Method for checking compliance of application operating database behavior based on iast technology

Abstract

The application discloses a method for checking compliance of application operation database behavior based on IAST technology, comprising: creating a database table permission definition module, the database table permission definition module defining permission relationships of a database, a database table, an application and a user; weaving a probe into the application; acquiring, in real time, username information of a current login request success and name information of the application; determining whether the username information and the name information of the application exist in the database table permission definition module; if yes, acquiring database name information and database table name information when the application accesses the database; determining whether the database name information and the database table name information exist in the database table permission definition module; and if yes, determining, based on data information acquired from current database operation behavior, whether the permission relationships of the corresponding database, the database table, the application and the user exist in the database table permission definition module to confirm whether the current database operation behavior is compliant.

Description

Technical Field

[0001] This application relates to the field of application operation database behavior compliance inspection technology, specifically to a method and apparatus for inspecting application operation database behavior compliance based on IAST technology. Background Technology

[0002] Databases and applications are two independent services, and permission checks are typically performed separately for each. Similar technologies primarily rely on code auditing and log auditing for permission verification. However, code auditing suffers from high manual costs, while log auditing has limitations in scope, is prone to omissions, and cannot effectively correlate auditing of the application and database. Summary of the Invention

[0003] The purpose of this application is to provide a method, apparatus, electronic device, and computer-readable storage medium for checking the compliance of application database operation behavior based on IAST technology, which can solve at least one of the technical problems existing in the background art.

[0004] To achieve the above objectives, this application provides a method for checking the compliance of application database operation behavior based on IAST technology, including:

[0005] Create a database table permission definition module, which defines the permission relationships between databases, database tables, applications, and users;

[0006] Use a staking tool to insert probes into the application;

[0007] Based on the probe, the username information and application name information of the currently successfully logged-in user are obtained in real time.

[0008] Determine whether the currently obtained username and application name information exist in the database table permission definition module;

[0009] If it exists, the application will obtain the SQL execution information when accessing the database in real time based on the probe, and extract the database name information and database table name information from the SQL execution information.

[0010] Determine whether the currently extracted database name information and database table name information exist in the database table permission definition module;

[0011] If they exist, the database table permission definition module determines whether there are corresponding permission relationships between the database, database table, application, and user based on the data information obtained from the current database operation behavior, so as to confirm whether the current database operation behavior is compliant.

[0012] Optionally, the module for defining permissions to create database tables includes:

[0013] Create database and database table submodules, which record the relationships between databases and database tables;

[0014] Create a role module, which records information about each role;

[0015] Create application and user submodules, wherein each application and its corresponding user is recorded in the application and user submodules;

[0016] A permission association submodule is created for databases, database tables, applications, and users. This submodule associates all data information in the database and database table submodule, the role module, and the application and user submodule to form permission relationships between the database, database tables, applications, and users.

[0017] Optionally, the step of obtaining the username information of the currently successfully logged-in user based on the probe in real time includes:

[0018] The probe is used to obtain the username information of the user when logging in in real time.

[0019] The probe is used to obtain Set-Cookie information or token value information from the user login response header in real time.

[0020] The username used to log in is determined based on Set-Cookie information or token value information, and is the username information for a successful login request.

[0021] Optionally, the step of obtaining the name information of the application that successfully completed the login request in real time based on the probe includes:

[0022] The probe is used to obtain command-line parameters or application contextpath information when the application starts in real time.

[0023] Extract the application's name information from the command-line parameters or the context path information.

[0024] Optionally, if there is no corresponding permission relationship between the database, database table, application, and user in the database table permission definition module, the current database operation behavior is logged and reported to the database table permission definition module.

[0025] Optionally, logging the current database operation behavior includes:

[0026] Log the requesting user, request execution stack, and executed SQL information.

[0027] Optionally, if the database table permission definition module does not contain the corresponding permission relationship between the database, database table, application, and user, an exception is thrown, interrupting the current database operation.

