Communication auditing method, system and device of database and server

Abstract

The invention discloses a communication auditing method, system and device for a database and a server, and relates to the field of database security, and the method comprises the steps: obtaining a negotiated key and an encryption algorithm between the database and a client after the client establishes a communication connection with the database and the key negotiation between the database and the client is finished; intercepting communication data between the database and the client, and storing the communication data in a preset queue; determining a target address of the communication data, and sending the communication data to the target address; and decrypting the communication data by using the secret key and the encryption algorithm, and storing and auditing the decrypted communication data. During communication between a database and a client, communication data, a secret key and an encryption algorithm between the database and the client are intercepted, the secret key can be determined without obtaining a certificate, and the communication data are decrypted through the obtained secret key and encryption algorithm and then stored so as to realize auditing. Meanwhile, communication data can be sent back to a target address, and communication between the database and the client side is not affected.

Description

Technical Field

[0001] The present invention relates to the field of database security, and in particular to a database communication audit method, system, device and server. Background Art

[0002] Oracle Database is one of the most commonly used databases. It supports native network communication encryption, which encrypts communication data using the Diffie-Hellman (DH) algorithm. Database auditing products require plaintext communication data to audit Oracle databases. Therefore, auditing Oracle databases is impossible without addressing the native communication encryption issue. Related technologies for auditing database communication encryption rely on obtaining the database certificate, using the private key in the certificate to decrypt the communication session key, and then using the session key to decrypt the database communication data. This method only works for databases encrypted with RSA. Oracle's native communication encryption is based on the DH algorithm, a key exchange protocol for securely exchanging keys over an insecure communication channel. The DH protocol allows two users who have never communicated to negotiate a shared secret key over an insecure channel. This secret key can then be used to encrypt subsequent communications. Without a certificate, existing methods cannot decrypt the communication data during the audit process, making auditing impossible. Summary of the Invention

[0003] The present invention aims to provide a database communication auditing method, system, device, and server. These methods intercept communication data between the database and client, decrypt the data, and store it for auditing. Simultaneously, the data is sent back to the target without affecting the communication between the database and client.

[0004] To solve the above technical problems, the present invention provides a communication audit method for a database, comprising:

[0005] After the client establishes a communication connection with the database and the negotiation of the key between the database and the client is completed, obtaining the key and encryption algorithm negotiated between the database and the client;

[0006] Intercepting the communication data between the database and the client, and saving it to a preset queue;

[0007] determining a destination of the communication data and sending the communication data to the destination;

[0008] The communication data in the preset queue is decrypted using the key and the encryption algorithm, and the decrypted communication data is stored and audited.

[0009] On the other hand, after intercepting the communication data between the database and the client, the method further includes:

[0010] Determining whether there is an encryption identifier in the communication data;

[0011] If the encryption identifier does not exist, the communication data is directly audited;

[0012] If the encryption identifier exists, the process proceeds to the step of saving the encrypted data into a preset queue.

[0013] On the other hand, it also includes:

[0014] After the key negotiation between the database and the client is completed, obtaining a random decryption vector;

[0015] Decrypting the communication data in the preset queue using the key and the encryption algorithm includes:

[0016] The communication data in the preset queue is decrypted using the key, the encryption algorithm and the random decryption vector.

[0017] On the other hand, before intercepting the communication data between the database and the client and saving it in a preset queue, the method further includes:

[0018] Acquiring all communication data between the database and the client;

[0019] Determine the data belonging to the oracle process according to the name of the process where the communication data is located;

[0020] Intercept the communication data belonging to the oracle process and save it to the preset queue.

[0021] On the other hand, the communication data belonging to the oracle process is intercepted and saved to the preset queue, including:

[0022] Determining the type of data of the oracle process, the type including communication data and copied data, the copied data including a key and a random decryption vector;

[0023] Saving the communication data to a communication data queue;

[0024] Saving the key to a key queue;

[0025] The random decryption vector is saved in the random decryption vector queue.

[0026] On the other hand, decrypting the communication data in the preset queue using the key and the encryption algorithm includes:

[0027] fetching communication data from the communication data queue, fetching a key from the key queue, and fetching a random decryption vector from the random decryption vector queue;

[0028] The communication data is decrypted using an encryption algorithm, the retrieved key, and the retrieved random decryption vector.

