Database security protection method and device

Abstract

The invention provides a database security protection method and device, and the method comprises the steps: building a connection with a target database which provides behavior detection after identity authentication information passes verification; collecting database operation traffic of the target database; performing protocol analysis on the database operation flow based on a database security protection protocol, and restoring the target SQL operation; detecting SQL operation information corresponding to the target SQL operation according to a behavior detection rule, wherein the behavior detection rule comprises a corresponding relationship between behavior information and an SQL operation type; if the target SQL operation is matched with the behavior detection rule, judging whether the target SQL operation is a high-risk operation or not; if it is judged that the target SQL operation is the high-risk operation, the target SQL operation is blocked, and an alarm is generated according to needs; if it is judged that the target SQL operation is the normal operation, an SQL statement corresponding to the target SQL operation is sent to the target database and executed. According to the method, database behaviors are analyzed, high-risk operation of the database is blocked, and the safety of a database system is improved.

Description

Technical Field

[0001] The present application relates to the technical field of database security protection, and in particular to a database security protection method and device. Background Art

[0002] Database security protection refers to the technology of analyzing SQL (Structured Query Language) statements and grammatical features in the database communication protocol, identifying high-risk operations, and using actions such as alarms and blocking to protect the database.

[0003] Database security protection technology is centered on security events (any event that attempts to change the security status of the information system, such as changing access control measures, changing security levels, changing user passwords, etc.) and is based on comprehensive and precise audits. It monitors and records various database operations, including checks on various settings of the database system, known vulnerabilities in the database system software itself, and the integrity of the database system. It assesses the overall security of the database system, promptly discovers and reports possible security risks, identifies high-risk operations, and uses actions such as alarms and blocking to protect the database and enhance database security.

[0004] Database security directly affects all aspects of data security such as national security, economic security, military security, etc. Therefore, it is necessary to provide a database security protection solution to improve the security of the database system. Summary of the invention

[0005] The present application shows a database security protection method and device to improve the security of the database system.

[0006] In a first aspect, the present application shows a database security protection method, which is applied to a database security protection server, and the method includes:

[0007] After the identity authentication information is verified, a connection is established with the target database that provides behavior detection;

[0008] Collecting database operation traffic of the target database;

[0009] Perform protocol parsing on the database operation traffic based on the database security protection protocol to restore the target SQL operation;

[0010] Detecting SQL operation information corresponding to the target SQL operation according to a preset behavior detection rule, wherein the behavior detection rule includes a correspondence between behavior information and SQL operation type;

[0011] If the target SQL operation matches the behavior detection rule, determining whether the target SQL operation is a high-risk operation;

[0012] If the target SQL operation is determined to be a high-risk operation, the target SQL operation is blocked and an alarm is generated as needed; if the target SQL operation is determined to be a normal operation, a SQL statement corresponding to the target SQL operation is sent to the target database and executed.

[0013] Optionally, the step of establishing a connection with a target database providing behavior detection after the identity authentication information is verified includes:

[0014] The application system client receives a database connection request input by a user carrying user authentication information, wherein the user authentication information includes at least a user name and a login password;

[0015] If the user authentication information passes the verification, a database session connection is established between the database security protection server and the target database.

[0016] Optionally, the step of collecting database operation traffic of the target database includes:

[0017] The database security protection server receives database operation traffic collected by the database server using a traffic probe in a diversion manner.

[0018] Optionally, before the step of performing protocol parsing on the database operation traffic based on the database security protection protocol to restore the target SQL operation, the step further includes:

[0019] The database operation traffic collected by using the traffic probe is reassembled into traffic packets, and the traffic packet reassembly includes sorting, deduplication, and packet loss processing of the collected database traffic.

[0020] Optionally, the step of performing protocol parsing on the database operation traffic based on the database security protection protocol to restore the target SQL operation includes:

[0021] The data flow packets corresponding to the target database after message reassembly are subjected to deep protocol analysis based on the network protocol stack until the database application layer protocol is parsed, and behavioral information is extracted. The behavioral information includes at least data source information, database information, access behavior and operation type, return information, access time information, and SQL standardization processing.