[0028] To achieve the above objectives, this application also provides an apparatus for checking the compliance of application database operation behavior based on IAST technology, comprising:

[0029] A creation module is used to create a database table permission definition module, which defines the permission relationships between the database, database tables, applications, and users.

[0030] The weave-in module is used to weave probes into the application using a stud tool;

[0031] The acquisition module is used to acquire, in real time, the username information of the currently successfully logged-in user and the name information of the application based on the probe;

[0032] The first determining module is used to determine whether the currently obtained username information and application name information exist in the database table permission definition module;

[0033] The extraction module is used to, if present, acquire in real time the SQL execution information when the application accesses the database based on the probe, and extract the database name information and database table name information from the SQL execution information.

[0034] The second determining module is used to determine whether the currently extracted database name information and database table name information exist in the database table permission definition module;

[0035] The third determining module is used to determine, if present, whether there is a corresponding database, database table, application, and user permission relationship in the database table permission definition module based on the data information obtained from the current database operation behavior, so as to confirm whether the current database operation behavior is compliant.

[0036] To achieve the above objectives, this application also provides an electronic device, comprising:

[0037] processor;

[0038] A memory in which executable instructions of the processor are stored;

[0039] The processor is configured to execute the aforementioned method for checking the compliance of application database operations based on IAST technology by executing the executable instructions.

[0040] To achieve the above objectives, this application also provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the method described above for checking the compliance of application database operation behavior based on IAST technology.

[0041] This application also provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. The processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the method described above for checking the compliance of application database operation behavior based on IAST technology.

[0042] This application only requires pre-defining the permission relationships between the database, database tables, applications, and users, and using instrumentation tools to embed probes into the application. Then, when a user logs into the application to perform database table operations, the probe can obtain the username information of the successfully logged-in user and the name information of the corresponding application. If the username and application name information exist in the database table permission definition module, the probe can then obtain the database name and database table name information. If the database name and database table name information also exist in the database table permission definition module, the existence of the corresponding database, database table, application, and user permission relationships in the database table permission definition module can be determined based on the data information obtained from the current database operation behavior, thus confirming whether the current database operation behavior is compliant. In this application, users do not need to concern themselves with the code and related log information, which helps reduce costs and avoids the technical problems of insufficient audit scope and easy omissions caused by log auditing. Furthermore, it enables correlated auditing of the application and the database to determine the compliance of the application's database operation behavior. In addition, this application performs real-time operation compliance detection based on the information obtained by the probe, facilitating timely response measures. Attached Figure Description

[0043] Figure 1 This is a flowchart of a method for checking the compliance of application database operation behavior based on IAST technology, according to an embodiment of this application.

[0044] Figure 2 This is a schematic block diagram of an apparatus for checking the compliance of application database operation behavior based on IAST technology, according to an embodiment of this application.

[0045] Figure 3 This is an example block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0046] To explain in detail the technical content, structural features, objectives and effects of this application, the following description is provided in conjunction with the embodiments and accompanying drawings.

[0047] Example 1

[0048] Please see Figure 1 This application discloses a method for checking the compliance of application database operation behavior based on IAST technology, including:

[0049] 101. Create a database table permission definition module. The database table permission definition module defines the permission relationships between databases, database tables, applications, and users.

[0050] The database table permission definition module defines the permission relationships between databases, database tables, applications, and users. This can be understood as defining the databases and associated database tables that a user has permission to access when logging into the application. For example, user X1, when logging into application A1, has permission to access database tables T1, T2, and T3 associated with database B1, while user X2, when logging into application A1, only has permission to access database table T3 associated with database B1.

[0051] In this application, the permission relationships between databases, database tables, applications, and users are established based on database name information, database table name information, application name information, and username information.

[0052] Specifically, the database table permission definition module is created, including:

[0053] Create database and database table submodules. These submodules record the relationships between databases and database tables. You can retrieve these relationships by manually entering them or by entering the database access address, username, password, and other information.

[0054] Create a role module, which records information about each role, such as administrator or regular user.

