A database flow auditing processing method and system under a multi-database service end

Abstract

The application discloses a database flow auditing processing method and system under a multi-database server side, and the method comprises the following steps: acquiring the type of each database of all databases installed on a server; acquiring the characteristic information and port number of each database according to the type of each database; writing the characteristic information and port number of each database into a file respectively; taking the file corresponding to the characteristic information and port number of each database as a file loaded when a plug-in is started, and the plug-in is used to acquire the database flow between a database client and a file corresponding database server, and the database flow is used for database auditing. The application solves the problem that the plug-in installed on the database client cannot be distinguished in the case that different database server sides are installed on a server or multiple database instances exist, thereby affecting the database auditing, and ensures the smooth progress of the database auditing.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of databases, and in particular, to a database traffic auditing processing method and system under a multi-database server. BACKGROUND

[0002] Database auditing (DBAudit for short) is centered on security events, based on comprehensive auditing and accurate auditing, records database activities on the network in real time, performs fine-grained auditing compliance management on database operations, and performs real-time alarm on risk behaviors suffered by the database. It helps users to generate compliance reports after the fact, trace the source of an accident, and provides efficient query of audit reports through big data search technology to locate the cause of the event, so as to facilitate future query, analysis and filtering, and to realize the monitoring and auditing of internal and external database network behaviors, and to improve data asset security.

[0003] When auditing a database, database traffic is generally obtained, and the database traffic is audited. In the process of database auditing, if the database client and the database server are installed on the same server, a plug-in needs to be installed on the database client, the plug-in installed on the database client can obtain database traffic interacted between the database client and the database server, and then the obtained database traffic is sent to an auditing device for auditing.

[0004] In the related art, multiple different database servers are sometimes installed on one server, that is, even for the same kind of database, different database instances exist. For these cases, the plug-in installed on the client cannot be distinguished, thereby affecting database auditing. SUMMARY

[0005] Embodiments of the present application provide a database traffic auditing processing method and system under a multi-database server, to at least solve the problem in the related art that when different database servers are installed on one server or multiple database instances exist, the plug-in installed on the database client cannot be distinguished, thereby affecting database auditing.

[0006] According to an aspect of the present application, a database traffic auditing processing method under a multi-database server is provided, comprising: acquiring the type of each database of all databases installed on a server, wherein a database client is used to connect with each database server of the all databases; acquiring the characteristic information and port number of each database according to the type of each database; writing the characteristic information and port number of each database into a file respectively; taking the file corresponding to the characteristic information and port number of each database as a file loaded when a plug-in is started, wherein each file corresponds to one plug-in, and the plug-in is used to acquire database traffic between the database client and the database server corresponding to the file, and the database traffic is used for database auditing.

[0007] Further, the method further comprises: sending the acquired database traffic to an agent program by the plug-in; and sending the database traffic to an auditing device for auditing by the agent program, wherein the agent program and the difference are both deployed on the server.

[0008] Further, the method further comprises: receiving information from the auditing device by the agent program, wherein the information comprises the port number and IP address of the database server; saving the corresponding relationship between the auditing device and the port number and IP address of the database server by the agent program; and sending the database traffic from different port numbers and IP addresses to the corresponding auditing device according to the corresponding relationship by the agent program.

[0009] Further, the method further comprises: performing hash operation on the port number and IP address by the agent program to obtain an operation result; and saving the corresponding relationship between the auditing device and the operation result by the agent program.

[0010] According to another aspect of the present application, a database traffic auditing processing system under a multi-database server is also provided, comprising: a first obtaining module in a deployment program, configured to obtain the type of each database of all databases installed on a server, wherein a database client is used to connect with each database server of the all databases; a second obtaining module in the deployment program, configured to obtain characteristic information and a port number of each database according to the type of each database; a writing module in the deployment program, configured to write the characteristic information and the port number of each database into a file respectively; and a file corresponding to the characteristic information and the port number of each database is loaded as a file loaded when a plug-in is started, wherein each file corresponds to one plug-in, the plug-in is configured to obtain database traffic between the database client and the file corresponding database server, and the database traffic is configured to be used for database auditing.

[0011] Further, the system further comprises: a plug-in and an agent program, wherein the plug-in is configured to send the obtained database traffic to the agent program; and the agent program is configured to send the database traffic to an auditing device for auditing, wherein the agent program and the difference are both deployed on the server.

[0012] Further, the agent program is configured to receive information from the auditing device, wherein the information comprises a port number and an IP address of the database server; the agent program is configured to save a corresponding relationship between the auditing device and the port number and the IP address of the database server; and the agent program is configured to send database traffic from different port numbers and IP addresses to corresponding auditing devices according to the corresponding relationship.