[0029] On the other hand, determining the type of data of the oracle process includes:

[0030] Predetermining the call stack of each function in the oracle process;

[0031] Pre-set test data, control the client to send the test data to the Oracle database service using the specified encryption algorithm, and copy and save the encrypted test communication data, suspected key, and suspected random decryption vector;

[0032] Select any two call stacks from the call stacks of each function as a key and a random decryption vector, respectively, and decrypt the test communication data;

[0033] When the decrypted test communication data is identical to the test data, determining the two selected call stacks as a call stack of a key and a call stack of a random decryption vector;

[0034] The data in the call stack of the key is determined to be the key, and the data in the call stack of the random decryption vector is determined to be the random decryption vector.

[0035] To solve the above technical problems, the present invention further provides a database communication audit system, comprising:

[0036] An encrypted data acquisition unit, configured to acquire the key and encryption algorithm negotiated between the database and the client after the client establishes a communication connection with the database and the key negotiation between the database and the client is completed;

[0037] An interception unit, configured to intercept the communication data between the database and the client, and save the data into a preset queue;

[0038] a sending unit, configured to determine a target of the communication data and send the communication data to the target;

[0039] The decryption unit is used to decrypt the communication data in the preset queue using the key and the encryption algorithm, and to save and audit the decrypted communication data.

[0040] To solve the above technical problems, the present invention further provides a communication audit device for a database, comprising:

[0041] memory for storing computer programs;

[0042] The processor is configured to implement the steps of the above-mentioned database communication audit method when executing the computer program.

[0043] In order to solve the above technical problems, the present invention also provides a server including the above database communication auditing device.

[0044] The present invention discloses a database communication audit method, system, device and server, which relates to the field of database security and includes establishing a communication connection between the database and the client; after the negotiation of the key between the database and the client is completed, obtaining the key and encryption algorithm negotiated between the database and the client; intercepting the communication data between the database and the client and saving it in a preset queue; determining the target of the communication data and sending the communication data to the target; decrypting the communication data using the key and encryption algorithm, and saving and auditing the decrypted communication data. During communication between the database and the client, the communication data, key and encryption algorithm between the database and the client are intercepted, and the key can be determined without obtaining a certificate. The communication data is decrypted using the obtained key and encryption algorithm and then saved to achieve auditing. At the same time, the communication data is sent back to the target without affecting the communication between the database and the client. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the prior art and the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0046] Figure 1 A flowchart of a database communication audit method provided by the present invention;

[0047] Figure 2 A schematic diagram of the structure of a communication audit system for a database provided by the present invention;

[0048] Figure 3 This is a structural diagram of a database communication audit device provided by the present invention. DETAILED DESCRIPTION

[0049] The core of the present invention is to provide a database communication auditing method, system, device, and server. These methods intercept communication data between the database and client, decrypt it, and then store it for auditing. Simultaneously, the communication data is sent back to the target without affecting the communication between the database and client.

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0051] Figure 1 A flowchart of a database communication audit method provided by the present invention, the database communication audit method comprising:

[0052] Deploy a database traffic proxy on a Linux-based Oracle database server. The proxy writes the Oracle decryption dynamic library to the / etc / ld.so.preload file, injecting it into the Oracle service process. Only after injecting the decryption dynamic library into the Oracle service process can Oracle communication data and keys be intercepted, allowing further decryption.

[0053] Deploy a database traffic agent on the Oracle database server in the Linux system. The database traffic agent injects the Oracle decryption dynamic library into the Oracle service process through / etc / ld.so.preload.

[0054] S11: After the client establishes a communication connection with the database and the database and the client complete the key negotiation, the client obtains the key and encryption algorithm negotiated between the database and the client.

[0055] The client, such as other hosts, will establish contact with the database and perform a handshake to determine the encryption algorithm and key so that the client can subsequently decrypt the received communication data.

[0056] This application uses the Oracle decryption dynamic library to obtain the key and encryption algorithm. After the client and the Oracle server complete the negotiation of the session key, the Oracle decryption dynamic library copies the session key used for encrypting / decrypting data on the Oracle server during subsequent data communication between the client and the Oracle server.

[0057] S12: intercepting the communication data between the database and the client, and saving it to a preset queue;

[0058] The communication data is saved in a preset queue so that the communication data can be saved later. The meaning of interception is to obtain the data before the database sends the communication data to the client or before the client sends the communication data to the database.

[0059] S13: Determine a target for the communication data and send the communication data to the target;

[0060] If only the communication data is intercepted, the communication data will not be sent to the target, which will affect the normal communication between the client and the database. Therefore, it is necessary to determine the target of the communication data itself and then send it to the target to avoid affecting normal communication due to intercepted data.

[0061] S14: Decrypt the communication data in the preset queue using the key and encryption algorithm, and save and audit the decrypted communication data.

