A method for checking the compliance of application access to database based on IAST technology

Abstract

The present application discloses a method for checking the compliance of application access database behavior based on IAST technology, comprising: obtaining application information, user information, role information, database information and database table information of database access behavior in a data collection phase in real time based on a probe; recording the data information obtained from the current database access behavior in a database table permission mapping module; determining the permission mapping relationship of multiple role information mapped to the same database table information for auditing based on the permission mapping relationship of all database access behaviors in the data collection phase recorded in the database table permission mapping module; obtaining data information of database access behavior in an actual use phase in real time based on a probe; determining whether the permission mapping relationship obtained from the current database access behavior in the actual use phase exists in the database table permission mapping module, and if so, the current database access behavior is compliant.

Description

Technical Field

[0001] The present application relates to the technical field of compliance checking of application database access behavior, and specifically to a method for checking the compliance of application database access behavior based on IAST technology. Background Art

[0002] Databases and applications are two independent services. When performing permission verification and auditing, these two services are generally checked separately. Similar technologies mainly rely on code auditing and log auditing for permission verification. Code auditing is labor-intensive, while log auditing is limited in scope, prone to omissions, and unable to effectively link application and database audits. Summary of the Invention

[0003] The purpose of this application is to provide a method, device, electronic device and computer-readable storage medium for checking the compliance of application program access to database behavior based on IAST technology, which can solve at least one technical problem existing in the above background technology.

[0004] To achieve the above objectives, this application provides a method for checking the compliance of application database access behavior based on IAST technology, including:

[0005] Create a database table permission mapping module, which is used to record the permission mapping relationship between application information, user information, role information and database table information;

[0006] Use instrumentation tools to insert probes into applications;

[0007] Acquiring application information, user information, role information, database information, and database table information of database access behavior in a data collection phase in real time based on the probe;

[0008] Pushing the application information, user information, role information, database information, and database table information obtained from the current database access behavior to the database table permission mapping module for recording;

[0009] Based on the permission mapping relationships among application information, user information, role information, and database table information of all database access behaviors in the data collection phase recorded in the database table permission mapping module, determining permission mapping relationships where multiple role information is mapped to the same database table information for auditing;

[0010] Acquiring application information, user information, role information, database information, and database table information of database access behavior in an actual usage phase in real time based on the probe;

[0011] Determine whether the permission mapping relationship of application information, user information, role information and database table information obtained from the current database access behavior in the actual use stage exists in the database table permission mapping module after the audit is completed. If so, the current database access behavior is compliant.

[0012] Optionally, the creation of a database table permission definition module includes:

[0013] Creating a database and database table submodule, wherein the database and database table submodule is used to record the association relationship between database information and database table information;

[0014] Creating a role module, wherein the role module is used to record role information;

[0015] Creating an application and user submodule, wherein the application and user submodule is used to record each application information and its corresponding user information;

[0016] Create a database table permission mapping submodule, which is used to associate the data information in the database and database table submodule, the role module and the application and user submodule to form a permission mapping relationship between application information, user information, role information and database table information.

[0017] Optionally, the user information is user name information;

[0018] The user information of database access behavior is obtained in real time based on the probe, including:

[0019] Acquire user name information of the user when logging in in real time based on the probe;

[0020] Based on the probe, the Set-Cookie information or token value information in the response header of the user login is obtained in real time;

[0021] The user name information when the user logs in is determined according to the Set-Cookie information or token value information as the user name information for the database access behavior.

[0022] Optionally, the application information is name information of the application;

[0023] Based on the probe, application information about database access behavior is obtained in real time, including:

[0024] Acquire command line parameters or context path information of the application when the application is started in real time based on the probe;

[0025] Extract the name information of the application program from the command line parameter or the context path information.

[0026] Optionally, the database information is database name information, and the database table information is database table name information;

[0027] The database information and database table information of the database access behavior are obtained in real time based on the probe, including:

[0028] Acquire the SQL execution information of the database access behavior in real time based on the probe;

[0029] The database name information and the database table name information are extracted from the SQL execution information.