[0055] Create application and user submodules, which record each application and its corresponding users. Understandably, when there is only one application, you can configure settings only for the user, which is also considered as recording the user corresponding to the application. When there are multiple applications, you can configure the applications first and then configure the corresponding users for each application.

[0056] This module creates a permission association submodule for databases, database tables, applications, and users. This submodule associates all data information from the database and database table submodules, the role module, and the application and user submodules to form permission relationships between databases, database tables, applications, and users. For example, the formed permission relationship indicates that user X1, when logged into application A1 with the administrator role, has permission to operate on database tables T1, T2, and T3 associated with database B1; all users with the same role (such as ordinary users), when logged into application A1, have permission to operate on database table T1 associated with database B1.

[0057] 102. Use the staking tool to insert the probe into the application.

[0058] The probe is able to obtain the context of each request execution process of the application. Upon detecting an application request, the probe begins tracing the data flow. How to use instrumentation tools to insert the probe into the application and how the probe traces the execution process of each application request and obtains its context are well-known to those skilled in the art and will not be detailed here.

[0059] 103. Based on probes, obtain the username information of the currently successfully logged-in user and the name information of the application in real time.

[0060] Specifically, the system uses a probe to obtain the username information of users who have successfully logged in in real time, including:

[0061] Real-time acquisition of user username information during login using probes;

[0062] Based on the probe, obtain Set-Cookie information or token value information in the response header of user login in real time;

[0063] The username used to log in is determined based on Set-Cookie information or token value information, and is the username information for a successful login request.

[0064] Specifically, the name information of the application that successfully completed the login request is obtained in real time based on the probe, including:

[0065] Based on probes, obtain command-line parameters or application context path information when the application starts in real time;

[0066] Extract the application's name information from command-line arguments or context path information.

[0067] In this way, when the username information of a successful login request is obtained, the name information of the corresponding application can be obtained.

[0068] 104. Determine if the currently obtained username and application name information exist in the database table permission definition module. If they exist, proceed to step 105. If they do not exist, the current user action can be interrupted directly.

[0069] 105. Based on the probe, obtain the SQL execution information of the current application when operating the database in real time, and extract the database name information and database table name information from the SQL execution information.

[0070] 106. Determine if the extracted database name and table name information exist in the database table permission definition module. If they exist, proceed to step 107. If they do not exist, it means there is an access error.

[0071] 107. Based on the data information obtained from the current database operation, determine whether the database table permission definition module contains corresponding permission relationships for the database, database table, application, and user to confirm whether the current database operation is compliant. That is, after confirming that the database table permission definition module contains the username, application name, database name, and database table name extracted from the current database operation, determine whether permission relationships exist among these entities. For example, suppose the current database operation is user X1 logging into application A1 and operating on database table T1 associated with database B1. Then, the database table permission definition module needs to contain permission relationships reflecting this operation, i.e., permission relationships between user X1, application A1, database B1, and database table T1. It can be understood that a database operation refers to the action of a user successfully logging in and operating on a database table. One login operation on one database table can be considered one database operation, and similarly, one login operation on N databases can be considered N database operation operations, but this is not a limitation.

[0072] The existence of corresponding database, database table, application, and user permission relationships means that the current database operation is compliant; otherwise, it means that it is non-compliant.

[0073] Specifically, if the database table permission definition module does not have the corresponding permission relationship between the database, database table, application and user (non-compliant), the current database operation behavior will be logged and reported to the database table permission definition module, and then the log record can be used for further auditing.

[0074] Furthermore, the current database operation behavior is logged, including:

[0075] Log the requesting user, request execution stack (based on the context obtained by the probe), and executed SQL information.

[0076] Specifically, if the database table permission definition module does not contain the corresponding permission relationships for the database, database table, application, and user, an exception is thrown, interrupting the current database operation. This interrupts the user's non-compliant operations and ensures security.

[0077] It should be noted that the order in which steps 102 and 101 are executed is not restricted. Figure 1 The flowchart shown is just a specific example.