[0062] Since the communication data is stored in a preset queue, the communication data in the preset queue is decrypted using a key and an encryption algorithm, and the decrypted communication data is finally obtained and stored. Specifically, the audit may include storing the communication data as a log.

[0063] The present invention discloses a database communication auditing method, which relates to the field of database security. The method includes establishing a communication connection between a client and a database; after completing key negotiation between the database and the client, obtaining the negotiated key and encryption algorithm; intercepting communication data between the database and the client and saving it in a preset queue; determining a target for the communication data and sending the communication data to the target; decrypting the communication data using the key and encryption algorithm, and saving and auditing the decrypted communication data. During communication between the database and the client, the communication data between the database and the client is intercepted, decrypted, and saved for auditing. Simultaneously, the communication data is sent back to the target, without affecting communication between the database and the client.

[0064] Based on the above embodiment:

[0065] In some embodiments, after intercepting the communication data between the database and the client, the method further includes:

[0066] Determine whether there is an encryption identifier in the communication data;

[0067] If there is no encryption mark, the communication data will be audited directly;

[0068] If there is an encryption mark, the process proceeds to the step of saving to the preset queue.

[0069] After the client establishes a connection with the Oracle server through the database driver provided by Oracle, the Oracle decryption dynamic library parses the communication data between the client and the server to determine whether the client and the Oracle server have adopted Oracle's native encryption function. This step is based on whether the encryption is used in the message negotiated for encryption during the communication between the client and the Oracle server. For encrypted scenarios, it also includes the type of encryption algorithm used. Connections that do not use Oracle's native encryption function are not processed. For connections that use Oracle's native encryption function, the client and Oracle server negotiate the conversation key data to obtain the type of symmetric encryption algorithm used for data communication, which can be AES128 / AES192 / AES256, etc. This application does not make too many restrictions here.

[0070] In some embodiments, it further includes:

[0071] After the key negotiation between the database and the client is completed, a random decryption vector is obtained;

[0072] Decrypt the communication data in the preset queue using the key and encryption algorithm, including:

[0073] The communication data in the preset queue is decrypted using a key, an encryption algorithm and a random decryption vector.

[0074] After the client and Oracle server negotiate the session key, the Oracle decryption dynamic library copies the session key and initialization vector used by the Oracle server to encrypt and decrypt data during subsequent data communications. The Oracle decryption dynamic library uses the copied session key and initialization vector along with the parsed symmetric encryption algorithm to decrypt the data communicated between the client and Oracle server. The decrypted data is then passed to the traffic proxy, which then passes the decrypted database traffic data to the database audit service for auditing.

[0075] In order to improve the reliability of encryption, a random decryption vector is used in the encryption process. The initialization vector is the random decryption vector. The random decryption vector can be used to transmit data more securely.

[0076] In some embodiments, before intercepting the communication data between the database and the client and saving it in a preset queue, the method further includes:

[0077] Get all communication data between the database and the client;

[0078] Determine the data belonging to the Oracle process based on the name of the process where the communication data is located;

[0079] Intercept the communication data belonging to the oracle process and save it to the preset queue.

[0080] The Linux system defines an identical function, func_wrap, for copying data and communicating with sockets. The Linux system prioritizes loading the dynamic library in the / etc / ld.so.preload file over other dynamic libraries. Therefore, calling the func function in a program actually calls the func_wrap function. func_wrap uses dlsym to find the actual func function address. It then calls the actual func function and identifies the Oracle process based on the process name. Only then does it intercept the Oracle process.

[0081] In some embodiments, intercepting communication data belonging to an oracle process and saving it to a preset queue includes:

[0082] Determine the type of data in the oracle process, which includes communication data and copied data. The copied data includes the key and random decryption vector.

[0083] Save the communication data to the communication data queue;

[0084] Save the key to the key queue;

[0085] Save the random decryption vector to the random decryption vector queue.

[0086] For copy data functions, the function call stack is used to identify whether the copied data is the session key, initialization vector, or other data. The session key and initialization vector are copied and saved to the session key queue and initialization vector queue, respectively. For socket communication functions, the communication data is copied and saved to the communication data queue. Saving different functions to corresponding queues makes subsequent use more convenient.

[0087] In some embodiments, decrypting the communication data in the preset queue using a key and an encryption algorithm includes:

[0088] Take out the communication data from the communication data queue, take out the key from the key queue, and take out the random decryption vector from the random decryption vector queue;

[0089] The communication data is decrypted using the encryption algorithm, the extracted key and the extracted random decryption vector.

