Ransomware Defense Methods and Systems Based on Database Permissions

Abstract

This invention proposes a method and system for ransomware defense based on database permissions, belonging to the field of data processing technology in computer network security. The method includes: receiving an instruction to execute a database operation request; verifying the legitimacy of the operation request under the role executing the request; and determining whether the operation is currently permitted based on the context. If the operation is permitted, the method determines the type of operation; if it is a critical data operation with significant business importance, it triggers a database table backup to ensure that data in the database tables can be restored if encrypted by ransomware. This effectively prevents ransomware from encrypting database table data even after gaining partial database operation permissions.

Description

Technical Field

[0001] This invention belongs to the field of data processing technology in computer network security, and particularly relates to a method and system for ransomware defense based on database permissions. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] A major harm of ransomware is that it encrypts critical data in a target database using cryptographic algorithms, forcing victims to pay a ransom to recover the data.

[0004] Existing ransomware detection technologies identify ransomware by monitoring system processes or file operations. However, database ransomware does not encrypt any files at the operating system level. Instead, it directly logs into the database, traverses all tables, and encrypts the data in the database tables using database encryption algorithms. Therefore, existing detection technologies struggle to detect and defend against ransomware's illegal encryption operations after logging into the database, thus failing to provide true defense. Summary of the Invention

[0005] To overcome the shortcomings of the prior art, this invention provides a ransomware defense method based on database permissions, which restricts user behavior by managing and controlling user access permissions to database objects. Furthermore, predefined database operations can trigger preset database protection behaviors to safeguard database security.

[0006] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions:

[0007] Firstly, a method for ransomware defense based on database permissions was disclosed, including:

[0008] It receives instructions to execute database operation requests, verifies the legitimacy of the operation request under the role of executing the database operation request, and determines whether the operation is allowed to be executed based on the context.

[0009] If the operation is allowed, the type of operation is determined. If it is a critical data operation with significant business importance, a database table backup is triggered to ensure that data in the database tables can be recovered if the data is encrypted by ransomware.

[0010] As a further technical solution, before verifying the legitimacy of the database operation request under the role executing the request, different database user roles are defined, and corresponding permissions are assigned to each role to map the database operation to the role.

[0011] As a further technical solution, corresponding permissions are assigned to each role to map database operations to roles, specifically:

[0012] Specify the database operations that are allowed to be performed for each role, and use a database access control list to store the mapping relationship between roles and operations.

[0013] As a further technical solution, it also includes: setting the deletion of a database table and the creation of a database table to be performed by the same role;

[0014] Modifying the type and content of a long field in the same database table cannot be performed by the same user.

[0015] As a further technical solution, when a user initiates a database operation request, their identity is first verified and their role is determined. Then, based on the user's role and the requested operation, the database access control list is checked to determine whether the operation is allowed. Finally, the database table to be operated on is used to determine whether the operation can be executed.

[0016] As a further technical solution, the database access control rules take the following form:

[0017]

[0018] Here, Rule is the permission judgment rule; Rid is the role; Aid is the requested operation; Table is the database table object of the operation; and Return is the return value, which can be either allowed or denied.

[0019] As a further technical solution, database table backup is triggered, specifically as follows:

[0020] Setting database table deletion operations and database table data encryption will trigger a backup script to perform the corresponding backup task for the current table;

[0021] Configure the database encryption function to perform a backup task on the encrypted original data.

[0022] Secondly, a ransomware defense system based on database permissions was disclosed, including:

[0023] The database operation permission control module is configured to: receive instructions to execute database operation requests, identify the legitimacy of the operation request under the role executing the database operation request, and determine whether the operation is currently allowed based on the context;

[0024] The real-time database backup module is configured to: if the operation is allowed, determine the type of the operation; if it is a critical data operation with significant business importance, trigger a database table backup to ensure that data in the database table is backed up and restored when it is encrypted by ransomware.

[0025] The above one or more technical solutions have the following beneficial effects:

[0026] The technical solution of this invention utilizes database operation permission control technology, which, based on the characteristics of ransomware behavior, can monitor and defend against encryption of data in database tables, preventing ransomware from encrypting database table data even after gaining partial database operation permissions.

[0027] This invention utilizes real-time database backup technology to achieve real-time data backup. It identifies specific database operations and performs data backups accordingly, promptly saving important data. Even if data is encrypted by ransomware, it can be recovered from the backup.

