Three-layer access relation construction method and device, equipment and storage medium

Abstract

The invention discloses a three-layer access relation construction method, device and equipment and a storage medium, which are applied to the field of data security, and the method comprises the following steps: when a client request message sent by a client to a Web application is monitored in the Web application, generating a monitoring session link ID injection client request message; transmitting a monitoring session link ID in a request link of the client request message; and associating the application account, the Web application and the database in the request link based on the monitoring session link ID to obtain a three-layer access relationship of the request link. According to the method, the monitoring session link ID of each request link is generated, and the three-layer access relationship among the application account, the Web application and the database under the same request link is constructed based on the monitoring session link ID, so that compared with the prior art, the traceability of risk events is improved, and the running safety of the Web application is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a three-layer access relationship construction method, device, equipment and storage medium. Background Art

[0002] With the introduction of laws and regulations such as the Data Security Law and the Personal Information Protection Law, protection measures for data in the process of exchange, circulation and storage in Web applications are very important. The main way to monitor data flow in the existing technology is to analyze the information data packets from the request end to the destination end in the network traffic, and use complex DPI (Deep Packet Inspection) and DFI (Deep Flow Inspection) to perform protocol analysis to extract the protocol type and request response messages for analysis. Due to the traffic fault in Web applications, the existing technology can only establish the association between application accounts and Web applications and between Web applications and databases, but cannot establish the three-layer association relationship for access to data flow in each link in Web applications. When a risk event occurs, it is impossible to effectively trace the source, which reduces the security of Web application operation. Summary of the invention

[0003] The purpose of the present invention is to provide a three-layer access relationship construction method, device, equipment and storage medium, which are applied to the field of data security. The method generates a monitoring session link ID for each request link, and constructs a three-layer access relationship between an application account, a Web application and a database under the same request link based on the monitoring session link ID. Compared with the prior art, the method improves the traceability capability of risk events and ensures the operational security of Web applications.

[0004] In order to solve the above technical problems, the present invention provides a three-layer access relationship construction method, comprising:

[0005] When a client request message sent by a client to the Web application is monitored in the Web application, a monitoring session link ID is generated and injected into the client request message;

[0006] Transmitting the monitoring session link ID in the request link of the client request message;

[0007] Based on the monitoring session link ID, the application account, the Web application and the database in the request link are associated to obtain a three-layer access relationship of the request link.

[0008] Optionally, when a client request message sent by a client to the Web application is monitored in the Web application, generating a monitoring session link ID and injecting it into the client request message includes:

[0009] The HTTP interceptor monitors the Web application based on the JavaAgent probe program, and when the client request message sent by the client to the Web application is monitored in the Web application, the monitoring session link ID is generated based on the JavaAgent probe program and injected into the client request message.

[0010] Optionally, the transmitting of the monitoring session link ID in the link to which the client request message belongs includes:

[0011] The sub-messages in the request link are monitored based on the JavaAgent probe program, and the monitoring session link ID is injected into the sub-message to implement the transmission of the monitoring session link ID in the request link of the client request message.

[0012] Optionally, associating the application account, the Web application, and the database in the request link based on the monitoring session link ID to obtain a three-layer access relationship of the request link includes:

[0013] Obtaining the client request message and the sub-message having the same monitoring session link ID;

[0014] Acquire a first association relationship between the application account and the Web application based on the client request message;

[0015] When there is a cross-application call, obtaining a second association relationship between the Web applications based on the cross-application call sub-message;

[0016] Acquire a third association relationship between the Web application and the database based on the database call sub-message;

[0017] The application account, the Web application, and the database are associated based on the first association relationship, the second association relationship, and the third association relationship to obtain a three-layer access relationship of the request link.

[0018] Optionally, also include:

[0019] Performing risk monitoring on the request message and the response message in the request link to generate a message risk monitoring result;

[0020] The monitoring session link ID is injected into the message risk monitoring result.

[0021] Optionally, also include:

[0022] When database return data is detected in the request link, risk monitoring is performed on the database return data to obtain a database return data risk monitoring result;

[0023] The monitoring session link ID is injected into the data risk monitoring result returned by the database.