[0030] Optionally, after determining the permission mapping relationship in which multiple role information is mapped to the same database table information, the method further includes:

[0031] For each database table information, a weight is assigned according to the number of role information mapped to it. The weight represents the security probability of the corresponding database table and is inversely proportional to the number of mapped role information, or represents the risk probability of the corresponding database table and is directly proportional to the number of mapped role information.

[0032] The database table information is sorted before auditing according to the weight corresponding to each of the database table information, with the database table information with low security probability or high risk probability being placed at the front.

[0033] Optionally, if the permission mapping relationship of application information, user information, role information and database table information obtained from the current database access behavior in the actual usage stage does not exist in the database table permission mapping module after the audit is completed, the database access behavior is logged and reported to the database table permission mapping module, and an exception is thrown to interrupt the database access behavior.

[0034] To achieve the above objectives, the present application also provides a device for checking the compliance of application program access to database based on IAST technology, including:

[0035] A creation module is used to create a database table permission mapping module, wherein the database table permission mapping module is used to record the permission mapping relationship between application information, user information, role information and database table information;

[0036] The weaving module is used to weave probes into applications using instrumentation tools;

[0037] A first acquisition module is used to acquire application information, user information, role information, database information and database table information of database access behavior in a data collection phase in real time based on the probe;

[0038] A recording module is used to push the application information, user information, role information, database information and database table information obtained from the current database access behavior to the database table permission mapping module for recording;

[0039] a first determining module for determining, based on the permission mapping relationships among application information, user information, role information, and database table information of all database access behaviors recorded in the database table permission mapping module during the data collection phase, permission mapping relationships among multiple role information mapped to the same database table information for auditing;

[0040] A second acquisition module is used to acquire application information, user information, role information, database information and database table information of database access behavior in an actual use phase in real time based on the probe;

[0041] The second determination module is used to determine whether the permission mapping relationship of application information, user information, role information and database table information obtained from the current database access behavior in the actual use stage exists in the database table permission mapping module after the audit is completed. If so, the current database access behavior is compliant.

[0042] To achieve the above objectives, the present application further provides an electronic device, comprising:

[0043] processor;

[0044] a memory storing executable instructions for the processor;

[0045] The processor is configured to execute the aforementioned method of checking the compliance of application program access to database behavior based on IAST technology by executing the executable instructions.

[0046] To achieve the above-mentioned purpose, the present application also provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, it implements the method for checking the compliance of application program access to database behavior based on IAST technology as described above.

[0047] The present application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the method for checking the compliance of application program access to a database based on IAST technology as described above.

[0048] This application uses an instrumentation tool to insert a probe into the application. Later, when the user logs in to the application to access the database during the data collection phase, the application information, user information, role information, database information and database table information of the database access behavior can be obtained based on the probe and recorded in the database table permission mapping module, that is, the database table permission mapping module records the permission mapping relationship of the application information, user information, role information and database table information of each database access behavior. After the database table permission mapping module completes data collection (completes all functional tests), the data in the database table permission mapping module can be used to make compliance judgments on the database access behavior in the actual use phase. In this application, users do not need to care about the code and related log information, which is conducive to reducing costs. There are also no technical problems such as insufficient audit scope and easy omissions caused by log audits, and the application and database can be audited in conjunction to determine the compliance of the application's database access behavior. In addition, this application performs real-time operational compliance detection based on the information obtained by the probe, which facilitates timely response measures. Moreover, the present application audits the permission mapping relationship between multiple role information existing in the database table permission mapping module and the same database table information, so that the non-compliant mapping relationship in the database table permission mapping module can basically be modified, which is conducive to ensuring the accuracy of the mapping relationship stored in the database table permission mapping module, and further helps to ensure the accuracy of the compliance judgment of subsequent database access behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a flowchart of a method for checking the compliance of application program access to database behavior based on IAST technology in an embodiment of the present application.

[0050] Figure 2 This is a schematic block diagram of an apparatus for checking the compliance of application program access to a database based on IAST technology in an embodiment of the present application.

[0051] Figure 3 This is an example block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to explain the technical content, structural features, achieved objectives and effects of this application in detail, the following is a detailed description in conjunction with the implementation methods and the accompanying drawings.