[0090] After obtaining the conversation key, the Oracle decryption dynamic library starts a decryption thread. The decryption thread takes out the conversation key, initialization vector and communication data from the conversation key queue, initialization vector queue and communication data queue respectively, decrypts the communication data with the conversation key and initialization vector, and sends the decrypted communication data to the traffic agent.

[0091] In some embodiments, determining the type of data for the oracle process includes:

[0092] Predetermine the call stack of each function in the Oracle process;

[0093] Pre-set test data, control the client to send the test data to the Oracle database service using the specified encryption algorithm, and copy the encrypted test communication data, suspected keys, and suspected random decryption vectors;

[0094] Select any two call stacks from the call stacks of each function as the key and random decryption vector respectively, and decrypt the test communication data;

[0095] When the decrypted test communication data is identical to the test data, the two selected call stacks are determined as the call stack of the key and the call stack of the random decryption vector;

[0096] The data in the call stack for determining the key is the key, and the data in the call stack for determining the random decryption vector is the random decryption vector.

[0097] For software programs, copy data functions are fundamental functions. Developers develop software using these fundamental functions. The call stacks of these fundamental functions can be used to distinguish their purpose, such as identifying session keys, initialization vectors, or other data.

[0098] As for how to find the call stack of the conversation key and initialization vector, this is analyzed based on the test data. That is, at the beginning, you don't know which call stack is the conversation key and initialization vector, but you know what the test data is. You can use the obtained encrypted communication data and the intercepted copy data, and use the copied data as the conversation key and initialization vector to reverse parse the encrypted communication data. When the key and initialization vector are correct, the decrypted communication data can see the test data; when the key and initialization vector are wrong, the decrypted communication data cannot see the test data.

[0099] That is, there are multiple call stacks, but we don't know what the data in the call stack is. Therefore, this application randomly selects two call stacks as the key and random decryption vector for decryption respectively. If the correspondence between the call stack and the key and the random decryption vector is correct, then the communication data can be successfully decrypted to obtain the same data as the test data. If the correspondence is incorrect, decryption cannot be performed and the call stack needs to be reselected.

[0100] The above process belongs to the process of reverse analysis of the conversation key and initialization vector function call stack. After the analysis is completed, these are not needed in the subsequent decryption process.

[0101] Figure 2 This is a schematic diagram of the structure of a database communication audit system provided by the present invention, which includes:

[0102] The encrypted data acquisition unit 21 is used to acquire the key and encryption algorithm negotiated between the database and the client after the client establishes a communication connection with the database and the key negotiation between the database and the client is completed;

[0103] The interception unit 22 is used to intercept the communication data between the database and the client and save it to a preset queue;

[0104] The sending unit 23 is used to determine the target address of the communication data and send the communication data to the target;

[0105] The decryption unit 24 is used to decrypt the communication data in the preset queue using a key and an encryption algorithm, and to store and audit the decrypted communication data.

[0106] Based on the above embodiment, the following further aspects are included:

[0107] The encryption identification judgment unit is used to judge whether there is an encryption identification in the communication data; if not, the audit unit is triggered; if so, it is saved to the preset queue;

[0108] Audit unit, used to directly audit communication data;

[0109] A random decryption vector acquisition unit, configured to acquire a random decryption vector after the key negotiation between the database and the client is completed;

[0110] The decryption unit 24 is specifically configured to decrypt the communication data in the preset queue using a key, an encryption algorithm, and a random decryption vector.

[0111] All communication data acquisition unit, used to acquire all communication data between the database and the client;

[0112] a process determination unit, configured to determine data belonging to an Oracle process based on a name of the process where the communication data resides;

[0113] The interception unit 22 is specifically used to intercept the communication data belonging to the oracle process and save it into a preset queue.

[0114] The interception unit 22 is specifically used to determine the type of data of the oracle process, which includes communication data and copied data, and the copied data includes a key and a random decryption vector;

[0115] Save the communication data to the communication data queue;

[0116] Save the key to the key queue;

[0117] Save the random decryption vector to the random decryption vector queue;

[0118] A calling unit, configured to retrieve communication data from a communication data queue, retrieve a key from a key queue, and retrieve a random decryption vector from a random decryption vector queue;

[0119] The decryption unit 24 is specifically configured to decrypt the communication data using the encryption algorithm, the retrieved key, and the retrieved random decryption vector.

[0120] The calling unit is specifically used to predetermine the call stack of each function in the Oracle process;

[0121] Pre-set test data, control the client to use the test data to send to the Oracle database service using the specified encryption algorithm and copy the encrypted test communication data, suspected key, and suspected random decryption vector;

[0122] Select any two call stacks from the call stacks of each function as the key and random decryption vector respectively, and decrypt the test communication data;

[0123] When the decrypted test communication data is identical to the test data, the two selected call stacks are determined as the call stack of the key and the call stack of the random decryption vector;

[0124] The data in the call stack for determining the key is the key, and the data in the call stack for determining the random decryption vector is the random decryption vector.