[0024] Optionally, also include:

[0025] Determine access operation and access information based on database call sub-message;

[0026] Performing sensitive identification based on the access operation and the access information to obtain a sensitive identification result;

[0027] The monitoring session link ID is injected into the sensitive identification result.

[0028] In order to solve the above technical problems, the present invention provides a three-layer access relationship construction device, comprising:

[0029] The first module is used to generate a monitoring session link ID and inject it into the client request message when a client request message sent by the client to the Web application is monitored in the Web application;

[0030] The second module is used to transmit the monitoring session link ID in the request link of the client request message;

[0031] The third module is used to associate the application account, the Web application and the database in the request link based on the monitoring session link ID to obtain the three-layer access relationship of the request link.

[0032] In order to solve the above technical problems, the present invention provides a three-layer access relationship construction device, comprising:

[0033] Memory, for storing computer programs;

[0034] A processor is used to implement the above-mentioned three-layer access relationship construction method when executing the computer program.

[0035] In order to solve the above technical problems, the present invention provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, the above-mentioned three-layer access relationship construction method is implemented.

[0036] It can be seen that the method of the present invention generates a monitoring session link ID and injects it into the client request message when monitoring the client request message sent by the client to the Web application in the Web application; transmits the monitoring session link ID in the request link of the client request message; and associates the application account, Web application and database in the request link based on the monitoring session link ID to obtain the three-layer access relationship of the request link. The method of the present invention generates a monitoring session link ID for each request link, and constructs a three-layer access relationship between the application account, Web application and database under the same request link based on the monitoring session link ID. Compared with the prior art, the method improves the traceability capability of risk events and ensures the operational security of Web applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0038] Figure 1 A flowchart of a method for constructing a three-layer access relationship provided by an embodiment of the present invention;

[0039] Figure 2 A three-layer access relationship diagram of a specific embodiment provided by an embodiment of the present invention;

[0040] Figure 3 A structural block diagram of a three-layer access relationship building device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] The following combination Figure 1 , Figure 1 A flowchart of a method for constructing a three-layer access relationship provided by an embodiment of the present invention, the method may include:

[0043] S101: When a client request message sent by a client to a Web application is monitored in a Web application, a monitoring session link ID is generated and injected into the client request message.

[0044] In this embodiment, when a client request message sent by a client to a Web application is monitored in a Web (network) application, a monitoring session link ID (Identity Document) can be generated and injected into the client request message. A Web application is a computer program that uses a web browser and network technology to perform tasks on the Internet. A user needs to send a client request message to a Web application through a client to call the Web application. In this embodiment, a monitoring session link ID can be generated and injected into the client request message, and the monitoring session link ID injected into each client request message in each service is different. This embodiment does not limit the specific method of monitoring the client request message, nor does it limit the specific method of generating the monitoring session link ID and injecting the client request message. Generally, when the Web application is an application developed in Java language, this embodiment can monitor the HTTP (Hyper Text Transfer Protocol) interceptor of the Web application through a JavaAgent probe program. When a client request message sent by a client to a Web application is monitored in the Web application, a monitoring session link ID is generated based on the JavaAgent probe program and injected into the client request message. JavaAgent is a mechanism provided by Java that can intercept and modify bytecode before loading bytecode files.

[0045] S102: Monitoring the transmission of the session link ID in the request link of the client request message.

[0046] This embodiment can monitor the transmission of the session ID in the request link of the client request message. After receiving the client request message, the Web will send a corresponding sub-message based on the client request message to implement the service corresponding to the client request message. This embodiment can inject the monitoring session ID into the sub-message in the same request link as the client request message to implement the transmission of the monitoring session link ID in the request link of the client request message.

[0047] In this embodiment, when the Web application is an application developed in Java language, this embodiment can monitor the sub-messages in the request link based on the JavaAgent probe program, and inject the monitoring session link ID into the sub-message to realize the transmission of the monitoring session link ID in the request link of the client request message.

[0048] S103: Associating the application account, Web application and database in the request link based on the monitoring session link ID to obtain a three-layer access relationship of the request link.