[0053] Example 1

[0054] See also Figure 1 This application discloses a method for checking the compliance of application program access to database based on IAST technology, including:

[0055] 101. Create a database table permission mapping module, which is used to record the permission mapping relationship between application information, user information, role information and database table information.

[0056] The database table permission mapping module is used to record the permission mapping relationships between application information, user information, role information, and database table information. This can be understood as recording the application information, user information, role information, database information, and database table information for each database access during the data collection phase in the database table permission mapping module. For example, during the data collection phase, if user X1 successfully logs into application A1 as role J1 and accesses database table T1 associated with database B1, the application information, user information, role information, database information, and database table information for this database access behavior will be recorded in the database table permission mapping module. This means that the database table permission mapping module records the permission mapping relationships between the application information, user information, role information, and database table information for this data access behavior, as well as the relationship between the database information and the database table information.

[0057] It is understood that database access refers to the operation of operating a database table after a user successfully logs in. One login to operate one database table can be considered one database operation, while one login to operate two databases can be considered two database operations, but this is not a limitation.

[0058] Specifically, create a database table permission definition module, including:

[0059] Create a database and database table submodule, which is used to record the relationship between database information and database table information. That is, when receiving each push of database information and database table information, it will be recorded in the database and database table submodule.

[0060] Create a role module, which is used to record role information. That is, every time role information is pushed, it will be recorded in the role module.

[0061] Create an application and user submodule, which is used to record each application information and its corresponding user information. In other words, when receiving each pushed application information and user information, it will be recorded in the application and user submodule.

[0062] Create a database table permission mapping submodule. This submodule is used to associate data in the database and database table submodules, and in the role module with the application and user submodules, to form permission mapping relationships between application information, user information, role information, and database table information. Specifically, the application information, user information, role information, database information, and database table information extracted from each data access behavior are pushed and recorded in the corresponding modules. The database table permission mapping submodule then associates this set of application information, user information, role information, and database table information.

[0063] 102. Use instrumentation tools to insert probes into applications.

[0064] The probe can capture the context of every application request. Upon detecting an application request, the probe begins tracking the data flow. Those skilled in the art are familiar with how to use instrumentation tools to embed the probe into an application and how the probe tracks every application request and captures its context, so this section will not discuss in detail.

[0065] 103. The probes are used to obtain application information, user information, role information (user affiliation), database information, and database table information from database access behaviors during the data collection phase in real time. The application information, user information, role information, and database table information extracted from the same database access behavior have a permission mapping relationship, and the database information and database table information have an association relationship.

[0066] Specifically, the user information is user name information;

[0067] Probe-based real-time acquisition of user information about database access behavior, including:

[0068] Get user name information when logging in in real time based on probes;

[0069] Based on the probe, the Set-Cookie information or token value information in the response header of the user login is obtained in real time;

[0070] The user name information when the user logs in is determined according to the Set-Cookie information or token value information as the user name information for the database access behavior.

[0071] Specifically, the application information is the name information of the application;

[0072] Probe-based real-time acquisition of application information about database access behavior, including:

[0073] Get the command line parameters or context path information of the application in real time based on the probe when the application is started;

[0074] Extracts the application name from command-line arguments or context path information.

[0075] Specifically, the database information is the database name information, and the database table information is the database table name information;

[0076] Probe-based real-time acquisition of database access behavior and database table information, including:

[0077] Obtain SQL execution information of database access behavior in real time based on probes;

[0078] Extract database name information and database table name information from the executed SQL information.

[0079] 104. The application information, user information, role information, database information, and database table information obtained from the current database access behavior are pushed to the database table permission mapping module for recording. After all functional tests are completed (i.e., all users corresponding to each application have executed all the configured database access behaviors), the database table permission mapping module will phase in the data population and establish the mapping relationship, thus completing data collection.

[0080] 105. Based on the permission mapping relationship among application information, user information, role information and database table information of all database access behaviors recorded in the data collection phase in the database table permission mapping module, determine the permission mapping relationship among multiple role information mapped to the same database table information for auditing.

[0081] What is meant by "multiple role information is mapped to the same database table information" can be set according to actual conditions. For example, "multiple role information" can be at least two or at least three.