[0028] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0029] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0030] Figure 1 This is an overall flowchart of the method in an embodiment of the present invention;

[0031] Figure 2 This is a flowchart illustrating the specific processing steps of the database operation permission control component and the database real-time backup component working together in the method of this embodiment of the invention.

[0032] Figure 3 This is a schematic diagram of the user operation process in an embodiment of the present invention. Detailed Implementation

[0033] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0034] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations of the present invention.

[0035] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0036] Example 1

[0037] See appendix Figure 1 As shown, this embodiment discloses a ransomware defense method based on database permissions, including:

[0038] When a user performs a database operation, the database operation permission control component will verify the legitimacy of the operation under that role and determine whether the operation can be performed based on the context.

[0039] Meanwhile, when the real-time database backup component detects a specific preset operation, it will trigger a backup of a specific database table to ensure that if the data in the database table is encrypted by ransomware, there will be a data backup for recovery.

[0040] In this example, suspicious operations, critical data operations, and specific database operations all refer to the same thing.

[0041] The above-described solution in this embodiment detects and defends against ransomware's illegal encryption of database data by auditing and controlling database operation permissions. When suspicious operations on database table data are detected, a database table backup is triggered to prevent serious consequences caused by ransomware encryption.

[0042] Database access control is a technical measure used to protect database security by restricting users' behavior through managing and controlling their access permissions to database objects. Furthermore, specific database operations can trigger pre-defined database protection behaviors.

[0043] For the processing procedures of the database operation access control component and the database real-time backup component, please refer to the appendix. Figure 2 As shown. The role table is divided into: New member, who only has creation permission; Deletor, who only has deletion permission.

[0044] Sensitive operation list: includes encryption operations, such as... mysql The ENCODE() function call modifies the blob type.

[0045] Regarding database operation access control components:

[0046] Define different database user roles and assign corresponding permissions to each role to map database operations to roles. Specify the database operations that are allowed to be executed for each role, such as SELECT, INSERT, UPDATE, DELETE, etc., and use a database access control list (DB_ACL) to store the mapping relationship between roles and operations.

[0047] Different types of database tables are defined, categorized into protected database tables and ordinary database tables based on whether they require ransomware protection. Operations on protected database tables require a database access control list check; operations on ordinary database tables can be performed directly.

[0048] When a user initiates a database operation request, their identity is first verified and their role is determined. Then, based on the user's role and the requested operation, the database access control rule list (DB_ACL) is checked to determine whether the operation is allowed. If the user's role and the requested operation match the mapping relationship in the database access control list, the operation is allowed. The database table in the requested operation is then used to determine whether the operation can be executed.

[0049] Database access control rules take the following form:

[0050]

[0051] Here, Rule is the permission judgment rule; Rid is the role; Aid is the requested operation, including CREATE, ALTERTABLE, DELETE, UPDATE; Table is the database table object to be operated on, specifically the protected database table or the ordinary database table; Retrun The return value can be either allowed or denied.

[0052] Database access control list: Defines 2 rules:

[0053] The configuration allows the same role to be responsible for deleting and creating database tables.

[0054] To prevent the same user from modifying the type and content of a blob field in the same database table, the same user must be allowed to perform these actions.

[0055] Specifically, the database operation permission judgment rules are set as follows: According to ransomware behavior research, ransomware typically encrypts database data in the following two ways:

[0056] 1. When ransomware encrypts database data, it iterates through the database tables, creating a new table, copying the data from the original table to the new table, and then deleting the original table. To address this characteristic of ransomware, this component includes a rule: for protected database tables, a role cannot simultaneously possess both CREATE and DELETE permissions for creating and deleting database tables, thus restricting ransomware encryption operations.

[0057] Detailed rule settings instructions:

[0058] Rule 1 (Class A operator; CREATE; protect database table; return allowed)

[0059] Rule 2 (Class A operator; DELETE; protect database table; return rejection)

[0060] Rule 1 (Class B Operator; CREATE; Protect Database Table; Return Reject)

[0061] Rule2 (Class B operator; DELETE; protect database table; return allowed).

[0062] This component is configured to prevent the deletion and creation of database tables from being performed by the same user, thereby restricting unauthorized data encryption operations.

