors to complete the present invention. The program module, as referred to in this invention, is a series of computer program instruction segments capable of performing a specific function. It is more suitable than the program itself for describing the execution process of the interceptor-based auditing device in the storage medium. The following description will specifically introduce the functions of each program module in this embodiment.

[0080] like Figure 2 As shown, the interceptor-based auditing device specifically includes the following components:

[0081] The acquisition module 201 is used to acquire the data change information of the application database when a data change operation is detected in the application database;

[0082] The parsing module 202 is used to parse the application identifier, change operation type, and data before and after the change from the data change information; wherein, the application identifier is used to characterize the application software to which the application database belongs;

[0083] The recording module 203 is used to obtain a change audit table corresponding to the change operation type, and record the application identifier and the data before and after the change in the change audit table.

[0084] Specifically, the acquisition module 201 is further configured to:

[0085] Establish a connection between a preset interface and each application database; wherein, the preset interface is an interface with added change annotations for monitoring whether data changes have occurred in the application database;

[0086] The data in each application database is monitored. When the application database undergoes data changes such as adding, deleting, or updating, the change statement is obtained through the preset interface.

[0087] The data change information is obtained by parsing the change statement.

[0088] Furthermore, the device also includes:

[0089] The user ID and data change time are parsed from the data change information, and the user ID and the data change time are recorded in the change audit table;

[0090] Based on a preset user permission table, determine whether the user ID has the permission to make data changes to the application database corresponding to the change operation type;

[0091] When the user ID does not have the permission to make the change, the audit data corresponding to the user ID in the change audit table is marked as sensitive audit data, and the sensitive audit data is sent to the audit component for auditing.

[0092] In addition, the device also includes:

[0093] Based on a preset time period, new audit data with a target application identifier in the change audit table are used to generate audit logs, and the target application identifier is used as a tag for the audit logs.

[0094] The audit logs are sent to the audit component so that the audit component can audit the audit logs.

[0095] Furthermore, the device also includes:

[0096] A hash algorithm is used to calculate the hash value of the data change information, and the hash value is used as the digest information of the data change information.

[0097] Obtain the audit data corresponding to the data change information from the change audit table;

[0098] The summary information and the audit data are stored in the blockchain cluster according to the blockchain storage rules.

[0099] Example 3

[0100] This embodiment also provides a computer device, such as a smartphone, tablet computer, laptop computer, desktop computer, rack server, blade server, tower server, or cabinet server (including a standalone server or a server cluster composed of multiple servers), etc., capable of executing programs. Figure 3 As shown, the computer device 30 in this embodiment includes, but is not limited to, a memory 301 and a processor 302 that are communicatively connected to each other via a system bus. It should be noted that... Figure 3 Only a computer device 30 with components 301-302 is shown; however, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0101] In this embodiment, the memory 301 (i.e., the readable storage medium) includes flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 301 may be an internal storage unit of the computer device 30, such as the hard disk or memory of the computer device 30. In other embodiments, the memory 301 may also be an external storage device of the computer device 30, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 30. Of course, the memory 301 may include both the internal storage unit and the external storage device of the computer device 30. In this embodiment, the memory 301 is typically used to store the operating system and various application software installed on the computer device 30. In addition, the memory 301 may also be used to temporarily store various types of data that have been output or will be output.

[0102] In some embodiments, processor 302 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. This processor 302 is typically used to control the overall operation of computer device 30.

[0103] Specifically, in this embodiment, the processor 302 is used to execute a program of an interceptor-based auditing method stored in the memory 301. When the program of the interceptor-based auditing method is executed, it performs the following steps:

[0104] When a data change operation is detected in the application database, the data change information of the application database is obtained;

[0105] The application identifier, change operation type, and data before and after the change are obtained by parsing the data change information; wherein, the application identifier is used to identify the application software to which the application database belongs;

[0106] Obtain the change audit table corresponding to the change operation type, and record the application identifier and the data before and after the change in the change audit table.

[0107] For a detailed description of the above method steps, please refer to Example 1. This example will not be repeated here.