[0082] "Auditing" here includes modifying data when it doesn't comply with regulations. Specifically, after determining the permissions mapping relationships between multiple roles and the same database table, a manual audit can be conducted on the corresponding database table mapping information to verify that each role's access complies with regulations and to determine if any roles should not have permissions. If so, appropriate modifications will be made until all auditable items are audited.

[0083] Specifically, after determining the permission mapping relationship in which multiple role information is mapped to the same database table information, the method further includes:

[0084] Each database table is assigned a weight based on the number of roles it maps to (the same weight applies to equal numbers). The weight represents the security probability of the corresponding database table and is inversely proportional to the number of roles it maps to, or the risk probability of the corresponding database table and is directly proportional to the number of roles it maps to. For example, a database table accessed by only one role has a weight of one, while a table accessed by two roles has a weight of two, and so on.

[0085] The database table information is sorted before auditing according to its corresponding weight. The database table information with low security probability or high risk probability is placed at the front, which facilitates quick auditing.

[0086] It should be explained that the security probability refers to the probability that the database table is accessed in a compliant manner, and the risk probability refers to the probability that the database table is accessed in an compliant manner.

[0087] 106. The probes are used to capture application information, user information, role information, database information, and database table information from actual database access behaviors in real time. The application information, user information, role information, and database table information extracted from the same database access behavior have permission mapping relationships, and the database information and database table information have associations.

[0088] After completing the establishment of the data in the database table permission mapping module based on all the data collected in the data collection phase, the data in the database table permission mapping module can be used in real time to determine whether the database access behavior is compliant in the actual use phase.

[0089] 107. Determine whether the permission mapping relationship between the application information, user information, role information and database table information obtained from the current database access behavior during the actual use phase exists in the database table permission mapping module after the audit is completed. If so, the current database access behavior is compliant, that is, the current database access behavior is in compliance with the settings of the database table permission mapping module.

[0090] Specifically, if the permission mapping relationship of application information, user information, role information and database table information obtained from the current database access behavior during the actual usage stage does not exist in the database table permission mapping module after the audit is completed (non-compliant), the database access behavior will be logged and reported to the database table permission mapping module, and the log record can be used for further auditing.

[0091] Furthermore, the current database access behavior is logged, including:

[0092] Logs the request user, request execution stack (based on the context obtained by the probe), and executed SQL information.

[0093] Specifically, if the permission mapping relationship between application information, user information, role information, and database table information obtained from the current database access behavior during actual use does not exist in the audited database table permission mapping module, an exception is thrown, interrupting the database access behavior. This interrupts the user's non-compliant operation and ensures security.

[0094] It should be noted that the order of execution of step 102 and step 101 is not limited. Figure 1 The flowcharts are only specific examples.

[0095] This application uses an instrumentation tool to insert a probe into the application. Later, when the user logs in to the application to access the database during the data collection phase, the application information, user information, role information, database information and database table information of the database access behavior can be obtained based on the probe and recorded in the database table permission mapping module, that is, the database table permission mapping module records the permission mapping relationship of the application information, user information, role information and database table information of each database access behavior. After the database table permission mapping module completes data collection (completes all functional tests), the data in the database table permission mapping module can be used to make compliance judgments on the database access behavior in the actual use phase. In this application, users do not need to care about the code and related log information, which is conducive to reducing costs. There are also no technical problems such as insufficient audit scope and easy omissions caused by log audits, and the application and database can be audited in conjunction to determine the compliance of the application's database access behavior. In addition, this application performs real-time operational compliance detection based on the information obtained by the probe, which facilitates timely response measures. Moreover, the present application audits the permission mapping relationship between multiple role information existing in the database table permission mapping module and the same database table information, so that the non-compliant mapping relationship in the database table permission mapping module can basically be modified, which is conducive to ensuring the accuracy of the mapping relationship stored in the database table permission mapping module, and further helps to ensure the accuracy of the compliance judgment of subsequent database access behavior.