[0013] Further, the agent program is configured to perform a hash operation on the port number and the IP address to obtain an operation result; and the agent program is configured to save a corresponding relationship between the auditing device and the operation result.

[0014] According to another aspect of the present application, an electronic device is also provided, comprising a memory and a processor; wherein the memory is configured to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method steps described above.

[0015] According to another aspect of the present application, a readable storage medium having computer instructions stored thereon is also provided, wherein the computer instructions are executed by a processor to implement the method steps described above.

[0016] In the embodiment of the present application, the type of each database of all databases installed on a server is acquired, wherein a database client is used to connect with each database server in the all databases; the characteristic information and port number of each database are acquired according to the type of each database; the characteristic information and port number of each database are written into a file respectively; the file corresponding to the characteristic information and port number of each database is loaded as a file loaded when a plug-in is started, wherein each file corresponds to one plug-in, the plug-in is used to acquire database traffic between the database client and the database server corresponding to the file, and the database traffic is used for database auditing. The problem that the plug-in installed in the database client cannot be distinguished in the case that different database servers or multiple database instances exist on one server in the related art, thereby affecting the database auditing, is solved, so that the smooth progress of the database auditing can be ensured. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings, which form a part of the present application, are intended to provide further understanding of the present application, and are used to interpret the application together with the specification. The illustrative embodiments of the present application and their description serve to explain the application. In the drawings:

[0018] Figure 1 is a schematic diagram of three auditing modes according to the embodiment of the present application;

[0019] Figure 2 is a schematic diagram of an auditing traffic acquisition mode according to the embodiment of the present application;

[0020] Figure 3 is a schematic diagram of a proxy program grabbing database traffic from a network card according to the embodiment of the present application; and

[0021] Figure 4 is a flowchart of a database traffic auditing processing method under multiple database servers according to the embodiment of the present application. DETAILED DESCRIPTION

[0022] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0023] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a group of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that herein.

[0024] The technical terms involved in the following embodiments will be described first.

[0025] Socket is a network data transmission technology, using tcp / ip protocol family as transmission protocol, used for cross-host communication, and Unix socket is an IPC mechanism (inter-process communication) developed on the framework of socket. UDS (UNIX Domain Socket) provides two kinds of API interfaces, stream-oriented and packet-oriented, similar to TCP and UDP. SOCK_STREAM is very reliable, and messages will not be lost or out of order. It is more efficient than traditional socket, generally twice as fast as tcp transmission, and does not need to go through the network protocol stack, does not need to be packed and unpacked, calculate checksum, maintain sequence number and response, etc. It only copies application layer data from one process to another process.

[0026] The English of the probe (also known as agent) is agent, and the English of the plug-in is plugin. The functions of the probe and the plug-in will be described below in combination with the database audit product. The database audit product is a product that analyzes the traffic between networks to analyze database information and performs audit. When performing database audit, there are various ways to obtain database traffic, including mirror traffic, local audit method and local audit plug-in method, which are suitable for different scenarios. Figure 1 is a schematic diagram of three audit methods according to embodiments of the present application, as Figure 1 shown, the mirror traffic method is to obtain the database traffic (also known as audit data) to be audited through the switch mirror traffic function, and then send the audit data to the audit device (also known as audit service) for audit. The local audit method is to deploy a small agent program on the database device, obtain the database access traffic through the local network card, and send it back to the audit device to obtain the database traffic. The local audit plug-in method is suitable for the scenario where the client directly uses the client and the database on the same device. The client may interact with the database through shared memory, pipe, UDS, etc. At this time, the traffic cannot be obtained from the network card. At this time, a plugin is deployed on the client to obtain the traffic. The obtained traffic is sent to the agent program, and then sent to the audit device by the agent program.

[0027] Figure 2 is a schematic diagram of the audit traffic acquisition method according to embodiments of the present application, as Figure 2As shown, a database client (db-client) and a database server (db-server) are arranged on the database server, wherein the database client is installed with a plugin, which captures data of SQL interaction between the database client and the server, and the data is sent to an agent as audit data, and then the agent sends the audit data to an audit device. The audit device provides an interface and a program (which can be referred to as rms program) for receiving the audit data, and then performs protocol analysis on the received audit data to obtain the final audit result.

[0028] In Figure 2 , the plugin is a program which can be embedded into the database client to obtain the interaction traffic between the database client and the database server through interface feature information. In the following embodiments, the plugin can record the obtained feature information of the database client transceiving packet interface into a certain file, and the feature information is different for different client types and different client versions.