[0108] Example 4

[0109] This embodiment also provides a computer-readable storage medium, such as flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, server, app store, etc., which stores a computer program. When the computer program is executed by a processor, it implements the following method steps:

[0110] When a data change operation is detected in the application database, the data change information of the application database is obtained;

[0111] The application identifier, change operation type, and data before and after the change are obtained by parsing the data change information; wherein, the application identifier is used to identify the application software to which the application database belongs;

[0112] Obtain the change audit table corresponding to the change operation type, and record the application identifier and the data before and after the change in the change audit table.

[0113] For a detailed description of the above method steps, please refer to Example 1. This example will not be repeated here.

[0114] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0115] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0116] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0117] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. An interceptor-based auditing method, characterized by, The method applied to an interceptor for docking multiple application databases, the method comprises: When a data change operation of an application database is monitored, data change information of the application database is acquired; An application identifier, a change operation type, and data before and after the change are parsed from the data change information; wherein the application identifier is used to represent an application software to which the application database belongs; A change audit table corresponding to the change operation type is acquired, and the application identifier and the data before and after the change are recorded in the change audit table; Wherein, when the data change operation of the application database is monitored, the data change information of the application database is acquired, comprising: A connection between a preset interface and each application database is established; wherein the preset interface is an interface to which a change annotation for monitoring whether data change of the application database occurs is added; The data of each application database is monitored, and when the application database has a data change of a change operation type of adding, deleting, or updating, a change statement is acquired through the preset interface; The data change information is parsed from the change statement.

2. The interceptor-based auditing method of claim 1, wherein, After the application identifier and the data before and after the change are recorded in the change audit table, the method further comprises: A user ID and a data change time are parsed from the data change information, and the user ID and the data change time are recorded in the change audit table; Based on a preset user permission table, it is judged whether the user ID has a change permission of performing a data change corresponding to the change operation type on the application database; When the user ID does not have the change permission, audit data corresponding to the user ID in the change audit table is marked as sensitive audit data, and the sensitive audit data is sent to an audit component for auditing.

3. The interceptor-based auditing method of claim 2, wherein, After the application identifier and the data before and after the change are recorded in the change audit table, the method further comprises: Based on a preset time period, audit data with a target application identifier added in the change audit table is generated as an audit log, and the target application identifier is taken as a label of the audit log; The audit log is sent to the audit component, so that the audit component audits the audit log.

4. The interceptor-based auditing method of claim 1, wherein, After the application identifier and the data before and after the change are recorded in the change audit table, the method further comprises: A hash value of the data change information is calculated by using a hash algorithm, and the hash value is taken as digest information of the data change information; Audit data corresponding to the data change information is acquired from the change audit table; The digest information and the audit data are stored into a blockchain cluster according to a blockchain storage rule.

5. An interceptor-based auditing apparatus, characterized by: The device comprises: An acquisition module for acquiring data change information of an application database when a data change operation of the application database is monitored; An analysis module for parsing an application identifier, a change operation type, and data before and after the change from the data change information; wherein the application identifier is used to represent an application software to which the application database belongs; A recording module is configured to acquire a change audit table corresponding to the change operation type, and record the application identifier and the data before and after the change in the change audit table; The apparatus is further configured to: establish a connection between a preset interface and each application database, wherein the preset interface is an interface to which a change note for monitoring whether data change occurs in the application database is added; monitor the data of each application database, and acquire a change statement through the preset interface when the application database has data change of a change operation type of addition, deletion, or update; parse the data change information from the change statement.

6. The interceptor-based auditing apparatus of claim 5, wherein, The apparatus is further configured to: parse a user ID and a data change time from the data change information, and record the user ID and the data change time in the change audit table; determine whether the user ID has a change permission to perform data change corresponding to the change operation type on the application database based on a preset user permission table; when the user ID does not have the change permission, mark audit data corresponding to the user ID in the change audit table as sensitive audit data, and send the sensitive audit data to an audit component for auditing.

7. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method in any one of claims 1 to 4 when executing the computer program.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 4.

Images