[0022] In a second aspect, the present application shows a database security protection device, which is applied to a database security protection server, and the device includes:

[0023] The database access module is used to establish a connection with the target database that provides behavior detection after the identity authentication information is verified;

[0024] An operation flow collection module, used to collect database operation flow of the target database;

[0025] An SQL operation parsing module is used to perform protocol parsing on the database operation traffic based on the database security protection protocol and restore the target SQL operation;

[0026] An SQL operation information detection module, used to detect the SQL operation information corresponding to the target SQL operation according to a preset behavior detection rule, wherein the behavior detection rule includes a correspondence between behavior information and SQL operation type;

[0027] An operation type judgment module, used to judge whether the target SQL operation is a high-risk operation when the target SQL operation matches the behavior detection rule;

[0028] The database security protection module is used to block the target SQL operation when it is determined that the target SQL operation is a high-risk operation and generate an alarm as needed; and when it is determined that the target SQL operation is a normal operation, send the SQL statement corresponding to the target SQL operation to the target database and execute it.

[0029] Optionally, the database access module is specifically used for the application system client to receive a database connection request input by a user carrying user authentication information, and the user authentication information includes at least a user name and a login password; if the user authentication information passes the verification, a database session connection is established between the database security protection server and the target database.

[0030] Optionally, the operation traffic collection module is specifically used for the database security protection server to receive database operation traffic collected by the database server in a drainage manner using a traffic probe.

[0031] Optionally, the device also includes a traffic message reassembly module, which is used to perform traffic message reassembly on the database operation traffic collected using a traffic probe before performing protocol parsing on the database operation traffic based on the database security protection protocol and restoring the target SQL operation. The traffic message reassembly includes sorting, deduplication, and packet loss processing on the collected database traffic.

[0032] Optionally, the SQL operation parsing module is specifically used to perform deep protocol analysis on the data traffic packets corresponding to the target database after message reassembly based on the network protocol stack until the database application layer protocol is parsed, and behavior information is extracted. The behavior information includes at least data source information, database information, access behavior and operation type, return information, access time information, and SQL standardization processing.

[0033] In a third aspect, the present application shows an electronic device, which includes: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the method described in any of the above aspects.

[0034] In a fourth aspect, the present application illustrates a non-temporary computer-readable storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute a method as described in any of the above aspects.

[0035] In a fifth aspect, the present application illustrates a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to execute the method described in any of the above aspects.

[0036] The technical solution provided by this application may have the following beneficial effects:

[0037] In database security protection, the data flow packets of the target database are received and parsed to obtain the SQL operation behavior and content, and then the behavior analysis of the target database is performed based on the behavior information to determine whether the SQL operation is a high-risk operation. If it is determined to be a high-risk operation, the high-risk operation of the target database is blocked. Specifically, the database operation behavior and content obtained from the protocol parsing results are detected using predefined detection rules, and high-risk operations are filtered out and blocked and alarmed. It can be seen that this application analyzes database behavior and blocks high-risk database operations, thereby improving the security of the database system. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 The overall architecture diagram of the database security protection solution provided for this application.

[0039] Figure 2 A flowchart of the database security protection method provided in this application.

[0040] Figure 3 A flowchart of database access control provided by this application.

[0041] Figure 4 A flow chart for collecting database operation traffic provided in this application.

[0042] Figure 5 A flow chart of the database message reorganization process provided by this application.

[0043] Figure 6 A flow chart of the database operation flow protocol parsing process after database message reorganization provided in this application.

[0044] Figure 7 A flowchart of database security protection provided for this application.

[0045] Figure 8 An architectural diagram of the database security protection solution provided for this application.

[0046] Fig. 9 This is a structural block diagram of the database security protection device of the present application.

[0047] Fig.10 A block diagram of an electronic device of the present application.

[0048] Fig.11 A block diagram of an electronic device of the present application. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0050] Database security protection technology generally uses database proxy technology. Specifically, first obtain and forward database traffic, and then use protocol analysis to identify the protocol type and content in the database traffic. For example, first establish a connection, login authentication, data query, data insertion, data update, data deletion and result return, and then use pattern matching technology to match and identify the operation behavior, obtain high-risk operations, and issue alarms or block high-risk operations.

[0051] In order to improve the security of the database system, this application shows a database security protection method and device. Before describing the solution of this application, the overall technical solution of this application is first introduced. Figure 1As shown in the figure, the core architecture of this technical solution involves three parts: database layer, data collection layer and business processing layer. The database layer provides the data source for behavior detection and supports functions such as data storage and data processing; the data collection layer is responsible for collecting database operation traffic and supports two methods of collecting database traffic: mirror traffic and probe diversion; the business processing layer performs traffic grouping, protocol analysis, SQL standardization, behavior detection and high-risk operation protection on the database traffic from the data collection layer.

