Database security control method and system with network partitioning function

Abstract

The invention provides a database security control method and system with a network partitioning function, and the network partitioning means that a large network is divided into a plurality of small sub-networks, thereby improving the network performance, security and management efficiency. Network partitioning can be carried out on different levels and angles, common network partitioning is carried out in an IPv4 network, a large IP address range is divided into a plurality of subnets through subnet division, each subnet has the own IP address range, and therefore, the network performance can be improved, and the size of a broadcast domain can be reduced. According to the method, a multi-node deployment mode is adopted, that is, one or more sets of database security control services are deployed in each network partition; and when a user submits an access request, automatically selecting a certain database security control service processing request in the corresponding network partition according to request information. After the method is adopted, the heuristic optimization weighted polling load balancing algorithm based on the real-time load can be realized. According to the algorithm, the weight can be dynamically adjusted according to the real-time performance condition of the server, so that the request load is distributed in a more balanced manner, and the overall performance and stability of the system are improved.

Description

Technical Field

[0001] The present invention relates to a database security management and control method and system including a network partitioning function, and belongs to the field of database security. Background Art

[0002] With the advent of the digital age, enterprises are paying more and more attention to database security. Although traditional database clients can connect to and operate databases, their functions in database security management are very basic. In order to improve the security of database use, the Database Security Control (DSC) platform is being used by more and more enterprises as an effective security solution.

[0003] The use of database security control platforms is mainly distributed in multiple industries represented by finance. The reason is obvious. Financial institutions often have a large amount of sensitive data, such as customer identity information, transaction records, etc. If the data is leaked or illegally accessed, it may have serious consequences. Therefore, the financial industry has an urgent need for database security control platforms. In addition, medical, government, and manufacturing industries also have a wide range of applications for database security control platforms. These industries are without exception. Their data involves personal privacy, data security, production processes, and other aspects, and they all have high requirements for data security.

[0004] The database security control platform can ensure data security and privacy by identifying sensitive data, limiting access rights, and monitoring data usage. At the same time, it can also control user access rights to sensitive data, and through identity authentication, permission management, and access auditing, ensure that only authorized personnel can access sensitive data and system resources, and monitor abnormal data usage behaviors, and can promptly detect and warn. In short, the database security control platform can effectively protect the company's data, prevent data leakage, tampering, or illegal access, and ensure data security.

[0005] The existing database security management and control platform is mainly deployed on a single node. This deployment method is simple and easy to deploy, but the disadvantage is that all access requests will be submitted to this node. If the total number of access requests is not large, a single node can bear and process them; but if the total number of access requests is large, it will exceed the processing capacity of a single node, affecting the stable operation of the entire database security management and control platform. In addition, in the user's network environment, multiple network partitions are often divided, and the network between different partitions may be isolated. Therefore, the single-node deployment method is difficult to meet the user access requirements in multiple network partition environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1 The figure is a flow chart of the method of the present invention. Summary of the invention

[0007] In order to solve the problems existing in the prior art, the present invention proposes a database security management method and system including a network partitioning function. Network partitioning refers to dividing a large network into several smaller sub-networks, thereby improving network performance, security and management efficiency. Network partitioning can be performed at different levels and angles. Common network partitioning is in the IPv4 network. A large IP address range is divided into multiple subnets through subnet partitioning. Each subnet has its own IP address range, which helps to improve network performance and reduce the size of the broadcast domain. The present invention adopts a multi-node deployment method, that is, deploying one or more sets of database security management services in each network partition; when a user submits an access request, a database security management service in the corresponding network partition is automatically selected to process the request according to the request information.

[0008] Specifically, a database security management and control method including a network partitioning function includes the following steps:

[0009] (1) User request: The user submits an access request to the database security management and control platform through a web browser. The request contains the ID of the target database to be accessed.

[0010] (2) The interceptor intercepts the request: The interceptor finds that the user request contains the ID of the target database, queries the subnet information corresponding to the target database, and attaches the subnet information to the request;

[0011] (3) Nginx server routing request: Based on the subnet information in the above request, the request is routed to the DSC service in the corresponding subnet.

[0012] (4) Load balancing within a subnet: When the Nginx server routes the user's access request to the corresponding subnet, if the subnet has deployed multiple DSC services, load balancing is required to select and calculate, and ultimately determine the optimal DSC service to provide to the user.