[0029] When the plugin is used, the following situations can occur:

[0030] Case a: different versions of databases exist on one device, and different ports are used to distinguish them.

[0031] Case b: when multiple databases exist on one device, the plugin needs to support multiple different types of databases.

[0032] Case c: combination of cases a and b, multiple different databases exist on one device, and different instances of each database exist. The above situations need to be considered when the plugin is used. Therefore, in the following embodiments, the problems caused by the existence of multiple different databases and / or multiple instances of one database on one device can be solved.

[0033] In the following embodiments, a database traffic audit processing method under multiple database servers is provided, Figure 4 is a flowchart of the database traffic audit processing method under multiple database servers according to the embodiments of the present application, as Figure 4 shown, the steps included in the method shown in Figure 4 will be described below.

[0034] In step S402, the type of each database of all databases installed on one server is obtained, wherein one database client is used to connect with each database server in the all databases;

[0035] Step S404, obtaining the characteristic information and port number of each database according to the type of each database;

[0036] Step S406, writing the characteristic information and port number of each database into a file respectively;

[0037] As an optional embodiment, in this folder establishment mode, a folder is established for each different type of database, different instances under the same database use different port numbers, each port number corresponds to a subfolder under the database folder, each subfolder saves the plug-in and the characteristic information, and the plug-in is called when the characteristic information under the same folder is started.

[0038] Step S408, taking the file corresponding to the characteristic information and port number of each database as a file loaded when the plug-in is started, wherein each file corresponds to a plug-in, the plug-in is used to obtain the database traffic between the database client and the database server corresponding to the file, and the database traffic is used for database auditing.

[0039] Through the above steps, the problem that the plug-in installed in the database client cannot be distinguished in the case that different database servers or multiple database instances exist on a server in the related art, thereby affecting the database auditing, is solved, so that the smooth progress of the database auditing can be ensured.

[0040] In an embodiment, the plug-in further sends the obtained database traffic to an agent program; and the agent program sends the database traffic to an auditing device for auditing, wherein the agent program and the difference are both deployed on the server.

[0041] In the above steps, optionally, the agent program sending the database traffic to the auditing device for auditing comprises: the agent program receiving information from the auditing device, wherein the information includes the port number and IP address of the database server; the agent program saving the correspondence between the auditing device and the port number and IP address of the database server; and the agent program sending the database traffic from different port numbers and IP addresses to the corresponding auditing device according to the correspondence.

[0042] As an optional embodiment, when the agent program receives the same port number and IP address from different auditors, the agent program obtains the load conditions of different auditors according to a period, and sends the proportion of the database traffic to different auditors according to the load proportion of each auditor in the next period.

[0043] In the above step, optionally, the agent program saves the correspondence between the port number and the IP address of the audit device and the database server, including: the agent program performs hash operation on the port number and the IP address to obtain an operation result; and the agent program saves the correspondence between the audit device and the operation result.

[0044] The following takes linux as an example to illustrate how to deploy plugin. When deploying, a deployment program is used to deploy plugin. The deployment method can include the following steps:

[0045] Step 1: The deployment program acquires specified database feature information and listening port number according to the database type. The feature information is used to indicate information used for connecting the database.

[0046] Step 2: The deployment program saves the feature information according to the database type and the port number information to a specified path.

[0047] For example, two folders of oracle and mysql can be saved under the dblap directory, two folders of 1521 and 1522 are saved under the oracle folder, and two folders of 3306 and 3307 are saved under the mysql folder. A feature information file (feature) and a plugin (libhook.so) are deployed under each folder. The 1521, 1522, 3306, and 3307 all indicate port numbers, that is, a folder is established for each port number. In this folder establishment mode, a folder is established for each different type of database, and different instances under the same database use different port numbers. Each port number corresponds to a subfolder under the database folder.

[0048] Step 3: The client starts and loads the plugin according to the database type and the port, that is, libhook.so is started.

[0049] Step 4: The plugin loads the feature information and acquires the interactive sql information of the client and the server.

[0050] Step 5: The plugin sends the acquired data to the agent through inter-process communication (for example, unixdomainsocket). Of course, other ways of sending can also be considered.

[0051] Step 6: The agent sends the acquired data to the audit device through socket.

[0052] In the above implementation steps, the plugin loading mode depends on the LD_PRELOAD environment variable under Linux, which sets the client to preferentially load the libhook.so program. For the steps of loading feature information and obtaining the interaction sql of the client and the server, in the libhook.so library file, the interface for transmitting and receiving packets of the client is re-implemented, and after loading, it will replace the original client using the transmitting and receiving packet interface to achieve the way of intercepting data. The plugin (or called plugin program) implements the transmitting and receiving packet interface of the database client, which is used to replace the transmitting and receiving packet interface of the original database client.

