Database permission control method

Abstract

The present invention provides a database authority control method, which can be applied to the field of data security technology. The method includes: in response to the operation behavior on the database submitted by the user, determining the operation statement captured by the database trigger, wherein the operation statement includes a structured query statement for defining, modifying and querying the database; intercepting the operation behavior by using a database interception script; determining the user's operation characteristics based on the operation statement; verifying the operation characteristics by using the user's user portrait to obtain a first verification result; in the case where the first verification result indicates that the operation characteristics do not match the user portrait, determining the abnormal situation of the operation behavior based on the first verification result; determining the adjustment plan for the user's operation authority based on the abnormal situation; using the database interception script to execute the operation behavior with the adjusted operation authority, wherein the adjusted operation authority is obtained after adjusting the operation authority according to the adjustment plan.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a database authority control method. Background Art

[0002] Data security is an important part of database management. Data security refers to a series of measures and strategies to protect the data stored in the database from unauthorized access, leakage, tampering or destruction. Protecting data security can prevent sensitive information from being leaked to unauthorized accounts and ensure that data is not modified, damaged or lost without authorization. In the prior art, abnormal activities are usually identified based on static rules and predefined access rights. For example, database behaviors such as access control, data encryption and audit logs are monitored to identify and block unauthorized accounts.

[0003] In the process of implementing the present invention, it is found that the prior art has at least the following problems: data security is ensured by means of static rules and predefined access rights, and only a single anomaly can be detected. It is difficult to identify and detect dynamically changing user behaviors, and therefore it is difficult to effectively identify and respond to potential threats such as password leakage. Summary of the invention

[0004] In view of the above problems, the present invention provides a database authority control method.

[0005] According to a first aspect of the present invention, a database authority control method is provided, comprising: in response to an operation behavior on a database submitted by a user, determining an operation statement captured by a database trigger, wherein the operation statement includes a structured query statement for defining, modifying and querying the database; intercepting the operation behavior by using a database interception script; determining the user's operation characteristics based on the operation statement; verifying the operation characteristics by using a user portrait of the user to obtain a first verification result, wherein the user portrait is determined based on the user's historical operation behavior on the database; when the first verification result indicates that the operation characteristics do not match the user portrait, determining an abnormal situation of the operation behavior based on the first verification result; based on the abnormal situation, determining an adjustment plan for the user's operation authority; using a database interception script to execute the operation behavior with the adjusted operation authority, wherein the adjusted operation authority is obtained after adjusting the operation authority according to the adjustment plan.

[0006] According to an embodiment of the present invention, the database authority control method also includes: sending the abnormal situation and the adjustment plan to the administrator so that the administrator determines the audit result based on the abnormal situation and the adjustment plan; verifying the audit result based on the management portrait of the administrator to obtain a second verification result, wherein the management portrait is determined based on the historical audit results of the administrator's historical adjustment plans of the database; and revising the adjustment plan based on the second verification result and the audit result.

[0007] According to an embodiment of the present invention, the adjustment plan is revised based on the second verification result and the audit result, including: when the second verification result indicates that the audit result matches the management portrait, the adjustment plan is revised using the audit result; when the second verification result indicates that the audit result does not match the management portrait, a correction plan opposite to the audit result is determined; and the adjustment plan is revised using the correction plan.

[0008] According to an embodiment of the present invention, operation characteristics include operation time, operation frequency, operation type, operation habits, and operation address; determining the operation characteristics of a user based on the operation statement includes: determining the operation time and frequency based on the submission time and submission frequency of the operation statement; determining the operation type based on the type of the operation statement; determining the operation habit based on the content of the operation statement; determining the operation address based on the submission address of the operation statement; determining the user's operation characteristics based on the operation time, operation frequency, operation type, operation habits, and operation address.

[0009] According to an embodiment of the present invention, the database permission control method also includes: using database triggers and database interception scripts to record the user's operation behavior on the database in real time; determining historical operation statements based on the user's historical operation behavior on the database, wherein the historical operation statements include structured query statements used to define, operate and query the database; based on the historical operation statements, determining the user's historical operation characteristics, wherein the historical operation characteristics include historical operation time, historical operation frequency, historical operation type, historical operation habits, and historical operation address; based on the historical operation characteristics, determining the user's user portrait.

[0010] According to an embodiment of the present invention, the operation feature is verified using the user's user profile to obtain a first verification result, including: determining time similarity based on historical operation time and operation time; determining frequency similarity based on historical operation frequency and operation frequency; determining type similarity based on historical operation type and operation type; determining habit similarity based on historical operation habits and operation habits; determining feature similarity based on time similarity, frequency similarity, type similarity and habit similarity; when the feature similarity is less than a similarity threshold or the historical operation address does not match the operation address, determining that the first verification result indicates that the operation feature does not match the user profile.

[0011] According to an embodiment of the present invention, the abnormal situation includes an abnormality type and an abnormality level, wherein the abnormality type includes frequency abnormality, operation abnormality, and network abnormality; based on the first verification result, the abnormal situation of the operation behavior is determined, including: when the frequency similarity characterizes that the historical operation frequency and the operation frequency do not match, determining that the abnormality type includes frequency abnormality; when the habit similarity characterizes that the historical operation habit and the operation habit do not match, determining that the abnormality type includes operation abnormality; when the historical operation address and the operation address do not match, determining that the abnormality type includes network abnormality.

[0012] According to an embodiment of the present invention, based on the abnormal situation, an adjustment plan for the user's operating authority is determined, including: based on the abnormality type, determining the adjustment type of the operating authority, wherein the adjustment type includes locking the account, re-verifying, and locking the address; based on the abnormality level, determining the alarm level; based on the adjustment type and the alarm level, determining the adjustment plan.

[0013] According to an embodiment of the present invention, based on the exception type, the adjustment type of the operating authority is determined, including: when the exception type includes a frequency exception, determining that the adjustment type includes locking the account and re-verification; when the exception type includes an operation exception, determining that the adjustment type includes re-verification; when the exception type includes a network exception, determining that the adjustment type includes locking the address and re-verification.