[0049] This embodiment can associate the application account, Web application and database in the request link based on the monitoring session link ID to obtain the three-layer access relationship of the request link. First, the client request message and sub-message with the same monitoring session link ID can be obtained, that is, the client request message and its sub-message in the same request link, and the first association relationship between the application account and the Web application is obtained based on the client request message. This embodiment does not limit the specific method of obtaining the first association relationship. Generally, the application account can be extracted from the client request message, and the application account is bound to the Web application that receives the client request message to obtain the first association relationship between the client and the Web application.

[0050] Since there may be cross-application calls in the process of executing the client request message, for example, a cross-application call sub-message is sent from Web application 1 to Web application 2, and Web application 2 sends a database call sub-message to call the corresponding database according to the cross-application call sub-message. In this embodiment, when there is a cross-application call, the second association relationship between Web applications can be obtained based on the cross-application call sub-message. This embodiment does not limit the method for obtaining the second relationship. Generally, the initiator and the receiver in the cross-application call sub-message can be obtained, and the association relationship between the initiator and the receiver can be established to obtain the second association relationship between Web applications.

[0051] This embodiment can obtain the third association relationship between the Web application and the database based on the database call sub-message. This embodiment does not limit the specific type of the database, nor the number of databases called by each Web application. This embodiment can determine the information of the called database from the database call sub-message, such as the database account and the connected database server IP (Internet Protocol), port information, etc., and bind the database to the Web application that sends the database call sub-message based on the database information to obtain the third association relationship between the Web application and the database.

[0052] In this embodiment, the application account, the Web application, and the database are associated based on the first association relationship, the second association relationship, and the third association relationship to obtain the three-layer access relationship of the request link. When the Web application is an application developed in Java language, this embodiment can obtain the first association relationship, the second association relationship, and the third association relationship based on the JavaAgent probe program, and associate the application account, the Web application, and the database based on the first association relationship, the second association relationship, and the third association relationship to obtain the three-layer access relationship of the request link.

[0053] The three-layer access relationship obtained in this embodiment can be applied to risk event tracing. When a risk event is monitored in the request link, the corresponding application account can be found based on the three-layer access relationship, so as to locate the specific source of the risk, which is conducive to ensuring the safe operation of Web applications and is of great significance to data security governance.

[0054] Since multiple Web applications and multiple databases may be called in the same request link, in this embodiment, the first association relationship between the client and the Web application, the second association relationship between the Web applications and the Web application, and the third association relationship between the Web application and the database can be obtained for any request link, and the association between the application account, the Web application and the database in the entire request link is realized based on the association relationship.

[0055] Furthermore, in this embodiment, risk analysis of data flowing in the request link can be performed. When the Web is an application developed in Java language, this embodiment can monitor the data flowing in the request link and perform data risk analysis based on the JavaAgent probe program.

[0056] This embodiment does not limit the specific method of performing data risk analysis. Generally, the request message and the response message in the request link can be risk-monitored to generate a message risk monitoring result, and the monitoring session link ID can be injected into the message risk monitoring result. This embodiment can also perform risk analysis on the database return data returned by the data in the request link. When the database return data is detected in the request link, the database return data is risk-monitored to obtain the database return data risk monitoring result, and the monitoring session link ID is injected into the database return data risk monitoring result. This embodiment can also determine the access operation (insert, update, delete, etc.) and access information (library information, table information and field information, etc.) based on the database call sub-message, perform sensitive identification based on the access operation and access information to obtain a sensitive identification result, and based on the sensitive identification result, it can be determined whether sensitive operations are involved and whether sensitive libraries, tables and fields are accessed, and the monitoring session link ID is injected into the sensitive identification result.

[0057] Based on the above embodiments, the method of the present invention generates a monitoring session link ID for each request link, and constructs a three-layer access relationship between the application account, Web application and database under the same request link based on the monitoring session link ID. Compared with the prior art, the method improves the traceability capability of risk events and ensures the operational security of Web applications.