[0125] For an introduction to the communication audit system of the database provided in this application, please refer to the above embodiment and will not be repeated here.

[0126] Figure 3 This is a schematic diagram of the structure of a communication audit device for a database provided by the present invention, the communication audit device for the database comprising:

[0127] Memory 31, for storing computer programs;

[0128] The processor 32 is configured to implement the steps of the above-mentioned database communication audit method when executing a computer program.

[0129] For an introduction to the communication audit device for the database provided in this application, please refer to the above embodiments and will not be repeated here.

[0130] The present application also provides a server including the communication auditing device of the above-mentioned database.

[0131] For an introduction to the server provided in this application, please refer to the above embodiment and will not be repeated here.

[0132] It should also be noted that, in this specification, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0133] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0134] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A communication audit method for a database, characterized in that: include: After the client establishes a communication connection with the database and the negotiation of the key between the database and the client is completed, obtaining the key and encryption algorithm negotiated between the database and the client; Intercepting the communication data between the database and the client, and saving it in a preset queue; determining a target of the communication data, and sending the communication data to the target; The communication data in the preset queue is decrypted using the key and the encryption algorithm, and the decrypted communication data is stored and audited.

2. The communication audit method of a database as claimed in claim 1, characterized in that: After intercepting the communication data between the database and the client, the method further includes: Determining whether there is an encryption mark in the communication data; If the encryption mark does not exist, the communication data is directly audited; If the encryption identifier exists, the step of saving to a preset queue is entered.

3. The communication audit method of a database as claimed in claim 1, characterized in that: Also includes: After the negotiation of the key between the database and the client is completed, obtaining a random decryption vector; Decrypting the communication data in the preset queue using the key and the encryption algorithm includes: The communication data in the preset queue is decrypted using the key, the encryption algorithm and the random decryption vector.

4. The communication audit method of a database according to any one of claims 1 to 3, characterized in that: Intercepting the communication data between the database and the client and saving it to a preset queue includes: Acquire all communication data between the database and the client; Determine the data belonging to the oracle process according to the name of the process where the communication data is located; Intercept the communication data belonging to the oracle process and save it to the preset queue.

5. The communication audit method of a database as claimed in claim 4, characterized in that: Intercept the communication data belonging to the oracle process and save it to the preset queue, including: Determine the type of data of the oracle process, the type including communication data and copy data, the copy data including a key and a random decryption vector; Saving the communication data to a communication data queue; Saving the key to a key queue; The random decryption vector is saved in the random decryption vector queue.

6. The communication audit method of a database as claimed in claim 5, characterized in that: Decrypting the communication data in the preset queue using the key and the encryption algorithm includes: fetching communication data from the communication data queue, fetching a key from the key queue, and fetching a random decryption vector from the random decryption vector queue; The communication data is decrypted using an encryption algorithm, the retrieved key, and the retrieved random decryption vector.

7. The communication audit method of a database as claimed in claim 5, characterized in that: Determine the type of data of the oracle process, including: Predetermining the call stack of each function in the oracle process; Pre-set test data, control the client to send the test data to the Oracle database service using the specified encryption algorithm, and copy and save the encrypted test communication data, suspected key data, and suspected random decryption vector; Select any two call stacks from the call stacks of each function as the call stacks of the key and the random decryption vector respectively, and decrypt the test communication data; When the decrypted test communication data is identical to the test data, determining the selected two call stacks as a call stack of a key and a call stack of a random decryption vector; The data in the call stack of the key is determined to be the key, and the data in the call stack of the random decryption vector is determined to be the random decryption vector.

8. A database communication audit system, characterized in that: include: An encrypted data acquisition unit, used for acquiring the key and encryption algorithm negotiated between the database and the client after the client establishes a communication connection with the database and the negotiation of the key between the database and the client is completed; An interception unit, used for intercepting the communication data between the database and the client, and saving it into a preset queue; a sending unit, configured to determine a target of the communication data and send the communication data to the target; A decryption unit is used to decrypt the communication data in the preset queue using the key and the encryption algorithm, and to store and audit the decrypted communication data.

9. A communication audit device for a database, characterized in that: include: Memory for storing computer programs; A processor is used to implement the steps of the database communication audit method as described in any one of claims 1 to 7 when executing the computer program.

10. A server, characterized in that: A communications audit device comprising a database as claimed in claim 9.

Images