[0053] After the plugin sends data to the agent, if the server where the agent is located only arranges one database, the database traffic received by the agent comes from one database, at this time, the agent can directly send the traffic to the audit device after obtaining the traffic.

[0054] In addition to obtaining the database traffic from the plugin, the agent also captures traffic from the network card, Figure 3 is a schematic diagram of the proxy program according to the embodiment of the present application capturing database traffic from the network card, as Figure 3 shown, the database client and the database server interact through the network card 2, that is, the database traffic between the database client and the database server will pass through the network card 2, the agent captures the database traffic through the network card, and then sends the database traffic to the audit device through the network card 2, the audit device receives the database traffic through the rms program, and then performs auditing.

[0055] There are several cases for the agent to capture packets:

[0056] Case 1: There are multiple databases on one device, all of which are configured on one design device, and the agent needs to capture and filter all of them.

[0057] Case 2: There are multiple databases on one device, which are respectively configured on different audit devices, and the agent needs to distribute the traffic of different databases to different audit devices to achieve the purpose of backup.

[0058] Case 3: There is one or more databases on one device, which are respectively configured on different audit devices, and the agent needs to send according to the strategy, when the first device cannot accept the audit data, it will automatically send to the second device.

[0059] In the above case, the number of databases on an audit device, device pressure, disk storage, and other information have reached the upper limit, and multiple audit devices must be used; or the multiple databases on the database device belong to different departments, and the departments need to maintain audit separation; the flow is sent to different audit devices, reducing the network pressure of a single device and the flow processing pressure of a single database.

[0060] In the following embodiments, the case of supporting multiple audit devices while managing a single agent can handle the case where multiple databases on a single device need to be audited at the same time. The agent can send different databases to different audit devices, reducing the pressure on a single audit device, reducing network flow pressure, and reducing the flow processing pressure that the audit device needs to handle. In one example, it can include the following steps:

[0061] Step 11, deploy and start the agent program on the database, and the agent listens to the specified port and starts to receive the connection of all audit devices.

[0062] Step 12, the customer configures the audit strategy on the audit device and issues it to the agent. The strategy contains the IP+port information of the database, and the IP+PORT issued by different audit devices can be repeated.

[0063] For example, DAS1:IP1+PORT1, DAS1:IP1+PORT2, DAS2:IP1+PORT3. Among them, IP1+PORT1 means sending the flow from the database service with IP address IP1 and port number PORT1 to audit device 1 (i.e. DAS1), and the other two also express the same meaning, which will not be repeated here.

[0064] In another example, the IP+Port information of the database issued by the audit device 1 and the audit device 2 is the same, then the agent can send the database flow of this IP+Port to the audit device 1 and / or the audit device 2, wherein the agent can determine the sending strategy by itself. For example, the agent can obtain the load situation of different audit devices according to the period, and send the proportion of database flow to different audit devices in the next period according to the load proportion of each audit device.

[0065] Step 13, the agent analyzes the received strategy and parses it into a hash structure for quick lookup.

[0066] Step 14, after the agent captures the data packet, it uses hash lookup to obtain the audit device address to which the data packet needs to be sent, and sends the data to the audit device.

[0067] Step 15, the rms program on the audit device accepts the data sent by the rmagent, and audits the operation of warehousing, etc.

[0068] Through the above steps, the problem that the plug-in installed in the database client cannot be distinguished in the case that different database servers are installed on a server or multiple database instances exist in the related art, thereby affecting the database audit, is solved, so that the smooth progress of the database audit can be ensured.

[0069] In the embodiment, an electronic device is provided, including a memory and a processor, the memory stores a computer program, and the processor is configured to run the computer program to execute the method in the above embodiment.

[0070] The above program can be run in the processor, or can also be stored in the memory (or called computer readable medium), the computer readable medium includes permanent and non-permanent, removable and non-removable media, and can be realized by any method or technology to store information. Information can be computer readable instructions, data structure, program module or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette tape, magnetic tape disk storage or other magnetic storage device, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0071] These computer programs can also be loaded into a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to generate a computer implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in the flow Figure 1 One flow or multiple flows and / or the functions specified in the block Figure 1 One block or multiple blocks, and different steps can be realized by different modules.