[0052] The database security protection method proposed in this application is described below.

[0053] Embodiment 1

[0054] Reference Figure 2 , a database security protection method is shown for this application, which is applied to a database security protection server, and the method includes:

[0055] Step S101: after the identity authentication information is verified, a connection is established with a target database providing behavior detection.

[0056] It should be noted that behavior detection refers to the process of analyzing database operation traffic to obtain operation behaviors and objects in order to identify high-risk database operations.

[0057] In one case, see Figure 3 , which is a flowchart of the database access control provided in this application, mainly involves the interaction process between the application system and the database server. It can be seen that after the user enters the database connection information in the application system, a connection can be established with the target database that provides behavior detection in the following manner: the application system client receives a database connection request input by the user that carries user authentication information, and the user authentication information includes at least a user name and a login password; if the user authentication information passes the verification, a database session connection is established between the database security protection server and the target database. It can be seen that whether the connection with the target database can be successfully established depends on Figure 3 Whether the identity authentication is passed, that is, whether the user authentication information is passed, if it is passed, a session with the target database is established, if it is not passed, the connection with the target database is blocked. It can be seen that by performing identity authentication on database access control, database access by unauthorized users can be effectively reduced and the security of the database system can be improved.

[0058] Step S102: collecting database operation traffic of the target database.

[0059] In one case, the database security protection server receives the database operation traffic collected by the database server using the traffic probe in a diversion manner. Figure 4 , is a flow chart of collecting database operation traffic provided by this application, Figure 4 The interactive process among the application system, database server and database security protection server during the process of collecting database operation traffic is shown. Specifically, the database traffic is obtained by using the traffic probe diversion method. First, the probe program is deployed on the database server where the target database is located, and the probe is configured, such as the network card name and the associated database name of the probe collection traffic. After the probe configuration is completed, the database security protection program connects to the probe. Then, when the application operates the database, the traffic flowing through the network card monitored by the probe to operate the database will be captured and forwarded to the database security protection program. After receiving the traffic, the database security protection program reorganizes the traffic message and performs protocol parsing. It should be noted that the above-mentioned probe diversion method is only the database operation traffic collection method provided by this application. This application can also use other methods for collection, such as the mirror traffic collection method.

[0060] Step S103: performing protocol parsing on the database operation traffic based on the database security protection protocol, and restoring the target SQL operation.

[0061] In a preferred implementation, before performing protocol analysis on the database operation traffic in step S03, the database operation traffic collected by the traffic probe can also be reassembled into traffic messages, and the traffic message reassembly includes sorting, deduplication, and packet loss processing of the collected database traffic. Accordingly, the data traffic packets corresponding to the target database after message reassembly are subjected to deep protocol analysis based on the network protocol stack until the database application layer protocol is parsed, and behavior information is extracted, and the behavior information at least includes data source information, database information, access behavior and operation type, return information, access time information, and SQL standardization processing.

[0062] In one example of this application, see Figure 5 and Figure 6 , an overall description is given of the database message reorganization process and the reorganized database operation traffic protocol parsing process. Figure 5 A flow chart for database message reassembly provided for this application requires that the database operation traffic packets forwarded by the probes received by the database security protection may have various complex situations such as packet loss, disorder, and duplicate packets. After sorting, deduplication, and packet loss processing of the received network packets, high-quality data streams can be output to the subsequent protocol analysis link. Figure 6 A flowchart of the database operation traffic protocol parsing process after the database message reorganization provided by this application. Specifically, the data traffic packet is deeply parsed based on the network protocol stack, and the protocol is parsed all the way to the database application layer, from which the following behavior information is extracted:

[0063] (1) Data source information, including client IP, client port, application name, MAC address, database user name, etc.

[0064] (2) Database information, including database IP, database port, database schema, table name, SQL statement, etc.

[0065] (3) Access behavior and operation type, where the operation type refers to the operation type under the categories of data definition language DDL, data manipulation language DML, data query language DQL, and data control language DCL, for example, DML operations SELECT / INSERT / UPDATE / DELETE under the category of data manipulation language DML;

[0066] (4) Return information, including return results, execution time, number of returned rows / number of affected rows, error code, result set, etc.