[0014] According to an embodiment of the present invention, the database authority control method also includes: when the first verification result indicates that the operation characteristics do not match the user portrait, saving the operation statement to a log file of the database; when database recovery is required, generating a database recovery statement based on the log file; and executing the database recovery statement on the database to complete the database recovery.

[0015] A second aspect of the present invention provides a database authority control device, comprising:

[0016] A statement determination module, for determining an operation statement captured by a database trigger in response to an operation behavior on a database submitted by a user, wherein the operation statement includes a structured query statement for defining, modifying and querying a database;

[0017] Operation interception module, used to intercept scripts and operation behaviors using databases;

[0018] A feature determination module, used to determine the user's operation features based on the operation statement;

[0019] An operation verification module, used to verify the operation feature using a user profile of the user to obtain a first verification result, wherein the user profile is determined based on the user's historical operation behavior on the database;

[0020] An abnormality determination module, used to determine the abnormality of the operation behavior based on the first verification result when the first verification result indicates that the operation feature does not match the user portrait;

[0021] The permission adjustment module is used to determine the adjustment plan for the user's operation permissions based on abnormal situations;

[0022] The operation execution module is used to utilize the database interception script to execute the operation behavior with the adjusted operation authority, wherein the adjusted operation authority is obtained after adjusting the operation authority according to the adjustment plan.

[0023] A third aspect of the present invention provides an electronic device, comprising: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0024] The fourth aspect of the present invention further provides a computer-readable storage medium on which a computer program or instruction is stored, and the steps of the above method are implemented when the above computer program or instruction is executed by a processor.

[0025] The fifth aspect of the present invention also provides a computer program product, including a computer program or instructions, which implement the steps of the above method when executed by a processor.

[0026] According to an embodiment of the present invention, in response to an operation behavior on a database submitted by a user, the operation behavior is temporarily intercepted and an operation statement is determined, the operation characteristics of the user are determined, and the operation characteristics and the user portrait are used to determine whether the operation behavior of the user is abnormal, and a first verification result is obtained. By analyzing the operation characteristics and the user portrait, the regularity of the user behavior can be used to judge the operation behavior, thereby improving the accuracy of the recognition of the operation behavior. Temporarily intercepting the operation behavior can avoid problems such as data loss and data leakage caused by abnormal behavior directly operating the database, thereby improving the security of the database. According to the first verification result, it is determined whether the operation behavior is abnormal and an adjustment plan for the user's operation authority is determined in the case of abnormal operation behavior, and the database interception script is used to execute the operation behavior with the adjusted operation authority. After determining the adjustment plan, the user authority can be adjusted, and the operation behavior can be executed in time with the adjusted operation authority. On the premise of ensuring the security of the database, the response speed of the operation behavior can also be improved, thereby improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The above contents and other objects, features and advantages of the present invention will become more apparent through the following description of the embodiments of the present invention with reference to the accompanying drawings.

[0028] Figure 1 An application scenario diagram of a database authority control method, apparatus, device, medium, and program product according to an embodiment of the present invention is shown.

[0029] Figure 2 A flow chart of a database authority control method according to an embodiment of the present invention is shown.

[0030] Figure 3 An interaction diagram of a database authority control method according to an embodiment of the present invention is shown.

[0031] Figure 4 A structural block diagram of a database authority control device according to an embodiment of the present invention is shown.

[0032] Figure 5 A block diagram of an electronic device suitable for implementing a database authority control method according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0033] Below, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present invention. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of embodiments of the present invention. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of concepts of the present invention.

[0034] The terms used herein are only for describing specific embodiments and are not intended to limit the present invention. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0035] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0036] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0037] In the technical solution of the present invention, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0038] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present invention provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0039] An embodiment of the present invention provides a database authority control method, which determines an operation statement captured by a database trigger in response to an operation behavior on a database submitted by a user, wherein the operation statement includes a structured query statement for defining, modifying and querying the database; intercepts the operation behavior by using a database interception script; determines the user's operation characteristics based on the operation statement; verifies the operation characteristics by using a user portrait of the user to obtain a first verification result, wherein the user portrait is determined based on the user's historical operation behavior on the database; when the first verification result indicates that the operation characteristics do not match the user portrait, determines the abnormal situation of the operation behavior based on the first verification result; determines an adjustment plan for the user's operation authority based on the abnormal situation; and executes the operation behavior with the adjusted operation authority by using the database interception script, wherein the adjusted operation authority is obtained after adjusting the operation authority according to the adjustment plan.

[0040] Figure 1 An application scenario diagram of a database authority control method, apparatus, device, medium, and program product according to an embodiment of the present invention is shown.

[0041] like Figure 1As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0042] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0043] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0044] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0045] It should be noted that the database authority control method provided in the embodiment of the present invention can generally be executed by the server 105. Accordingly, the database authority control device provided in the embodiment of the present invention can generally be set in the server 105. The database authority control method provided in the embodiment of the present invention can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Correspondingly, the database authority control device provided in the embodiment of the present invention can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0046] It should be understood that Figure 1The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0047] The following will be based on Figure 1 The scene described by Figure 2~Figure 3 The database authority control method according to the embodiment of the present invention is described in detail.

[0048] Figure 2 A flow chart of a database authority control method according to an embodiment of the present invention is shown.

[0049] like Figure 2 As shown, the database authority control method of this embodiment includes operations S210 to S270.

[0050] In operation S210 , in response to an operation behavior on a database submitted by a user, an operation statement captured by a database trigger is determined.

[0051] In operation S220, the operation behavior is intercepted using a database interception script.

[0052] In operation S230, based on the operation statement, an operation feature of the user is determined.

[0053] In operation S240, the operation feature is verified using the user portrait of the user to obtain a first verification result.