[0063] 2. When ransomware encrypts database data, it modifies the table field type to a blob type (equal length) before encryption to prevent the original field type from being insufficient to store the encrypted data. To address this characteristic of ransomware, this component includes a rule: for protected database tables, a role cannot simultaneously possess both ALTERTABLE permission and UPDATE permission to modify database table field content, thus restricting ransomware encryption operations.

[0064] Detailed rule settings instructions:

[0065] Rule 1 (Class A operator; ALTERTABLE; protect database table; return allowed)

[0066] Rule 2 (Class A operator; UPDATE; protected database table; return rejection)

[0067] Rule 1 (Class B operator; ALTERTABLE; protect database table; return rejection)

[0068] Rule2 (Class B operator; UPDATE; protected database table; return allowed).

[0069] This component sets the database access control list so that modifying the blob field type and modifying the field content in the same database table cannot be performed by the same role, thereby restricting illegal data encryption operations.

[0070] See appendix Figure 3 As shown, the database operation permission rule check method is as follows: The database operation permission control component receives a user operation request, which includes the username, operation type, and the database table object to be operated on. The component retrieves the user's role based on the username, and then checks it according to the set check rules. If the rule check result is allowed, the next operation is executed; if the check result is denied, the process terminates.

[0071] Real-time database backup component:

[0072] The real-time database backup component identifies specific database operations and performs real-time data backups. It identifies the specific database operations that need to trigger a backup and then executes the data backup task after identifying the specific database operation.

[0073] These operations include critical data operations such as INSERT, UPDATE, and DELETE, calls to database encryption functions, and other data operations of significant business importance.

[0074] Specific real-time backup rules include:

[0075] (1) Based on the characteristic that ransomware creates a new database table and then deletes the original table when encrypting data, this component is set to trigger a backup script when performing a delete operation (DELETE) on the protected database table and modifying the field type (ALTERTABLE) of the database table, and will perform the corresponding backup task on the current database table;

[0076] (2) Based on the characteristic that ransomware encrypts data by calling database encryption functions, this component is set to perform corresponding backup tasks on the encrypted database table when the database encryption function is called for the protected database table.

[0077] This embodiment's sub-solution installs a database operation permission control component, ensuring that deleting and creating database tables cannot be performed by the same role. It determines whether a database operation can be performed based on the requested operation context. The database operation permission control component sets that once a field type in the same database table is modified, operations that modify the field content are prohibited. A database backup trigger component is also installed; database table deletion and data encryption operations trigger a backup script, which performs the corresponding backup task for the current table.

[0078] Example 2

[0079] The purpose of this embodiment is to provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the above-described method.

[0080] Example 3

[0081] The purpose of this embodiment is to provide a computer-readable storage medium.

[0082] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the steps of the above method.

[0083] Example 4

[0084] The purpose of this embodiment is to provide a ransomware defense system based on database permissions, including:

[0085] The database operation permission control module is configured to: receive instructions to execute database operation requests, identify the legitimacy of the operation request under the role executing the database operation request, and determine whether the operation is currently allowed based on the context;

[0086] The real-time database backup module is configured to: if the operation is allowed, determine the type of the operation; if it is a critical data operation with significant business importance, trigger a database table backup to ensure that data in the database table is backed up and restored when it is encrypted by ransomware.

[0087] The database operation permission control component of this embodiment's sub-technical solution is designed with the following database permission rules: (1) For protected database tables, a role cannot simultaneously have the CREATE permission and the DELETE permission. (2) For protected database tables, a role cannot simultaneously have the ALTERTABLE permission and the UPDATE permission.

[0088] The real-time database backup component of this embodiment's sub-technical solution is designed with the following real-time database backup rules: (1) Performing a delete operation (DELETE) or modifying the field type (ALTERTABLE) of a protected database table will trigger a backup script, which will perform the corresponding backup task on the current database table. (2) When a database encryption function is called on a protected database table, the corresponding backup task will be performed on the encrypted database table.

[0089] This embodiment's sub-solution database operation permission control component, targeting the behavioral characteristics of ransomware, has invented database permission operation rules that can monitor and defend against encryption of data in database tables, preventing ransomware from encrypting database table data even after gaining partial database operation permissions. The real-time database backup component enables real-time data backup. It identifies specific database operations and performs data backups, promptly saving important data; data encrypted by ransomware can be recovered through backups.

[0090] Example 5

[0091] The purpose of this embodiment is to provide a computer program product containing instructions that, when run on a computer, cause the computer to perform the methods and functions involved in any of the above embodiments.