[0013] Furthermore, in step (4), the load balancing process is:

[0014] 4.1 Initialization: The DSC service set is S = {s1, s2, ..., s n}, where n is the total number of DSC services in the subnet, s i For the i-th DSC service, 1≤i≤n, w i is the weight of the ith DSC service, the initial weight is 0.5, and the initial weight list W is set to {w1,w2,…,w n}, set the current position pointer p = 1, that is, point to the first DSC service;

[0015] 4.2 Calculate the real-time load, divided into:

[0016] a) Calculate the load factor: For s i CPU usage of the server C i , the corresponding CPU load factor For s i The memory usage of the server M i , the corresponding memory load factor is

[0017] b) Calculate real-time load: The combined load factor of CPU and memory is

[0018] 4.3 Weight Update: Calculating Average Load The weight update strategy is Among them, w i ′ is the updated weight, w i is the weight before updating.

[0019] 4.4 Select server: w p ′>0.5, select DSC service s p Processing request, p and w p ′ are the DSC services pointed to by pointer p and their weights; w p When ′≤0.5, move the pointer p back one position and repeat this step until a DSC service with a weight greater than 0.5 is found or all DSC services are traversed; if there is no DSC service with a weight greater than 0.5, select the DSC service with the highest weight;

[0020] 4.5 Processing request: Sending the request to the selected DSC servers p ;

[0021] 4.6 Update pointer: Move pointer p back one position. If pointer p has reached the end of the list, reset it to the beginning of the list.

[0022] 4.7 Return to step 4.2 to continue processing new user requests.

[0023] Based on the above method, the present invention further proposes a database security management and control system including a network partitioning function, the system comprising:

[0024] (1) User request module: In this module, the user submits an access request to the database security management and control platform through a Web browser. The request contains the ID of the target database to be accessed.

[0025] (2) Interceptor interception request module: The interceptor in this module finds that the user request module contains the ID of the target database, queries the subnet information corresponding to the target database, and attaches the subnet information to the request module;

[0026] (3) Nginx server routing request module: This module routes the request to the DSC service in the corresponding subnet according to the subnet information in the above request module.

[0027] (4) Intra-subnet load balancing module: When the Nginx server routing request module routes the user access request to the corresponding subnet, if the subnet has deployed multiple sets of DSC services, the module will perform selection calculations through load balancing and ultimately determine the optimal DSC service to provide to the user.

[0028] Furthermore, in the load balancing module within the subnet, the load balancing process is:

[0029] 4.1 Initialization: The DSC service set is S = {s1, s2, ..., s n}, where n is the total number of DSC services in the subnet, s i For the i-th DSC service, 1≤i≤n, w i is the weight of the ith DSC service, the initial weight is 0.5, and the initial weight list W is set to {w1,w2,…,w n}, set the current position pointer p = 1, that is, point to the first DSC service;

[0030] 4.2 Calculate the real-time load, divided into:

[0031] a) Calculate the load factor: For s i CPU usage of the server C i , the corresponding CPU load factor For s i The memory usage of the server M i , the corresponding memory load factor is

[0032] b) Calculate real-time load: The combined load factor of CPU and memory is

[0033] 4.3 Weight Update: Calculating Average Load The weight update strategy is Among them, w i ′ is the updated weight, w i is the weight before updating.

[0034] 4.4 Select server: w p ′>0.5, select DSC service sp Processing request, p and w p ′ are the DSC services pointed to by pointer p and their weights; w p When ′≤0.5, move the pointer p back one position and repeat this step until a DSC service with a weight greater than 0.5 is found or all DSC services are traversed; if there is no DSC service with a weight greater than 0.5, select the DSC service with the highest weight;

[0035] 4.5 Processing request: Sending the request to the selected DSC servers p ;

[0036] 4.6 Update pointer: Move pointer p back one position. If pointer p has reached the end of the list, reset it to the beginning of the list.

[0037] 4.7 Return to step 4.2 to continue processing new user requests.