[0067] (5) Access time information, including access time and access timestamp;

[0068] (6) SQL standardization processing, including standardization of audited SQL statements and generation of SQL templates.

[0069] Step S104: Detecting the SQL operation information corresponding to the target SQL operation according to a preset behavior detection rule, wherein the behavior detection rule includes a correspondence between behavior information and SQL operation type.

[0070] It should be noted that this application does not limit the specific method of establishing detection rules. For example, a machine learning method can be used to train a model using training data consisting of a large amount of behavior information and SQL operation types, and then obtain detection rules; the SQL operation type of the behavior information can also be determined based on empirical values. This is only an example and does not constitute a limitation on the method of setting behavior detection rules in this application.

[0071] Step S105: If the target SQL operation matches the behavior detection rule, determine whether the target SQL operation is a high-risk operation; if the target SQL operation is determined to be a high-risk operation, execute step S106; if the target SQL operation is determined to be a normal operation, execute step S106.

[0072] Step S106: blocking the target SQL operation and generating an alarm as needed;

[0073] Step S107: Sending the SQL statement corresponding to the target SQL operation to the target database and executing it.

[0074] Combine the following Figure 7 This paper describes the database security protection process based on behavior detection. Figure 7 The figure shows a flowchart of database security protection provided by this application. Specifically, database security protection behavior detection matches SQL operations with object data through detection rules. If they match, the operation type defined by the rule is used to determine whether the SQL operation is a high-risk operation. If it is a high-risk operation, SQL execution is blocked and an alarm is generated as needed; if it is a normal access, SQL execution is allowed.

[0075] In database security protection, the data flow packets of the target database are received and parsed to obtain the SQL operation behavior and content, and then the behavior analysis of the target database is performed based on the behavior information to determine whether the SQL operation is a high-risk operation. If it is determined to be a high-risk operation, the high-risk operation of the target database is blocked. Specifically, the database operation behavior and content obtained from the protocol parsing results are detected using predefined detection rules, and high-risk operations are filtered out and blocked and alarmed. It can be seen that this application analyzes database behavior and blocks high-risk database operations, thereby improving the security of the database system.

[0076] The following is a specific example to illustrate the database security protection solution provided by this application. Figure 8 As shown in FIG. 1 , a schematic diagram of the database security protection solution provided by this application is shown. Figure 8 It includes the complete interaction process between the administrator, the security server (i.e., the server where the application system is located), the security agent (i.e., the database security protection server) and the database server. Specifically, database security protection mainly realizes the detection and protection of database access and operation behaviors. During the implementation process, an access behavior control module is provided to support configuration functions such as access control policies, authorization, and authentication. The configuration content includes rules, policies, etc., and then the configured rules and policies are published to support rule / policy matching. An SQL parsing engine is provided to support functions such as traffic parsing and SQL standardization processing; lexical and grammatical analysis is performed on the SQL statements to be executed, and an SQL template is generated to facilitate rule / policy matching. The policy / rule matching engine is used to detect SQL operations in real time, and determine whether the operation is a high-risk operation based on the detection results. If it is a high-risk operation, the execution is blocked; if it is a normal operation, the execution is released. The disposal process needs to record logs to support log audit management.

[0077] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions involved are not necessarily required by the present application.

[0078] Embodiment 2

[0079] Reference Fig. 9 , is a structural block diagram of a database security protection device of the present application, the database security protection device is applied to a database security protection server, and the device includes:

[0080] The database access module 210 is used to establish a connection with a target database providing behavior detection after the identity authentication information is verified;

[0081] An operation traffic collection module 220 is used to collect database operation traffic of the target database;

[0082] SQL operation parsing module 230, used to perform protocol parsing on the database operation traffic based on the database security protection protocol, and restore the target SQL operation;

[0083] An SQL operation information detection module 240 is used to detect the SQL operation information corresponding to the target SQL operation according to a preset behavior detection rule, wherein the behavior detection rule includes a correspondence between behavior information and SQL operation type;

[0084] An operation type determination module 250, configured to determine whether the target SQL operation is a high-risk operation when the target SQL operation matches the behavior detection rule;

[0085] The database security protection module 260 is used to block the target SQL operation when it is determined that the target SQL operation is a high-risk operation and generate an alarm as needed; and when it is determined that the target SQL operation is a normal operation, send the SQL statement corresponding to the target SQL operation to the target database and execute it.