[0092] The steps and methods involved in the apparatus of the above embodiments correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.

[0093] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0094] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A ransomware defense method based on database permissions, characterized by: include: It receives instructions to execute database operation requests, verifies the legitimacy of the operation request under the role of the person executing the database operation request through the database operation permission control component, and determines whether the operation is allowed to be executed based on the context. Meanwhile, when the real-time database backup component detects a specific preset operation, it will trigger a backup of a specific database table to ensure that there is a data backup for recovery when the data in the database table is encrypted by ransomware. Among them, the preset specific operations include key data operations, including INSERT, UPDATE (modifying the content of database table fields), DELETE (deleting data), ALTERTABLE (modifying the type of database table fields), and calling database encryption functions; Call the database encryption function, specifically the ENCODE() function in mysql, to modify the blob type. Before verifying the legitimacy of a database operation request under a given role, define different database user roles and assign corresponding permissions to each role to map database operations to roles; Assigning appropriate permissions to each role maps database operations to roles, specifically: Specify the database operations that are allowed to be performed for each role, and use a database access control list to store the mapping relationship between roles and operations; Specifically, the database operation permission judgment rules are set as follows: 1) In response to the characteristic that ransomware encrypts database data by traversing the database tables, creating a new database table, copying the data from the original table to the new table, and deleting the original table, the component sets a rule: for protected database tables, a role cannot have both the permission to create a database table and the permission to delete a database table at the same time, thereby restricting ransomware encryption operations; Detailed rule settings instructions: Rule 1: Class A operator; Create new CREATE; Protect database table; Return allowed; Rule 2: Class A operator; DELETE; Protect database table; Return rejection; Rule 1: Class B operator; Create new CREATE; Protect database table; Return rejection; Rule 2: Class B operator; Delete DELETE; Protect database table; Return permission; 2) In response to the characteristic that ransomware modifies the table field type to blob and other length types before encrypting database data to avoid the original field type being too short to store the encrypted data, the component sets a rule: For protected database tables, a role cannot have both the permission to modify the database table and the permission to modify the content of the database table fields at the same time, thereby restricting the ransomware's encryption operations. Detailed rule settings instructions: Rule 1: Class A operator; modifies database table ALTERTABLE; protects database table; returns "Allow"; Rule 2: Class A operator; UPDATE statement to modify database table field content; protected database table; return rejection; Rule 1: Class B operator; Modifies database table ALTERTABLE; Protects database table; Returns rejection; Rule 2: Class B operator; UPDATE statement modifies database table field; protected database table; returns "Allow"; If the operation is permitted, its type will be determined. If it is a critical data operation with significant business importance, the real-time database backup component will trigger a database table backup to ensure that data in the database tables can be restored if the data is encrypted by ransomware. Specific real-time backup rules include: 1) Based on the characteristic of ransomware creating a new database table and then deleting the original table when encrypting data, the component is configured to trigger a backup script when performing deletion operations on the protected database table or modifying the field type of the database table, and will perform the corresponding backup task on the current database table; 2) Based on the characteristic that ransomware encrypts data by calling database encryption functions, the component is configured to perform corresponding backup tasks on the encrypted database tables when the database encryption function is called.

2. The ransomware defense method based on database permissions as described in claim 1, characterized in that, When a user initiates a database operation request, their identity is first verified and their role is determined. Then, based on the user's role and the requested operation, the database access control list is checked to determine whether the operation is allowed. Finally, the database table to be operated on is checked to determine whether the operation can be executed.

3. The ransomware defense method based on database permissions as described in claim 1, characterized in that, Database access control rules take the following form: Here, Rule is the permission judgment rule; Rid is the role; Aid is the requested operation; Table is the database table object of the operation; and Return is the return value, which can be either allowed or denied.

4. A ransomware defense system based on database permissions, employing the ransomware defense method based on database permissions as described in claim 1, characterized in that: include: The database operation permission control module is configured to: receive instructions to execute database operation requests, identify the legitimacy of the operation request under the role executing the database operation request, and determine whether the operation is allowed to be executed based on the context; The real-time database backup module is configured to: if the operation is allowed, determine the type of the operation; if it is a critical data operation with significant business importance, trigger a database table backup to ensure that data in the database table is backed up and restored when it is encrypted by ransomware.

5. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 3.

6. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method described in any one of claims 1-3.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it performs the steps of the method described in any one of claims 1-3 above.

Images