[0054] In operation S250, when the first verification result indicates that the operation feature does not match the user portrait, an abnormality of the operation behavior is determined based on the first verification result.

[0055] In operation S260, based on the abnormal situation, an adjustment plan for the user's operation authority is determined.

[0056] In operation S270, the database interception script is used to execute the operation behavior with the adjusted operation authority.

[0057] According to an embodiment of the present invention, in response to an operation behavior on a database submitted by a user, an operation statement captured by a database trigger is determined, wherein the database trigger can be used to capture in real time the operation statements corresponding to the operation behavior on the database submitted by the user, wherein the operation behavior on the database may include defining, modifying and querying the database, etc., and the operation statements may include structured query statements for defining, modifying and querying the database, etc.

[0058] According to an embodiment of the present invention, a database interception script is used to intercept operation behaviors, wherein the database interception script can be deployed on a database server, and interception of operation behaviors is achieved by preventing the database server from executing operation statements corresponding to the operation behaviors.

[0059] According to an embodiment of the present invention, the user's operation characteristics are determined based on the operation statement, wherein the operation characteristics are used to characterize the user characteristics of the user's operation behavior, and can be determined by the submission time of the operation statement, the statement characteristics of the operation statement, etc.

[0060] According to an embodiment of the present invention, the operation characteristics are verified using the user's user portrait to obtain a first verification result, wherein the user portrait is determined based on the user's historical operation behavior on the database, and the operation characteristics can be verified by comparing the user portrait with the operation characteristics. The first verification result can be used to characterize whether the operation characteristics are consistent with the user portrait.

[0061] According to an embodiment of the present invention, when the first verification result characterizes that the operation feature does not match the user portrait, the abnormal situation of the operation behavior is determined based on the first verification result, wherein the operation feature includes multiple sub-features, and the abnormal situation is used to characterize the abnormal type and abnormal level of the operation behavior, wherein the abnormal type can be used to characterize the type of the sub-feature that has an abnormality, and the abnormal level can be used to characterize the severity of the abnormal situation.

[0062] According to an embodiment of the present invention, an adjustment plan for the user's operating authority is determined based on the abnormal situation, wherein the adjustment plan can be determined according to the abnormality type and abnormality level, and the higher the abnormality level, the less operable content of the operating authority after adjustment according to the adjustment plan.

[0063] According to an embodiment of the present invention, the operation authority is adjusted according to the adjustment plan to obtain the adjusted operation authority, and the operation statement corresponding to the operation behavior is executed on the database server using the database interception script to perform the operation behavior using the adjusted operation authority.

[0064] According to an embodiment of the present invention, in response to an operation behavior on a database submitted by a user, the operation behavior is temporarily intercepted and an operation statement is determined, the operation characteristics of the user are determined, and the operation characteristics and the user portrait are used to determine whether the operation behavior of the user is abnormal, and a first verification result is obtained. By analyzing the operation characteristics and the user portrait, the regularity of the user behavior can be used to judge the operation behavior, thereby improving the accuracy of the recognition of the operation behavior. Temporarily intercepting the operation behavior can avoid problems such as data loss and data leakage caused by abnormal behavior directly operating the database, thereby improving the security of the database. According to the first verification result, it is determined whether the operation behavior is abnormal and an adjustment plan for the user's operation authority is determined in the case of abnormal operation behavior, and the database interception script is used to execute the operation behavior with the adjusted operation authority. After determining the adjustment plan, the user authority can be adjusted, and the operation behavior can be executed in time with the adjusted operation authority. On the premise of ensuring the security of the database, the response speed of the operation behavior can also be improved, thereby improving the user experience.

[0065] According to an embodiment of the present invention, the database authority control method also includes: sending the abnormal situation and the adjustment plan to the administrator so that the administrator determines the audit result based on the abnormal situation and the adjustment plan; verifying the audit result based on the management portrait of the administrator to obtain a second verification result, wherein the management portrait is determined based on the historical audit results of the administrator's historical adjustment plans of the database; and revising the adjustment plan based on the second verification result and the audit result.

[0066] According to an embodiment of the present invention, the abnormal situation and the adjustment plan are sent to an administrator so that the administrator can determine the audit result based on the abnormal situation and the adjustment plan, wherein the audit result can be used to characterize whether the adjustment plan matches the abnormal situation. In the case where the audit result characterizes that the adjustment plan does not match the abnormal situation, the audit result may also include an audit adjustment plan determined by the administrator based on the abnormal situation and the adjustment plan, wherein the format of the audit adjustment plan may be the same as the format of the adjustment plan.

[0067] According to an embodiment of the present invention, the audit result is verified based on the management portrait of the administrator to obtain a second verification result, and the adjustment plan is revised based on the second verification result and the audit result, wherein the management portrait is determined based on the historical audit results of the administrator on the historical adjustment plans of the database, and the audit result can be verified by comparing the management portrait with the audit result, and the second verification result can be used to characterize whether the audit result is consistent with the management portrait.

[0068] According to an embodiment of the present invention, after determining the adjustment plan corresponding to the abnormal situation, the abnormal situation and the adjustment plan are sent to the administrator, who determines the audit result based on the abnormal situation and the adjustment plan, verifies the audit result based on the administrator's management portrait, obtains a second verification result, and modifies the adjustment plan based on the second verification result and the audit result. By having the administrator determine the audit result and further verify the audit result, it is possible to avoid absolute dependence on a certain link within the system, and have a certain defense capability against comprehensive and high-level system intrusions. In addition, by setting up multiple links to make the final determination of the adjustment plan, the accuracy of the adjustment plan can be improved, thereby improving the correctness of database authority control and ensuring data security.

[0069] According to an embodiment of the present invention, the adjustment plan is revised based on the second verification result and the audit result, including: when the second verification result indicates that the audit result matches the management portrait, the adjustment plan is revised using the audit result; when the second verification result indicates that the audit result does not match the management portrait, a correction plan opposite to the audit result is determined; and the adjustment plan is revised using the correction plan.