[0086] In database security protection, the data flow packets of the target database are received and parsed to obtain the SQL operation behavior and content, and then the behavior analysis of the target database is performed based on the behavior information to determine whether the SQL operation is a high-risk operation. If it is determined to be a high-risk operation, the high-risk operation of the target database is blocked. Specifically, the database operation behavior and content obtained from the protocol parsing results are detected using predefined detection rules, and high-risk operations are filtered out and blocked and alarmed. It can be seen that this application analyzes database behavior and blocks high-risk database operations, thereby improving the security of the database system.

[0087] In one scenario, the database access module 210 is specifically used for the application system client to receive a database connection request input by a user carrying user authentication information, and the user authentication information includes at least a user name and a login password; if the user authentication information passes the verification, a database session connection is established between the database security protection server and the target database.

[0088] In one case, the operation traffic collection module 220 is specifically used for the database security protection server to receive the database operation traffic collected by the database server using a traffic probe in a diversion manner.

[0089] In one embodiment of the present application, the device may also include a traffic message reassembly module, which is used to perform traffic message reassembly on the database operation traffic collected using a traffic probe before performing protocol parsing on the database operation traffic based on the database security protection protocol and restoring the target SQL operation. The traffic message reassembly includes sorting, deduplication, and packet loss processing on the collected database traffic.

[0090] In one scenario, the SQL operation parsing module 230 is specifically used to perform deep protocol parsing on the data traffic packet corresponding to the target database after message reassembly based on the network protocol stack until the database application layer protocol is parsed, and behavior information is extracted, and the behavior information includes at least data source information, database information, access behavior and operation type, return information, access time information, and SQL standardization processing.

[0091] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0092] Embodiment 3

[0093] Optionally, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0094] Embodiment 4

[0095] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0096] Embodiment 5

[0097] The present application shows a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to execute the method as described in any one of the above aspects.

[0098] FIG10 is a block diagram of an electronic device 800 shown in the present application. For example, the electronic device 800 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0099] Reference Fig.10 , the electronic device 800 may include one or more of the following components: a processing component 802 , a memory 804 , a power component 806 , a multimedia component 808 , an audio component 810 , an input / output (I / O) interface 812 , a sensor component 814 , and a communication component 816 .

[0100] The processing component 802 generally controls the overall operation of the electronic device 800, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to complete all or part of the steps of the above method. In addition, the processing component 802 may include one or more modules to facilitate the interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate the interaction between the multimedia component 808 and the processing component 802.

[0101] The memory 804 is configured to store various types of data to support operations on the device 800. Examples of such data include instructions for any application or method operating on the electronic device 800, contact data, phone book data, messages, images, videos, etc. The memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0102] The power supply component 806 provides power to the various components of the electronic device 800. The power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 800.

[0103] The multimedia component 808 includes a screen that provides an output interface between the electronic device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. When the device 800 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0104] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC), and when the electronic device 800 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 804 or sent via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals.

[0105] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: home button, volume button, start button, and lock button.

[0106] The sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the electronic device 800. For example, the sensor assembly 814 can detect the open / closed state of the device 800, the relative positioning of components, such as the display and keypad of the electronic device 800, and the sensor assembly 814 can also detect the position change of the electronic device 800 or a component of the electronic device 800, the presence or absence of contact between the user and the electronic device 800, the orientation or acceleration / deceleration of the electronic device 800, and the temperature change of the electronic device 800. The sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 814 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0107] The communication component 816 is configured to facilitate wired or wireless communication between the electronic device 800 and other devices. The electronic device 800 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast operation information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0108] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0109] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, and the instructions can be executed by a processor 820 of an electronic device 800 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0110] Fig.111 is a block diagram of an electronic device 1900 shown in the present application. For example, the electronic device 1900 may be provided as a server.

[0111] Reference Fig.11 , the electronic device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions executable by the processing component 1922, such as an application. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0112] The electronic device 1900 may also include a power supply component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input / output (I / O) interface 1958. The electronic device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™ or the like.