[0096] Example 2

[0097] Please combine Figure 2 This application discloses a device for checking the compliance of application program access to database based on IAST technology, including:

[0098] Create a module for creating a database table permission mapping module, which is used to record the permission mapping relationship between application information, user information, role information and database table information;

[0099] The weaving module is used to weave probes into applications using instrumentation tools;

[0100] The first acquisition module is used to acquire application information, user information, role information, database information and database table information of database access behavior in the data collection phase in real time based on the probe;

[0101] The recording module is used to push the application information, user information, role information, database information and database table information obtained from the current database access behavior to the database table permission mapping module for recording;

[0102] A first determination module is configured to determine, based on the permission mapping relationships among application information, user information, role information, and database table information of all database access behaviors recorded in the data collection phase in the database table permission mapping module, permission mapping relationships among multiple role information mapped to the same database table information for auditing;

[0103] The second acquisition module is used to acquire application information, user information, role information, database information and database table information of database access behavior in the actual use stage in real time based on the probe;

[0104] The second determination module is used to determine whether the permission mapping relationship of application information, user information, role information and database table information obtained from the current database access behavior in the actual use stage exists in the database table permission mapping module after the audit is completed. If so, the current database access behavior is compliant.

[0105] This application uses an instrumentation tool to insert a probe into the application. Later, when the user logs in to the application to access the database during the data collection phase, the application information, user information, role information, database information and database table information of the database access behavior can be obtained based on the probe and recorded in the database table permission mapping module, that is, the database table permission mapping module records the permission mapping relationship of the application information, user information, role information and database table information of each database access behavior. After the database table permission mapping module completes data collection (completes all functional tests), the data in the database table permission mapping module can be used to make compliance judgments on the database access behavior in the actual use phase. In this application, users do not need to care about the code and related log information, which is conducive to reducing costs. There are also no technical problems such as insufficient audit scope and easy omissions caused by log audits, and the application and database can be audited in conjunction to determine the compliance of the application's database access behavior. In addition, this application performs real-time operational compliance detection based on the information obtained by the probe, which facilitates timely response measures. Moreover, the present application audits the permission mapping relationship between multiple role information existing in the database table permission mapping module and the same database table information, so that the non-compliant mapping relationship in the database table permission mapping module can basically be modified, which is conducive to ensuring the accuracy of the mapping relationship stored in the database table permission mapping module, and further helps to ensure the accuracy of the compliance judgment of subsequent database access behavior.

[0106] Example 3

[0107] Please combine Figure 3 , the present application discloses an electronic device, comprising:

[0108] Processor 30;

[0109] a memory 40 in which executable instructions of the processor 30 are stored;

[0110] The processor 30 is configured to execute the method for checking the compliance of application program access to database behavior based on IAST technology as described in the first embodiment by executing executable instructions.

[0111] Example 4

[0112] The present application discloses a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, the method for checking the compliance of application program access to a database based on IAST technology as described in Example 1 is implemented.

[0113] Example 5

[0114] The present application discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned method for checking the compliance of application program access to a database based on IAST technology.

[0115] It should be understood that in the embodiments of the present application, the processor referred to may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0116] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by hardware associated with computer program instructions. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0117] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0118] The above disclosure is only a preferred example of the present application and cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are all within the scope covered by the present application.

Claims

1. A method for checking the compliance of application program access to database based on IAST technology, characterized in that: include: Create a database table permission mapping module, which is used to record the permission mapping relationship between application information, user information, role information and database table information; Use instrumentation tools to insert probes into applications; Acquiring application information, user information, role information, database information, and database table information of database access behavior in a data collection phase in real time based on the probe; Pushing the application information, user information, role information, database information, and database table information obtained from the current database access behavior to the database table permission mapping module for recording; Based on the permission mapping relationships among application information, user information, role information, and database table information of all database access behaviors in the data collection phase recorded in the database table permission mapping module, determining permission mapping relationships where multiple role information is mapped to the same database table information for auditing; Acquiring application information, user information, role information, database information, and database table information of database access behavior in an actual usage phase in real time based on the probe; Determine whether the permission mapping relationship between application information, user information, role information, and database table information obtained from the current database access behavior during the actual use phase exists in the database table permission mapping module after the audit is completed. If so, the current database access behavior is compliant. After determining the permission mapping relationship in which multiple role information is mapped to the same database table information, the method further includes: For each database table information, a weight is assigned according to the number of role information mapped to it. The weight represents the security probability of the corresponding database table and is inversely proportional to the number of mapped role information, or represents the risk probability of the corresponding database table and is directly proportional to the number of mapped role information. The database table information is sorted before auditing according to the weight corresponding to each of the database table information, with the database table information with low security probability or high risk probability being placed at the front.