[0038] After adopting the present invention, a heuristic optimization weighted polling load balancing algorithm based on real-time load can be implemented. The algorithm dynamically adjusts the weight by calculating the actual load of the server, so that it better reflects the real state of the current server, and performs more accurate request allocation accordingly; at the same time, when calculating the real-time load, the algorithm uses a heuristic function to consider the comprehensive load factor of the CPU and memory. This heuristic method helps to find the optimal solution faster and avoids overly complicated calculation processes; in addition, the algorithm updates the weight based on the comparison result of the real-time load and the average load, which can ensure that resources are used more fairly and effectively. DETAILED DESCRIPTION

[0039] Depend on Figure 1 It can be known that the specific method steps of the present invention are:

[0040] (1) User request: The user submits an access request to the database security management and control platform through a web browser. The request contains the ID of the target database to be accessed.

[0041] (2) Interceptor intercepts requests: The interceptor plays a role in preprocessing requests and responses in the system. When the interceptor finds that the user request contains the ID of the target database, it queries the subnet information corresponding to the target database and attaches the subnet information to the request;

[0042] (3)) Nginx server routing request: According to the subnet information in the request, the request is routed to the DSC service in the corresponding subnet. This routing mechanism based on request information enables Nginx to flexibly handle complex network topologies and ensure that the request is correctly sent to the target service;

[0043] (4) Load balancing within a subnet: One or more DSC services are deployed in each subnet. When the Nginx server routes the user's access request to the corresponding subnet, if the subnet has multiple DSC services deployed, load balancing is required to select and calculate, and finally determine the optimal DSC service to provide to the user.

[0044] The specific process of the load balancing algorithm is as follows:

[0045] 1) Initialization: DSC service set S = {s1, s2, ..., s n}, where n represents the total number of DSC services in the subnet, s i represents the i-th DSC service, 1≤i≤n, w i represents the weight of the ith DSC service. The initial weights are all 0.5. Set the initial weight list W = {w1,w2,…,w n}, set the current position pointer p = 1, that is, point to the first DSC service;

[0046] 2) Real-time load calculation

[0047] Calculate the load of each DSC service server in real time;

[0048] a) Calculate the load factor:

[0049] oFor s i CPU usage of the server C i , the corresponding CPU load factor F cpu,i The function expression is When C i When the value of is small, F cpu,i The function value grows slowly, but when C i When the value of is large, F cpu,i The function value grows faster; this means that the higher the CPU load, the greater the impact on the CPU load factor. i =0.9, F cpu,i The value of is 1, which means the load factor reaches the highest;

[0050] oFor s i The memory usage of the server M i , the corresponding memory load factor F mem,i The function expression is When M i When the value of is small, F mem,i The function value grows slowly, but when M i When the value of is large, F mem,i The function value grows faster; this means that the higher the memory load, the greater the impact on the memory load factor, and when M i =0.9, Fmem,i The value of is 1, which means the load factor reaches the highest;

[0051] b) Comprehensive calculation of real-time load:

[0052] oCalculate the combined load factor F of CPU and memory i , and its calculation formula is

[0053] This function can be realized: when the load factor F cpu,i and F mem,i When the values ​​are all small, the comprehensive load factor F i The value of is small; once the load factor F cpu,i and F mem,i When one or even two of the values ​​are large, the comprehensive load factor F i The value of will become larger;

[0054] 3) Weight update method

[0055] Calculating the load average The calculation formula is: The weight is updated based on the comparison between the real-time load and the average load. When the server load is low, its weight is increased, and when the load is high, its weight is reduced. Based on this, the following weight update strategy is designed:

[0056] Among them, w i ′ is the updated weight, w i is the weight before updating.

[0057] 4) Select a server

[0058] If w p ′>0.5, then select DSC service s p Processing request, p and w p ′ are the DSC services pointed to by pointer p and their weights;

[0059] o Otherwise, move pointer p back one position and repeat this step until a DSC service with a weight greater than 0.5 is found or all DSC services are traversed;

[0060] o If there is no DSC service with a weight greater than 0.5, the DSC service with the highest weight is selected;

[0061] 5) Processing Requests

[0062] oSend the request to the selected DSC services p to process;

[0063] 6) Update pointer:

[0064] o Move pointer p back one position. If pointer p has reached the end of the list, reset it to the beginning of the list.

[0065] 7) Return to step 2) and continue processing new user requests

[0066] Through the above method, a weighted polling load balancing algorithm based on real-time load heuristic optimization can be implemented. This algorithm can dynamically adjust the weight according to the real-time performance of the server, thereby distributing the request load more evenly and improving the overall performance and stability of the system.