[0070] According to an embodiment of the present invention, when the second verification result characterizes that the audit result matches the management portrait, it characterizes that the audit result conforms to the administrator's processing habits, and the audit result is used to correct the adjustment plan. Specifically, when the audit result characterizes that the adjustment plan matches the abnormal situation, there is no need to correct the adjustment plan. When the audit result characterizes that the adjustment plan does not match the abnormal situation, the audit adjustment plan is used to correct the audit plan.

[0071] According to an embodiment of the present invention, when the second verification result indicates that the audit result does not match the management portrait, indicating that the audit result does not conform to the administrator's processing habits, a correction plan that is opposite to the audit result is determined, and the correction plan is used to correct the adjustment plan, wherein the format of the correction plan can be the same as the adjustment plan, and is used to determine the user's operating authority over the database.

[0072] According to an embodiment of the present invention, when the audit result indicates that the adjustment plan does not match the abnormal situation, there is no need to correct the adjustment plan. When the audit result indicates that the adjustment plan matches the abnormal situation, it is determined that the adjustment plan does not match the abnormal situation, an alarm can be issued to the administrator, and the correction plan can be re-determined, wherein the correction plan can be determined based on the administrator's historical audit results, or the abnormal situation can be resent to the administrator, and the administrator can determine the correction plan again.

[0073] According to an embodiment of the present invention, when the second verification result indicates that the audit result matches the management portrait, the adjustment plan can be corrected according to the audit result to determine the accurate adjustment plan, and when the second verification result indicates that the audit result does not match the management portrait, a correction plan opposite to the audit result is determined based on the audit result, and the adjustment plan is corrected using the correction plan. The accuracy of the corrected adjustment plan is ensured, thereby improving the security of authority control.

[0074] According to an embodiment of the present invention, operation characteristics include operation time, operation frequency, operation type, operation habits, and operation address; determining the operation characteristics of a user based on the operation statement includes: determining the operation time and frequency based on the submission time and submission frequency of the operation statement; determining the operation type based on the type of the operation statement; determining the operation habit based on the content of the operation statement; determining the operation address based on the submission address of the operation statement; determining the user's operation characteristics based on the operation time, operation frequency, operation type, operation habits, and operation address.

[0075] According to an embodiment of the present invention, the operation feature includes a plurality of sub-features, wherein the plurality of sub-features include operation time, operation frequency, operation type, operation habit, operation address, and the like.

[0076] According to an embodiment of the present invention, the operation time and frequency are determined based on the submission time and frequency of the operation statement, the operation type is determined based on the type of the operation statement, the operation habit is determined based on the content of the operation statement; and the operation address is determined based on the submission address of the operation statement.

[0077] According to an embodiment of the present invention, the user's operation characteristics are determined based on the operation time, operation frequency, operation type, operation habit and operation address, wherein the category of the operation characteristics can be determined by using a clustering algorithm.

[0078] According to an embodiment of the present invention, a clustering algorithm is used to determine the user's operation characteristics based on the submission time, content, type and other information of the operation statement. Since various aspects of the operation statement are taken into consideration, the comprehensiveness and accuracy of the operation characteristics can be improved.

[0079] According to an embodiment of the present invention, the database permission control method also includes: using database triggers and database interception scripts to record the user's operation behavior on the database in real time; determining historical operation statements based on the user's historical operation behavior on the database, wherein the historical operation statements include structured query statements used to define, operate and query the database; based on the historical operation statements, determining the user's historical operation characteristics, wherein the historical operation characteristics include historical operation time, historical operation frequency, historical operation type, historical operation habits, and historical operation address; based on the historical operation characteristics, determining the user's user portrait.

[0080] According to an embodiment of the present invention, database triggers and database interception scripts are used to record user operations on the database in real time. After the user submits the operation on the database, the operation is intercepted by the database interception script, and the database trigger is used to capture and save the operation statement.

[0081] According to an embodiment of the present invention, based on the historical operation behaviors of the user on the database, historical operation statements are determined from database triggers, wherein the historical operation statements include structured query statements for defining, operating and querying the database.

[0082] According to an embodiment of the present invention, based on historical operation statements, the user's historical operation characteristics are determined, and the user's user portrait is determined, wherein the historical operation characteristics include historical operation time, historical operation frequency, historical operation type, historical operation habits, and historical operation address. The historical operation characteristics are used to characterize the user characteristics in the user's historical operation behavior, and can be determined by the historical submission time of the historical operation statements, the historical statement characteristics of the historical operation statements, etc.

[0083] According to an embodiment of the present invention, historical operation statements saved in database triggers and database interception scripts are processed to determine the user's historical operation characteristics, thereby accurately determining the user portrait, which can ensure the accuracy of analyzing the user's operation behavior using the user portrait.

[0084] Figure 3 An interaction diagram of a database authority control method according to an embodiment of the present invention is shown.

[0085] like Figure 3 As shown, the interactive process of the database authority control method includes operations S301 to S314.

[0086] In operation S301, the user submits an operation behavior to the database server. The operation behavior is intercepted by the database interception script on the database server, and the database trigger captures the operation statement corresponding to the operation behavior. In operation S302, the database trigger of the database server sends the operation statement to the server. In operation S303, the server determines the user's operation characteristics according to the operation statement. In operation S304, the operation characteristics are verified by using the user portrait, and a first verification result is determined. In operation S305, the abnormal situation of the operation behavior is determined based on the first verification result. In operation S306, an adjustment plan for the operation authority is determined based on the abnormal situation. In operation S307, the abnormal situation and the adjustment plan are sent to the administrator. In operation S308, the administrator determines the audit result based on the abnormal situation and the adjustment plan. In operation S309, the administrator sends the audit result to the server. In operation S310, the server verifies the audit result by using the management portrait and determines the second verification result. In operation S311, the server modifies the adjustment plan according to the second verification result. In operation S312, the user's operation authority is adjusted based on the adjustment plan. In operation S313, after the operation authority is adjusted, the adjusted operation authority is notified to the database server for confirmation. In operation S314, the database interception script on the database server executes the operation behavior with the adjusted operation authority.