2. The method for checking the compliance of application program access to database behavior based on IAST technology according to claim 1, characterized in that: The creation of the database table permission definition module includes: Creating a database and database table submodule, wherein the database and database table submodule is used to record the association relationship between database information and database table information; Creating a role module, wherein the role module is used to record role information; Creating an application and user submodule, wherein the application and user submodule is used to record each application information and its corresponding user information; Create a database table permission mapping submodule, which is used to associate the data information in the database and database table submodule, the role module and the application and user submodule to form a permission mapping relationship between application information, user information, role information and database table information.

3. The method for checking the compliance of application program access to database behavior based on IAST technology according to claim 1, characterized in that: User information is user name information; The user information of database access behavior is obtained in real time based on the probe, including: Acquire user name information of the user when logging in in real time based on the probe; Based on the probe, the Set-Cookie information or token value information in the response header of the user login is obtained in real time; The user name information when the user logs in is determined according to the Set-Cookie information or token value information as the user name information for the database access behavior.

4. The method for checking the compliance of application program access to database behavior based on IAST technology according to claim 1, characterized in that: The application information is the name information of the application; Based on the probe, application information about database access behavior is obtained in real time, including: Acquire command line parameters or context path information of an application when the application is started in real time based on the probe; Extract the name information of the application program from the command line parameter or the context path information.

5. The method for checking the compliance of application program access to database behavior based on IAST technology according to claim 1, characterized in that: The database information is the database name information, and the database table information is the database table name information; The database information and database table information of the database access behavior are obtained in real time based on the probe, including: Acquire the SQL execution information of the database access behavior in real time based on the probe; The database name information and the database table name information are extracted from the SQL execution information.

6. The method for checking the compliance of application program access to database behavior based on IAST technology according to claim 1, characterized in that: If the permission mapping relationship of application information, user information, role information and database table information obtained from the current database access behavior in the actual usage stage does not exist in the database table permission mapping module after the audit is completed, the database access behavior will be logged and reported to the database table permission mapping module, and an exception will be thrown to interrupt the database access behavior.

7. A device for checking the compliance of application program access to database based on IAST technology, characterized in that: include: A creation module is used to create a database table permission mapping module, wherein the database table permission mapping module is used to record the permission mapping relationship between application information, user information, role information and database table information; The weaving module is used to weave probes into applications using instrumentation tools; A first acquisition module is used to acquire application information, user information, role information, database information and database table information of database access behavior in a data collection phase in real time based on the probe; A recording module is used to push the application information, user information, role information, database information and database table information obtained from the current database access behavior to the database table permission mapping module for recording; a first determining module for determining, based on the permission mapping relationships among application information, user information, role information, and database table information of all database access behaviors recorded in the database table permission mapping module during the data collection phase, permission mapping relationships among multiple role information mapped to the same database table information for auditing; A second acquisition module is used to acquire application information, user information, role information, database information and database table information of database access behavior in an actual use phase in real time based on the probe; A second determination module is configured to determine whether the permission mapping relationship among application information, user information, role information, and database table information obtained from the current database access behavior during the actual use phase exists in the database table permission mapping module after the audit is completed; if so, the current database access behavior is compliant; After determining the permission mapping relationship in which multiple role information is mapped to the same database table information, the method further includes: For each database table information, a weight is assigned according to the number of role information mapped to it. The weight represents the security probability of the corresponding database table and is inversely proportional to the number of mapped role information, or represents the risk probability of the corresponding database table and is directly proportional to the number of mapped role information. The database table information is sorted before auditing according to the weight corresponding to each of the database table information, with the database table information with low security probability or high risk probability being placed at the front.

8. An electronic device, characterized in that: include: processor; a memory storing executable instructions for the processor; Wherein, the processor is configured to execute the method for checking the compliance of application access to database behavior based on IAST technology as described in any one of claims 1 to 6 by executing the executable instructions.

9. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the method for checking the compliance of application program access to a database based on IAST technology as described in any one of claims 1 to 6 is implemented.

Images