[0072] The embodiment provides the device or system. The system is referred to as a database flow auditing processing system under a multi-database server, and comprises a first acquisition module located in a deployment program, used for acquiring the type of each database of all databases installed on a server, wherein a database client is used to connect with each database server in the all databases; a second acquisition module located in the deployment program, used for acquiring characteristic information and a port number of each database according to the type of each database; a writing module located in the deployment program, used for writing the characteristic information and the port number of each database into a file respectively; and a file corresponding to the characteristic information and the port number of each database is used as a file loaded when a plug-in is started, wherein each file corresponds to one plug-in, the plug-in is used to acquire database flow between the database client and the file corresponding database server, and the database flow is used for database auditing.

[0073] The system or device is used for realizing the functions of the method in the above embodiment, each module in the system or device corresponds to each step in the method, and has been described in the method, and thus is not described here again.

[0074] Optionally, the system further comprises a plug-in and an agent program, wherein the plug-in is used to send the acquired database flow to the agent program; and the agent program is used to send the database flow to an auditing device for auditing, wherein the agent program and the difference are both deployed on the server.

[0075] Optionally, the agent program is used to receive information from the auditing device, wherein the information comprises a port number and an IP address of the database server; the agent program is used to save a corresponding relationship between the auditing device and the port number and the IP address of the database server; and the agent program is used to send database flow from different port numbers and IP addresses to corresponding auditing devices according to the corresponding relationship.

[0076] Optionally, the agent program is used to perform hash operation on the port number and the IP address to obtain an operation result; and the agent program is used to save a corresponding relationship between the auditing device and the operation result.

[0077] Through the above embodiment, the problem that in the related art, in the case that different database servers or multiple database instances exist on one server, a plug-in installed on a database client cannot be distinguished, thereby affecting database auditing, is solved, so that the smooth progress of database auditing can be ensured.

[0078] The above merely provides an example of the present application, and is not intended to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present application shall fall into the scope of claims of the present application.

Claims

1. A database traffic auditing processing method under a multi-database service end, characterized in that, The method comprises: acquiring the type of each database installed on a server, wherein a database client is used to connect to each database server in all the databases; acquiring characteristic information and a port number of each database according to the type of each database; writing the characteristic information and the port number of each database into a file respectively; using the file corresponding to the characteristic information and the port number of each database as a file loaded when a plug-in is started, wherein each file corresponds to one plug-in, the plug-in is used to acquire database traffic between the database client and the database server corresponding to the file, and the database traffic is used for database auditing; The method further comprises: the plug-in sends the acquired database traffic to an agent program; the agent program sends the database traffic to an auditing device for auditing, wherein the agent program and the plug-in are both deployed on the server; wherein the agent program receives information from the auditing device, wherein the information includes a port number and an IP address of the database server; the agent program saves the correspondence between the auditing device and the port number and the IP address of the database server; and the agent program sends database traffic from different port numbers and IP addresses to corresponding auditing devices according to the correspondence.

2. The method of claim 1, wherein, The agent program saves the correspondence between the auditing device and the port number and the IP address of the database server comprises: the agent program performs a hash operation on the port number and the IP address to obtain an operation result; the agent program saves the correspondence between the auditing device and the operation result.

3. A database traffic auditing processing system under a multi-database service end, characterized in that, The method comprises: a first acquisition module in a deployment program, used to acquire the type of each database installed on a server, wherein a database client is used to connect to each database server in all the databases; a second acquisition module in the deployment program, used to acquire characteristic information and a port number of each database according to the type of each database; a writing module in the deployment program, used to write the characteristic information and the port number of each database into a file respectively; and used to use the file corresponding to the characteristic information and the port number of each database as a file loaded when a plug-in is started, wherein each file corresponds to one plug-in, the plug-in is used to acquire database traffic between the database client and the database server corresponding to the file, and the database traffic is used for database auditing. The system further comprises a plug-in and an agent, wherein the plug-in is configured to send the obtained database traffic to the agent; the agent is configured to send the database traffic to an audit device for auditing, wherein the agent and the plug-in are deployed on the server; the agent is configured to receive information from the audit device, wherein the information comprises a port number and an IP address of a database server; the agent is configured to save a correspondence between the audit device and the port number and the IP address of the database server; and the agent is configured to send database traffic from different port numbers and IP addresses to corresponding audit devices according to the correspondence.

4. The system of claim 3, wherein, the agent is configured to perform a hash operation on the port number and the IP address to obtain an operation result; and the agent is configured to save a correspondence between the audit device and the operation result.

5. An electronic device comprising a memory and a processor; wherein, The memory is configured to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method steps of any one of claims 1 to 2.

6. A readable storage medium having stored thereon computer instructions, wherein, The computer instructions, when executed by the processor, implement the method steps of any one of claims 1 to 2.

Images