[0087] According to an embodiment of the present invention, the operation feature is verified using the user's user profile to obtain a first verification result, including: determining time similarity based on historical operation time and operation time; determining frequency similarity based on historical operation frequency and operation frequency; determining type similarity based on historical operation type and operation type; determining habit similarity based on historical operation habits and operation habits; determining feature similarity based on time similarity, frequency similarity, type similarity and habit similarity; when the feature similarity is less than a similarity threshold or the historical operation address does not match the operation address, determining that the first verification result indicates that the operation feature does not match the user profile.

[0088] According to an embodiment of the present invention, the time similarity is determined based on the historical operation time and the operation time, wherein the time similarity can be represented by the difference between the historical operation time and the operation time, and the smaller the difference, the higher the time similarity. For example, if the historical operation time indicates that the user usually operates the database in the afternoon, the time similarity with the operation behavior in the early morning is low.

[0089] According to an embodiment of the present invention, the frequency similarity is determined based on the historical operation frequency and the operation frequency. For example, if the historical operation frequency indicates that the user usually performs a single query, the frequency similarity is low compared to the operation frequency indicating that the user frequently performs operations in a short period of time.

[0090] According to an embodiment of the present invention, type similarity is determined based on historical operation types and operation types, wherein the historical operation types and operation types can be used to characterize the user's historical operations or whether the operations include indexes, etc., and can be represented by a one-hot vector.

[0091] According to an embodiment of the present invention, habit similarity is determined based on historical operating habits and operating habits, wherein historical operating habits and operating habits can be used to characterize the complexity of the operating language corresponding to the operating behavior, for example, the number of filter clauses included in the operating behavior, etc.

[0092] According to an embodiment of the present invention, feature similarity is determined based on time similarity, frequency similarity, type similarity and habit similarity, wherein feature similarity can be determined by fusion of time similarity, frequency similarity, type similarity and habit similarity. In the case where the feature similarity is less than a similarity threshold or the historical operation address does not match the operation address, it is determined that the first verification result characterizes that the operation feature does not match the user portrait, wherein the similarity threshold can be set in advance, and the historical operation address and the operation address can include the network address when the user submits the historical operation behavior or the operation behavior. For example, in the case where the historical operation address characterizes that the user usually uses the intranet to access the database, the first verification result of the operation behavior where the operation address is the extranet can characterize that the operation feature does not match the user portrait.

[0093] According to an embodiment of the present invention, the user profile and the operation feature are used to determine multiple similarities and feature similarities, thereby determining a first verification result to determine whether the operation feature matches the user profile. By comparing the features, the accuracy of the first verification result can be ensured, thereby ensuring the correctness of subsequent permission adjustments.

[0094] According to an embodiment of the present invention, the abnormal situation includes an abnormality type and an abnormality level, wherein the abnormality type includes frequency abnormality, operation abnormality, and network abnormality; based on the first verification result, the abnormal situation of the operation behavior is determined, including: when the frequency similarity characterizes that the historical operation frequency and the operation frequency do not match, determining that the abnormality type includes frequency abnormality; when the habit similarity characterizes that the historical operation habit and the operation habit do not match, determining that the abnormality type includes operation abnormality; when the historical operation address and the operation address do not match, determining that the abnormality type includes network abnormality.

[0095] According to an embodiment of the present invention, the abnormality types include frequency abnormality, operation abnormality, and network abnormality. In the case where the frequency similarity characterizes that the historical operation frequency and the operation frequency do not match, the abnormality type is determined to include frequency abnormality; in the case where the habit similarity characterizes that the historical operation habit and the operation habit do not match, the abnormality type is determined to include operation abnormality; in the case where the historical operation address and the operation address do not match, the abnormality type is determined to include network abnormality.

[0096] According to an embodiment of the present invention, based on multiple similarities of the first verification result, the abnormal type of the operation behavior is determined, so as to determine a more targeted adjustment plan for the abnormal type and improve the accuracy of database authority control.

[0097] According to an embodiment of the present invention, based on the abnormal situation, an adjustment plan for the user's operating authority is determined, including: based on the abnormality type, determining the adjustment type of the operating authority, wherein the adjustment type includes locking the account, re-verifying, and locking the address; based on the abnormality level, determining the alarm level; based on the adjustment type and the alarm level, determining the adjustment plan.

[0098] According to an embodiment of the present invention, based on the exception type, the type of adjustment to the operating authority is determined, wherein the adjustment types include account locking, re-verification, and address locking. Account locking includes temporarily locking the account used by the user to submit the operating behavior, re-verification includes a secondary verification of the user's identity, and address locking includes temporarily locking the network address of the user to submit the operating behavior.

[0099] According to an embodiment of the present invention, the alarm level is determined based on the abnormality level, and the adjustment scheme is determined based on the adjustment type and the alarm level, wherein the degree of the adjustment type and the alarm level are different in the adjustment schemes corresponding to different alarm levels.

[0100] According to an embodiment of the present invention, when the first verification result indicates that the operation feature does not match the user portrait, and the user's operation behavior includes deleting records in the database, the abnormality level can be determined to be the highest.

[0101] According to an embodiment of the present invention, since different exception types and exception levels have different degrees of impact on the data security of data stored in the database, a more targeted adjustment plan is determined for each exception type and exception level of different exception situations, which can improve the security of the database.

[0102] According to an embodiment of the present invention, based on the exception type, the adjustment type of the operating authority is determined, including: when the exception type includes a frequency exception, determining that the adjustment type includes locking the account and re-verification; when the exception type includes an operation exception, determining that the adjustment type includes re-verification; when the exception type includes a network exception, determining that the adjustment type includes locking the address and re-verification.