[0078] This application only requires pre-defining the permission relationships between the database, database tables, applications, and users, and inserting probes into the application using instrumentation tools. Then, when a user logs into the application to perform database table operations, the probe can obtain the username information of the successfully logged-in user and the corresponding application name. If the username and application name information exist in the database table permission definition module, the probe can then obtain the database name and database table name information. If the database name and database table name information also exist in the database table permission definition module, the existence of the corresponding database, database table, application, and user permission relationships can be determined based on the data information obtained from the current database operation, thus confirming the compliance of the current database operation. In this application, users do not need to concern themselves with the code and related log information, which helps reduce costs and avoids the technical problems of insufficient audit scope and easy omissions caused by log auditing. Furthermore, it allows for correlated auditing of the application and database to determine the compliance of the application's database operation behavior. In addition, this application uses information obtained from the probe for real-time operation compliance detection, facilitating timely response measures.

[0079] Example 2

[0080] Please combine Figure 2 This application discloses an apparatus for checking the compliance of application database operation behavior based on IAST technology, comprising:

[0081] Create module 201, which is used to create a database table permission definition module. The database table permission definition module defines the permission relationships between databases, database tables, applications, and users.

[0082] The weaving module 202 is used to weave probes into the application using a stud tool;

[0083] The acquisition module 203 is used to acquire the username information of the currently successfully logged-in user and the name information of the application based on the probe in real time.

[0084] The first determining module 204 is used to determine whether the currently obtained username information and application name information exist in the database table permission definition module;

[0085] The extraction module 205 is used to obtain the SQL execution information of the application when accessing the database in real time based on the probe, and extract the database name information and database table name information from the SQL execution information, if they exist.

[0086] The second determining module 206 is used to determine whether the currently extracted database name information and database table name information exist in the database table permission definition module;

[0087] The third determining module 207 is used to determine, if it exists, whether there is a corresponding database, database table, application, and user permission relationship in the database table permission definition module based on the data information obtained from the current database operation behavior, so as to confirm whether the current database operation behavior is compliant.

[0088] This application only requires pre-defining the permission relationships between the database, database tables, applications, and users, and inserting probes into the application using instrumentation tools. Then, when a user logs into the application to perform database table operations, the probe can obtain the username information of the successfully logged-in user and the corresponding application name. If the username and application name information exist in the database table permission definition module, the probe can then obtain the database name and database table name information. If the database name and database table name information also exist in the database table permission definition module, the existence of the corresponding database, database table, application, and user permission relationships can be determined based on the data information obtained from the current database operation, thus confirming the compliance of the current database operation. In this application, users do not need to concern themselves with the code and related log information, which helps reduce costs and avoids the technical problems of insufficient audit scope and easy omissions caused by log auditing. Furthermore, it allows for correlated auditing of the application and database to determine the compliance of the application's database operation behavior. In addition, this application uses information obtained from the probe for real-time operation compliance detection, facilitating timely response measures.

[0089] Example 3

[0090] Please combine Figure 3 This application discloses an electronic device, comprising:

[0091] Processor 30;

[0092] Memory 40, which stores executable instructions of processor 30;

[0093] The processor 30 is configured to execute the method for checking the compliance of application database operation behavior based on IAST technology as described in Embodiment 1 by executing executable instructions.

[0094] Example 4

[0095] This application discloses a computer-readable storage medium storing a program thereon, which, when executed by a processor, implements the method for checking the compliance of application database operation behavior based on IAST technology as described in Embodiment 1.

[0096] Example 5

[0097] This application discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned method for checking the compliance of application database operations based on IAST technology.

[0098] It should be understood that, in the embodiments of this application, the processor may be a central processing unit (CPU), but it may also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0099] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by hardware related to computer program instructions. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0100] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0101] The above-disclosed examples are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall fall within the scope of this application.