[0113] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0114] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0115] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0116] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the present application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0117] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0118] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0119] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0120] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0121] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0122] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A database security protection method, characterized in that: Applied to a database security protection server, the method comprises: After the identity authentication information is verified, a connection is established with the target database that provides behavior detection; Collecting database operation traffic of the target database; Perform protocol parsing on the database operation traffic based on the database security protection protocol to restore the target SQL operation; Detecting SQL operation information corresponding to the target SQL operation according to a preset behavior detection rule, wherein the behavior detection rule includes a correspondence between behavior information and SQL operation type; If the target SQL operation matches the behavior detection rule, determining whether the target SQL operation is a high-risk operation; If the target SQL operation is determined to be a high-risk operation, the target SQL operation is blocked and an alarm is generated as needed; if the target SQL operation is determined to be a normal operation, a SQL statement corresponding to the target SQL operation is sent to the target database and executed.

2. The database security protection method according to claim 1, characterized in that: The step of establishing a connection with a target database providing behavior detection after the identity authentication information is verified includes: The application system client receives a database connection request input by a user carrying user authentication information, wherein the user authentication information includes at least a user name and a login password; If the user authentication information passes the verification, a database session connection is established between the database security protection server and the target database.

3. The database security protection method according to claim 1, characterized in that: The step of collecting the database operation traffic of the target database includes: The database security protection server receives database operation traffic collected by the database server using a traffic probe in a diversion manner.

4. The database security protection method according to claim 3, characterized in that: Before the step of performing protocol parsing on the database operation traffic based on the database security protection protocol to restore the target SQL operation, the method further includes: The database operation traffic collected by using the traffic probe is reassembled into traffic packets, and the traffic packet reassembly includes sorting, deduplication, and packet loss processing of the collected database traffic.

5. The database security protection method according to claim 4, characterized in that: The step of performing protocol parsing on the database operation traffic based on the database security protection protocol and restoring the target SQL operation includes: The data flow packets corresponding to the target database after message reassembly are subjected to deep protocol analysis based on the network protocol stack until the database application layer protocol is parsed, and behavioral information is extracted. The behavioral information includes at least data source information, database information, access behavior and operation type, return information, access time information, and SQL standardization processing.

6. A database security protection device, characterized in that: Applied to a database security protection server, the device comprises: The database access module is used to establish a connection with the target database that provides behavior detection after the identity authentication information is verified; An operation flow collection module, used to collect the database operation flow of the target database; An SQL operation parsing module is used to perform protocol parsing on the database operation traffic based on the database security protection protocol and restore the target SQL operation; An SQL operation information detection module, used to detect the SQL operation information corresponding to the target SQL operation according to a preset behavior detection rule, wherein the behavior detection rule includes a correspondence between behavior information and SQL operation type; An operation type judgment module, used to judge whether the target SQL operation is a high-risk operation when the target SQL operation matches the behavior detection rule; The database security protection module is used to block the target SQL operation when it is determined that the target SQL operation is a high-risk operation and generate an alarm as needed; and when it is determined that the target SQL operation is a normal operation, send the SQL statement corresponding to the target SQL operation to the target database and execute it.

7. The database security protection device according to claim 6, characterized in that: The database access module is specifically used for the application system client to receive a database connection request input by a user carrying user authentication information, wherein the user authentication information at least includes a user name and a login password; if the user authentication information passes the verification, a database session connection is established between the database security protection server and the target database.

8. The database security protection device according to claim 6, characterized in that: The operation traffic collection module is specifically used for the database security protection server to receive the database operation traffic collected by the database server using the traffic probe in a drainage manner.

9. The database security protection device according to claim 8, characterized in that: The device also includes a traffic message reassembly module, which is used to perform protocol parsing on the database operation traffic based on the database security protection protocol, and before restoring the target SQL operation, perform traffic message reassembly on the database operation traffic collected using a traffic probe, wherein the traffic message reassembly includes sorting, deduplication, and packet loss processing on the collected database traffic.

10. The database security protection device according to claim 9, characterized in that: The SQL operation parsing module is specifically used to perform deep protocol parsing on the data flow packet corresponding to the target database after message reassembly based on the network protocol stack until the database application layer protocol is parsed, and behavior information is extracted. The behavior information at least includes data source information, database information, access behavior and operation type, return information, access time information, and SQL standardization processing.

11. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the method according to any one of claims 1 to 6 when executed by the processor.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

13. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to perform the method according to any one of claims 1 to 6.

Images