[0103] According to an embodiment of the present invention, when the exception type includes frequency exception, determining the adjustment type includes locking the account and re-verification, wherein, when the exception level is low, the account locking time may be shorter, and when the exception level is higher, the account locking time is longer, and when the exception level is the highest, the account locking time is set to unlimited, and the user can prove that the operation behavior is normal through appeals, etc., and then the administrator can manually unlock the account.

[0104] According to an embodiment of the present invention, when the exception type includes an operational exception, determining the adjustment type includes re-verification, and verification of different frequencies can be performed according to different exception levels. When the exception level is low, re-verification is performed once, and the user can use it normally after passing the verification. When the exception level is high, re-verification is performed multiple times at a predetermined frequency.

[0105] According to an embodiment of the present invention, when the exception type includes a network exception, determining the adjustment type includes locking the address and re-verification, wherein, when the exception level is low, the address locking time may be shorter, and when the exception level is high, the address locking time is longer, and when the exception level is the highest, the address locking time is set to unlimited, and the administrator can manually unlock the address after the user proves that the operation behavior is normal through appeals or the like.

[0106] According to an embodiment of the present invention, different adjustment types for operating permissions are determined based on the exception type, and different adjustment types are used to perform targeted permission adjustments on exception situations of different exception types, thereby achieving precise permission control to improve data security.

[0107] According to an embodiment of the present invention, the database authority control method also includes: when the first verification result indicates that the operation characteristics do not match the user portrait, saving the operation statement to a log file of the database; when database recovery is required, generating a database recovery statement based on the log file; and executing the database recovery statement on the database to complete the database recovery.

[0108] According to an embodiment of the present invention, when the first verification result indicates that the operation characteristics do not match the user portrait, the operation statement is saved to a log file of the database, so that when database recovery is needed, a database recovery statement is generated based on the log file, and the database recovery statement is executed on the database to complete the database recovery, wherein difference data can be determined based on the data saved in the database before and after the execution of the operation statement, and a database recovery statement is generated based on the difference data, wherein the difference data indicates the data difference between the database after executing the operation statement and the database before executing the operation statement.

[0109] According to an embodiment of the present invention, since after the user's operating permissions are adjusted according to the adjustment plan, there is still a possibility of risky operations when operating the database using the adjusted operating permissions, the operation statements can be saved to the database log file so that database recovery statements can be quickly generated to perform database recovery, thereby further improving the security of the database.

[0110] Based on the above database authority control method, the present invention also provides a database authority control device. Figure 4 The device is described in detail.

[0111] Figure 4 A structural block diagram of a database authority control device according to an embodiment of the present invention is shown.

[0112] like Figure 4 As shown, the database authority control device 400 of this embodiment includes a statement determination module 410, an operation interception module 420, a feature determination module 430, an operation verification module 440, an abnormality determination module 450, a authority adjustment module 460 and an operation execution module 470.

[0113] The statement determination module 410 is used to determine the operation statement captured by the database trigger in response to the operation behavior on the database submitted by the user, wherein the operation statement includes a structured query statement for defining, modifying and querying the database. In one embodiment, the statement determination module 410 can be used to perform the operation S210 described above, which will not be repeated here.

[0114] The operation interception module 420 is used to intercept the operation behavior by using the database interception script. In one embodiment, the operation interception module 420 can be used to perform the operation S220 described above, which will not be described in detail here.

[0115] The feature determination module 430 is used to determine the user's operation features based on the operation statement. In one embodiment, the feature determination module 430 can be used to perform the operation S230 described above, which will not be described in detail here.

[0116] The operation verification module 440 is used to verify the operation feature using the user's user profile to obtain a first verification result, wherein the user profile is determined based on the user's historical operation behavior on the database. In one embodiment, the operation verification module 440 can be used to perform the operation S240 described above, which will not be repeated here.

[0117] The abnormality determination module 450 is used to determine the abnormality of the operation behavior based on the first verification result when the first verification result indicates that the operation feature does not match the user portrait. In one embodiment, the abnormality determination module 450 can be used to perform the operation S250 described above, which will not be repeated here.

[0118] The authority adjustment module 460 is used to determine an adjustment plan for the user's operation authority based on an abnormal situation. In one embodiment, the authority adjustment module 460 can be used to perform the operation S260 described above, which will not be described in detail here.

[0119] The operation execution module 470 is used to use the database interception script to execute the operation behavior with the adjusted operation authority, wherein the adjusted operation authority is obtained after adjusting the operation authority according to the adjustment plan. In one embodiment, the operation execution module 470 can be used to execute the operation S270 described above, which will not be repeated here.

[0120] According to an embodiment of the present invention, the database authority control device 400 further includes a solution sending module, a result verification module and a solution correction module.

[0121] The plan sending module is used to send the abnormal situation and the adjustment plan to the administrator so that the administrator can determine the audit result based on the abnormal situation and the adjustment plan.

[0122] The result verification module is used to verify the audit result based on the management portrait of the administrator to obtain a second verification result, wherein the management portrait is determined based on the historical audit results of the administrator on the historical adjustment plans of the database.

[0123] The scheme revision module is used to revise the adjustment scheme based on the second verification result and the review result.

[0124] According to an embodiment of the present invention, the solution correction module includes a first solution correction submodule, a solution determination submodule and a second solution correction submodule.

[0125] The first plan correction submodule uses the audit result to correct the adjustment plan when the second verification result indicates that the audit result matches the management portrait.

[0126] The solution determination submodule is used to determine a correction solution that is opposite to the audit result when the second verification result indicates that the audit result does not match the management portrait.

[0127] The second scheme correction submodule is used to correct the adjustment scheme using the correction scheme.

[0128] According to an embodiment of the present invention, the feature determination module 430 includes a first feature determination submodule, a second feature determination submodule, a third feature determination submodule, a fourth feature determination submodule and a feature determination submodule.