[0058] The following is a specific embodiment of a three-layer access relationship construction method provided by an embodiment of the present invention. In this specific embodiment, the Web application is an application developed in Java language. The user logs in to the client through the application account and sends a client request message to Web application 1 through the client. Web application 1 calls database 1, Web application 1 calls database 2 through Web application 2, and Web application 2 calls database 3 through Web application 3:

[0059] Implant JavaAgengt probe program in Web application 1, Web application 2 and Web application 3;

[0060] Based on the JavaAgengt probe program, the HTTP interceptor is monitored. When a client request message is detected, a monitoring session link ID is generated, the monitoring session link ID is injected into the client request message, the application account in the client request message is extracted, and the application account is associated with the Web application 1 to obtain a first association relationship;

[0061] Monitor the connection function of the JDBC (Java Database Connectivity) driver of the Web application 1 based on the JavaAgent probe program, obtain database information from the connection function, and associate the database 1 with the Web application 1 based on the database information to obtain a third association relationship between the database 1 and the Web application 1;

[0062] Based on the JavaAgent probe program, the first cross-application HTTP request message sent by Web application 1 to Web application 2 is monitored, and the sending end Web application 1 and the receiving end Web application 2 in the first cross-application HTTP request message are associated to obtain a second association relationship between Web application 1 and Web application 2;

[0063] Monitor the connection function of the JDBC driver of Web application 2 based on the JavaAgent probe program, obtain database information from the connection function, and associate database 2 with Web application 2 based on the database information to obtain a third association relationship between database 2 and Web application 2;

[0064] Based on the JavaAgent probe program, monitor the second cross-application HTTP request message sent by Web application 2 to Web application 3, and associate the sending end Web application 2 with the receiving end Web application 3 in the second cross-application HTTP request message to obtain a second association relationship between Web application 2 and Web application 3;

[0065] Monitor the connection function of the JDBC driver of Web application 3 based on the JavaAgent probe program, obtain database information from the connection function, and associate database 3 with Web application 3 based on the database information to obtain a third association relationship between database 3 and Web application 3;

[0066] The three-layer access relationship in the request link is constructed based on the first association relationship, the second association relationship and the third association relationship. The three-layer access relationship in this specific embodiment can be as follows: Figure 2 shown.

[0067] The following combination Figure 3 , Figure 3 A structural block diagram of a three-layer access relationship construction device provided by an embodiment of the present invention, the device may include:

[0068] The first module 100 is used to generate a monitoring session link ID and inject it into the client request message when a client request message sent by a client to the Web application is monitored in the Web application;

[0069] The second module 200 is used to transmit the monitoring session link ID in the request link of the client request message;

[0070] The third module 300 is used to associate the application account, the Web application and the database in the request link based on the monitoring session link ID to obtain the three-layer access relationship of the request link.

[0071] Based on the above embodiments, the method of the present invention generates a monitoring session link ID for each request link, and constructs a three-layer access relationship between the application account, Web application and database under the same request link based on the monitoring session link ID. Compared with the prior art, the method improves the traceability capability of risk events and ensures the operational security of Web applications.

[0072] Based on the above embodiment, the first module 100 may include:

[0073] The first unit is used for monitoring the HTTP interceptor of the Web application based on the JavaAgent probe program. When the client request message sent by the client to the Web application is monitored in the Web application, the monitoring session link ID is generated based on the JavaAgent probe program and injected into the client request message.

[0074] Based on the above embodiments, the second module 200 may include:

[0075] The second unit is used to monitor the sub-messages in the request link based on the JavaAgent probe program, and inject the monitoring session link ID into the sub-message to realize the transmission of the monitoring session link ID in the request link of the client request message.

[0076] Based on the above embodiments, the third module 300 may include:

[0077] The third unit is used to obtain the client request message and the sub-message having the same monitoring session link ID;

[0078] A fourth unit is used to obtain a first association relationship between the application account and the Web application based on the client request message;

[0079] A fifth unit, configured to obtain a second association relationship between the Web applications based on the cross-application call sub-message when there is a cross-application call;

[0080] A sixth unit, configured to obtain a third association relationship between the Web application and the database based on the database call sub-message;

[0081] The seventh unit is used to associate the application account, the Web application and the database based on the first association relationship, the second association relationship and the third association relationship to obtain a three-layer access relationship of the request link.

[0082] Based on the above embodiments, the device may further include:

[0083] The fourth module is used to perform risk monitoring on the request message and the response message in the request link to generate a message risk monitoring result;

[0084] The fifth module is used to inject the monitoring session link ID into the message risk monitoring result.