Claims

1. A method for checking the compliance of application database operation behavior based on IAST technology, characterized in that, include: Create a database table permission definition module, which defines the permission relationships between databases, database tables, applications, and users; Use a staking tool to insert probes into the application; Based on the probe, the username information and application name information of the currently successfully logged-in user are obtained in real time. Determine whether the currently obtained username and application name information exist in the database table permission definition module; If it exists, the probe is used to obtain the SQL execution information when the application accesses the database in real time, and the database name information and database table name information are extracted from the SQL execution information. Determine whether the currently extracted database name information and database table name information exist in the database table permission definition module; If they exist, the database table permission definition module determines whether there is a corresponding permission relationship between the database, database table, application, and user based on the username information, application name information, database name information, and database table name information obtained from the current database operation behavior, so as to confirm whether the current database operation behavior is compliant. If the database table permission definition module does not have the corresponding permission relationship between the database, database table, application and user, then the current database operation behavior is logged and reported to the database table permission definition module.

2. The method for checking the compliance of application database operation behavior based on IAST technology as described in claim 1, characterized in that, The module for defining permissions to create database tables includes: Create database and database table submodules, which record the relationships between databases and database tables; Create a role module, which records information about each role; Create application and user submodules, wherein each application and its corresponding user is recorded in the application and user submodules; A permission association submodule is created for databases, database tables, applications, and users. This submodule associates data information in the database and database table submodule, the role module, and the application and user submodule to form permission relationships between the database, database tables, applications, and users.

3. The method for checking the compliance of application database operation behavior based on IAST technology as described in claim 1, characterized in that, The step of obtaining the username information of the currently successfully logged-in user based on the probe in real time includes: The probe is used to obtain the username information of the user when logging in in real time. The probe is used to obtain Set-Cookie information or token value information from the user login response header in real time. The username used to log in is determined based on Set-Cookie information or token value information, and is the username information for a successful login request.

4. The method for checking the compliance of application database operation behavior based on IAST technology as described in claim 1, characterized in that, The step of obtaining the name information of the application that has successfully logged in based on the probe in real time includes: The probe is used to obtain command-line parameters or application context path information in real time when the application starts. Extract the application's name information from the command-line parameters or the context path information.

5. The method for checking the compliance of application database operation behavior based on IAST technology as described in claim 1, characterized in that, The logging of current database operations includes: Log the requesting user, request execution stack, and executed SQL information.

6. The method for checking the compliance of application database operation behavior based on IAST technology as described in claim 1, characterized in that, If the database table permission definition module does not contain the corresponding permission relationships for the database, database table, application, and user, an exception is thrown, interrupting the current database operation.

7. A device for checking the compliance of application database operation behavior based on IAST technology, characterized in that, include: A creation module is used to create a database table permission definition module, which defines the permission relationships between the database, database tables, applications, and users. The weave-in module is used to weave probes into the application using a stud tool; The acquisition module is used to acquire, in real time, the username information of the currently successfully logged-in user and the name information of the application based on the probe; The first determining module is used to determine whether the currently obtained username information and application name information exist in the database table permission definition module; The extraction module is used to, if present, acquire in real time the SQL execution information when the application accesses the database based on the probe, and extract the database name information and database table name information from the SQL execution information. The second determining module is used to determine whether the currently extracted database name information and database table name information exist in the database table permission definition module; The third determining module is used to determine, if present, whether there is a corresponding database, database table, application, and user permission relationship in the database table permission definition module based on the username information, application name information, database name information, and database table name information obtained from the current database operation behavior, so as to confirm whether the current database operation behavior is compliant. If the database table permission definition module does not have the corresponding permission relationship between the database, database table, application and user, then the current database operation behavior is logged and reported to the database table permission definition module.

8. An electronic device, characterized in that, include: processor; A memory in which executable instructions of the processor are stored; The processor is configured to execute the method for checking the compliance of application database operation behavior based on IAST technology, as described in any one of claims 1 to 6, by executing the executable instructions.

9. A computer-readable storage medium having a program stored thereon, characterized in that, When the program is executed by the processor, it implements the method for checking the compliance of application database operation behavior based on IAST technology as described in any one of claims 1 to 6.

Images