[0129] The first feature determination submodule is used to determine the operation time and operation frequency based on the submission time and submission frequency of the operation statement.

[0130] The second feature determination submodule is used to determine the operation type based on the type of the operation statement.

[0131] The third feature determination submodule is used to determine the operation habit based on the content of the operation statement.

[0132] The fourth feature determination submodule is used to determine the operation address based on the submission address of the operation statement.

[0133] The feature determination submodule is used to determine the user's operation features based on the operation time, operation frequency, operation type, operation habits and operation address.

[0134] According to an embodiment of the present invention, the database authority control device 400 also includes an operation recording module, a historical statement determination module, a historical feature determination module and a portrait determination module.

[0135] The operation recording module is used to record the user's operation behavior on the database in real time by using database triggers and database interception scripts.

[0136] The historical statement determination module is used to determine historical operation statements based on the user's historical operation behavior on the database, wherein the historical operation statements include structured query statements used to define, operate and query the database.

[0137] The historical feature determination module is used to determine the user's historical operation features based on historical operation statements, wherein the historical operation features include historical operation time, historical operation frequency, historical operation type, historical operation habits, and historical operation address.

[0138] The portrait determination module is used to determine the user portrait of the user based on historical operation characteristics.

[0139] According to an embodiment of the present invention, the operation verification module 440 includes a first similarity determination submodule, a second similarity determination submodule, a third similarity determination submodule, a fourth similarity determination submodule, a feature similarity determination submodule and an operation verification submodule.

[0140] The first similarity determination submodule is used to determine the time similarity based on the historical operation time and the operation time.

[0141] The second similarity determination submodule is used to determine the frequency similarity based on the historical operation frequency and the operation frequency.

[0142] The third similarity determination submodule is used to determine type similarity based on the historical operation type and the operation type.

[0143] The fourth similarity determination submodule is used to determine the habit similarity based on the historical operation habit and the operation habit.

[0144] The feature similarity determination submodule is used to determine feature similarity based on time similarity, frequency similarity, type similarity and habit similarity.

[0145] The operation verification submodule is used to determine that the first verification result represents that the operation feature does not match the user portrait when the feature similarity is less than the similarity threshold or the historical operation address does not match the operation address.

[0146] According to an embodiment of the present invention, the abnormality determination module 450 includes a first abnormality determination submodule, a second abnormality determination submodule and a third abnormality determination submodule.

[0147] The first abnormality determination submodule is used to determine that the abnormality type includes a frequency abnormality when the frequency similarity characterizes that the historical operating frequency does not match the operating frequency.

[0148] The second abnormality determination submodule is used to determine that the abnormality type includes an operation abnormality when the habit similarity characterizes that the historical operation habit does not match the operation habit.

[0149] The third abnormality determination submodule is used to determine that the abnormality type includes a network abnormality when the historical operation address does not match the operation address.

[0150] According to an embodiment of the present invention, the authority adjustment module 460 includes a type determination submodule, a level determination submodule and an adjustment determination submodule.

[0151] The type determination submodule is used to determine the adjustment type of the operation authority based on the exception type, wherein the adjustment type includes locking the account, re-verifying, and locking the address.

[0152] The level determination submodule is used to determine the alarm level based on the abnormality level.

[0153] The adjustment determination submodule is used to determine the adjustment plan based on the adjustment type and the alarm level.

[0154] According to an embodiment of the present invention, the type determination submodule includes a first type determination unit, a second type determination unit and a third type determination unit.

[0155] The first type determination unit is used to determine, when the abnormality type includes frequency abnormality, that the adjustment type includes account locking and re-verification.

[0156] The second type determination unit is configured to determine, when the abnormality type includes an operational abnormality, that the adjustment type includes re-verification.

[0157] The third type determination unit is used to determine, when the abnormality type includes network abnormality, that the adjustment type includes address locking and re-verification.

[0158] According to an embodiment of the present invention, the database authority control device 400 further includes a statement saving module, a statement generating module and a database recovery module.

[0159] The statement saving module is used to save the operation statement to a log file of the database when the first verification result indicates that the operation feature does not match the user portrait.

[0160] The statement generation module is used to generate database recovery statements based on log files when database recovery is required.

[0161] The database recovery module is used to execute database recovery statements on the database to complete database recovery.

[0162] According to an embodiment of the present invention, any multiple modules among the statement determination module 410, the operation interception module 420, the feature determination module 430, the operation verification module 440, the abnormal determination module 450, the authority adjustment module 460 and the operation execution module 470 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present invention, at least one of the statement determination module 410, the operation interception module 420, the feature determination module 430, the operation verification module 440, the abnormal determination module 450, the authority adjustment module 460 and the operation execution module 470 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation modes of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the statement determination module 410, the operation interception module 420, the feature determination module 430, the operation verification module 440, the exception determination module 450, the permission adjustment module 460 and the operation execution module 470 can be at least partially implemented as a computer program module, which can perform the corresponding function when the computer program module is executed.

[0163] Figure 5 A block diagram of an electronic device suitable for implementing a database authority control method according to an embodiment of the present invention is shown.

[0164] like Figure 5 As shown, the electronic device 500 according to an embodiment of the present invention includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 to a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include an onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0165] In RAM 503, various programs and data required for the operation of electronic device 500 are stored. Processor 501, ROM 502 and RAM 503 are connected to each other via bus 504. Processor 501 performs various operations of the method flow according to the embodiment of the present invention by executing the program in ROM 502 and / or RAM 503. It should be noted that the program can also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 can also perform various operations of the method flow according to the embodiment of the present invention by executing the program stored in the one or more memories.

[0166] According to an embodiment of the present invention, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 may further include one or more of the following components connected to the input / output (I / O) interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that the computer program read therefrom is installed into the storage portion 508 as needed.

[0167] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiment; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present invention is implemented.

[0168] According to an embodiment of the present invention, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present invention, the computer-readable storage medium may include the ROM 502 and / or RAM 503 described above and / or one or more memories other than ROM 502 and RAM 503.