[0085] Based on the above embodiments, the device may further include:

[0086] A sixth module is configured to, when database return data is detected in the request link, perform risk monitoring on the database return data to obtain a database return data risk monitoring result;

[0087] The fifth module is used to inject the monitoring session link ID into the data risk monitoring result returned by the database.

[0088] Based on the above embodiments, the device may further include:

[0089] The seventh module is used to determine the access operation and access information based on the database call sub-message;

[0090] An eighth module is used to perform sensitive identification based on the access operation and the access information to obtain a sensitive identification result;

[0091] The ninth module is used to inject the monitoring session link ID into the sensitive identification result.

[0092] Based on the above embodiment, the present invention also provides a three-layer access relationship construction device, which may include a memory and a processor, wherein the memory stores a computer program, and when the processor calls the computer program in the memory, the steps provided in the above embodiment can be implemented. Of course, the device may also include various necessary network interfaces, power supplies, and other components.

[0093] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by an execution terminal or a processor, the method provided in the embodiment of the present invention can be implemented; the storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0094] In this article, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

Claims

1. A three-layer access relationship construction method, characterized in that: include: When a client request message sent by a client to the Web application is monitored in the Web application, a monitoring session link ID is generated and injected into the client request message; Transmitting the monitoring session link ID in the request link of the client request message; Based on the monitoring session link ID, the application account, the Web application and the database in the request link are associated to obtain a three-layer access relationship of the request link.

2. The method for constructing a three-layer access relationship according to claim 1, characterized in that: When a client request message sent by a client to the Web application is monitored in the Web application, generating a monitoring session link ID and injecting it into the client request message includes: The HTTP interceptor monitors the Web application based on the JavaAgent probe program, and when the client request message sent by the client to the Web application is monitored in the Web application, the monitoring session link ID is generated based on the JavaAgent probe program and injected into the client request message.

3. The three-layer access relationship construction method according to claim 2 is characterized in that: The transmitting of the monitoring session link ID in the link to which the client request message belongs includes: The sub-messages in the request link are monitored based on the JavaAgent probe program, and the monitoring session link ID is injected into the sub-message to implement the transmission of the monitoring session link ID in the request link of the client request message.

4. The three-layer access relationship construction method according to claim 1 is characterized in that: The step of associating the application account, the Web application, and the database in the request link based on the monitoring session link ID to obtain a three-layer access relationship of the request link includes: Obtaining the client request message and the sub-message having the same monitoring session link ID; Acquire a first association relationship between the application account and the Web application based on the client request message; When there is a cross-application call, obtaining a second association relationship between the Web applications based on the cross-application call sub-message; Acquire a third association relationship between the Web application and the database based on the database call sub-message; The application account, the Web application, and the database are associated based on the first association relationship, the second association relationship, and the third association relationship to obtain a three-layer access relationship of the request link.

5. The method for constructing a three-layer access relationship according to claim 1, characterized in that: Also includes: Performing risk monitoring on the request message and the response message in the request link to generate a message risk monitoring result; The monitoring session link ID is injected into the message risk monitoring result.

6. The three-layer access relationship construction method according to claim 1 is characterized in that: Also includes: When database return data is detected in the request link, risk monitoring is performed on the database return data to obtain a database return data risk monitoring result; The monitoring session link ID is injected into the data risk monitoring result returned by the database.

7. The method for constructing a three-layer access relationship according to claim 1, characterized in that: Also includes: Determine access operation and access information based on database call sub-message; Performing sensitive identification based on the access operation and the access information to obtain a sensitive identification result; The monitoring session link ID is injected into the sensitive identification result.

8. A three-layer access relationship construction device, characterized in that: include: The first module is used to generate a monitoring session link ID and inject it into the client request message when a client request message sent by the client to the Web application is monitored in the Web application; The second module is used to transmit the monitoring session link ID in the request link of the client request message; The third module is used to associate the application account, the Web application and the database in the request link based on the monitoring session link ID to obtain the three-layer access relationship of the request link.

9. A three-layer access relationship building device, characterized in that: include: Memory, for storing computer programs; A processor, configured to implement the three-layer access relationship construction method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the three-layer access relationship construction method as described in any one of claims 1 to 7 is implemented.

Images