[0169] The embodiment of the present invention also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method provided by the embodiment of the present invention.

[0170] The computer program executes the above functions defined in the system / device of the embodiment of the present invention when it is executed by the processor 501. According to the embodiment of the present invention, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0171] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 509, and / or installed from the removable medium 511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0172] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the processor 501, the above functions defined in the system of the embodiment of the present invention are performed. According to the embodiment of the present invention, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0173] According to an embodiment of the present invention, the program code for executing the computer program provided by the embodiment of the present invention can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0174] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0175] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present invention may be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in the present invention. In particular, without departing from the spirit and teachings of the present invention, the features described in the various embodiments of the present invention may be combined and / or combined in various ways. All of these combinations and / or combinations fall within the scope of the present invention.

[0176] The embodiments of the present invention are described above. However, these embodiments are only for the purpose of illustration, and are not intended to limit the scope of the present invention. Although each embodiment is described above, it does not mean that the measures in each embodiment cannot be used in combination advantageously. Without departing from the scope of the present invention, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present invention.

Claims

1. A database authority control method, characterized in that: The method comprises: In response to the operation behavior on the database submitted by the user, determining the operation statement captured by the database trigger, wherein the operation statement includes a structured query statement for defining, modifying and querying the database; Using a database interception script to intercept the operation behavior; Based on the operation statement, determining the operation characteristics of the user; Verifying the operation feature using a user profile of the user to obtain a first verification result, wherein the user profile is determined based on a historical operation behavior of the user on the database; When the first verification result indicates that the operation feature does not match the user portrait, determining an abnormality of the operation behavior based on the first verification result; Based on the abnormal situation, determining an adjustment plan for the operation authority of the user; Utilizing the database interception script to execute the operation behavior with the adjusted operation authority, wherein the adjusted operation authority is obtained after adjusting the operation authority according to the adjustment plan; The method further comprises: Sending the abnormal situation and the adjustment plan to an administrator so that the administrator can determine the audit result based on the abnormal situation and the adjustment plan; Verifying the audit result based on the management profile of the administrator to obtain a second verification result, wherein the management profile is determined based on the historical audit results of the administrator on the historical adjustment plans of the database; Based on the second verification result and the audit result, the adjustment plan is revised.

2. The method according to claim 1, characterized in that The step of revising the adjustment plan based on the second verification result and the audit result includes: In the case where the second verification result indicates that the audit result matches the management portrait, modifying the adjustment plan using the audit result; In the case where the second verification result indicates that the audit result does not match the management portrait, determining a correction plan that is opposite to the audit result; The adjustment plan is modified using the modification plan.

3. The method according to claim 1, characterized in that The operation characteristics include operation time, operation frequency, operation type, operation habit, and operation address; The determining the operation feature of the user based on the operation statement includes: Determining the operation time and the operation frequency based on the submission time and the submission frequency of the operation statement; Determining the operation type based on the type of the operation statement; Determining the operation habit based on the content of the operation statement; Determining the operation address based on the submission address of the operation statement; The operation characteristics of the user are determined based on the operation time, the operation frequency, the operation type, the operation habit and the operation address.

4. The method according to claim 3, characterized in that The method further comprises: Using the database trigger and the database interception script to record the user's operation behavior on the database in real time; Determine historical operation statements based on the historical operation behavior of the user on the database, wherein the historical operation statements include structured query statements for defining, operating and querying the database; Based on the historical operation statements, determining the historical operation characteristics of the user, wherein the historical operation characteristics include historical operation time, historical operation frequency, historical operation type, historical operation habits, and historical operation address; Based on the historical operation characteristics, a user profile of the user is determined.

5. The method according to claim 4, characterized in that The using the user portrait of the user to verify the operation feature to obtain a first verification result includes: Determining time similarity based on the historical operation time and the operation time; Determining frequency similarity based on the historical operating frequency and the operating frequency; Determining type similarity based on the historical operation type and the operation type; Determining a habit similarity based on the historical operating habit and the operating habit; Determining feature similarity based on the time similarity, the frequency similarity, the type similarity, and the habit similarity; When the feature similarity is less than a similarity threshold or the historical operation address does not match the operation address, it is determined that the first verification result represents that the operation feature does not match the user portrait.

6. The method according to claim 5, characterized in that The abnormal situation includes an abnormal type and an abnormal level, wherein the abnormal type includes frequency abnormality, operation abnormality, and network abnormality; The determining, based on the first verification result, the abnormal situation of the operation behavior includes: In a case where the frequency similarity indicates that the historical operating frequency and the operating frequency do not match, determining that the abnormality type includes a frequency abnormality; In a case where the habit similarity indicates that the historical operating habit and the operating habit do not match, determining that the abnormality type includes an operating abnormality; In a case where the historical operation address does not match the operation address, it is determined that the abnormality type includes a network abnormality.

7. The method according to claim 6, characterized in that The determining, based on the abnormal situation, an adjustment plan for the user's operation authority includes: Based on the abnormality type, determining the adjustment type of the operation permission, wherein the adjustment type includes locking the account, re-verifying, and locking the address; Based on the abnormality level, determining an alarm level; The adjustment plan is determined based on the adjustment type and the alarm level.

8. The method according to claim 7, characterized in that The determining, based on the exception type, the type of adjustment of the operation authority includes: In the case where the abnormality type includes a frequency abnormality, determining that the adjustment type includes account locking and re-verification; In a case where the abnormality type includes an operational abnormality, determining that the adjustment type includes revalidation; In the case where the abnormality type includes a network abnormality, determining the adjustment type includes locking an address and re-verifying.

9. The method according to claim 1, characterized in that: The method further comprises: When the first verification result indicates that the operation feature does not match the user portrait, saving the operation statement to a log file of the database; When database recovery is required, generating a database recovery statement based on the log file; The database recovery statement is executed on the database to complete the database recovery.

Images