[0067] A more specific example:

[0068] 1) Initialization: Assume that there are three DSC services in the subnet, named s1, s2, and s3. The initial weights are all 0.5, so the initial weight list W = {0.5, 0.5, 0.5}, and the current position pointer p = 1.

[0069] 2) Real-time load calculation

[0070] Calculate the load of each DSC service server in real time;

[0071] a) Calculate the load factor:

[0072] For the server where s1 is located, the CPU usage C1=0.7 and the memory usage M1=0.5.

[0073] For the server where s2 is located, the CPU usage C2=0.3 and the memory usage M2=0.8.

[0074] The CPU usage C3 of the server where s3 is located is 0.9, and the memory usage M3 is 0.2.

[0075] Calculate the CPU load factor of each server:

[0076] F cpu,1 =0.471

[0077] F cpu,2 =0.037

[0078] F cpu,3 =1.000

[0079] Calculate the memory load factor of each server:

[0080] F mem,1 =0.172

[0081] F mem,2 =0.702

[0082] F mem,3=0.011

[0083] b) Comprehensive calculation of real-time load:

[0084] oCalculate the combined load factor F of CPU and memory i , and its calculation formula is

[0085]

[0086] Using the above formula to calculate the comprehensive load factors F1, F2, and F3 for each DSC service, the results are:

[0087] F1=0.245

[0088] F2=0.493

[0089] F3=1.000

[0090] 3) Weight update method

[0091] Calculating the load average The weight is updated based on the comparison between the real-time load and the average load. i ′ is the updated weight, w1′=0.712, w2′=0.926, w3′=0.211.

[0092] 4) Select a server

[0093] o w1′>0.5, select DSC service s1 to handle the request;

[0094] 5) Processing Requests

[0095] o Send the request to the selected DSC service s1 for processing;

[0096] 6) Update pointer:

[0097] o Move pointer p back one position, p=2.

[0098] 7) Return to step 2) and continue processing new user requests.

[0099] It can be seen from the calculation results of the embodiment that the present invention can dynamically adjust the weight according to the real-time performance of the server, while some other traditional load balancing algorithms are difficult to do this. For example, some algorithms may pre-set a fixed weight ratio, resulting in a failure to respond in time when the server performance changes.

[0100] Then, the present invention can perform adaptive adjustment according to the real-time load of the server to better balance the load between the servers. In contrast, some algorithms may only focus on a single indicator, which may lead to uneven load.

[0101] In addition, each step of the algorithm of the present invention is relatively simple and clear, easy to understand and implement. Moreover, as new services are added or removed, only the initial weight list needs to be modified accordingly, without redesigning the entire algorithm, which has good scalability.

[0102] The units, devices or modules described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. For the convenience of description, the above devices are described separately by functions divided into various modules. Of course, when implementing this application, the functions of each module can be implemented in the same or more software and / or hardware, or the modules that implement the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0103] Those skilled in the art also know that, in addition to implementing the controller in a purely computer-readable program code, the controller can be made to implement the same function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered as a hardware component, and the devices for implementing various functions included therein can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules for implementing the method and structures within the hardware component.

[0104] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, classes, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0105] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a mobile terminal, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0106] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc.

[0107] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A database security management and control method including a network partitioning function, characterized in that: The method comprises the following steps: (1) User request: The user submits an access request to the database security management and control platform through a web browser. The request contains the ID of the target database to be accessed. (2) The interceptor intercepts the request: The interceptor finds that the user request contains the ID of the target database, queries the subnet information corresponding to the target database, and attaches the subnet information to the request; (3) Nginx server routing request: Based on the subnet information in the above request, the request is routed to the DSC service in the corresponding subnet. (4) Load balancing within a subnet: When the Nginx server routes the user's access request to the corresponding subnet, if the subnet has deployed multiple DSC services, load balancing is required to select and calculate, and ultimately determine the optimal DSC service to provide to the user.

2. A database security management and control method including a network partitioning function as claimed in claim 1, characterized in that: In step (4), the load balancing process is: 4.1 Initialization: The DSC service set is S = {s1, s2, ..., s n }, where n is the total number of DSC services in the subnet, s i For the i-th DSC service, 1≤i≤n, w i is the weight of the ith DSC service, the initial weight is 0.5, and the initial weight list W is set to {w1,w2,…,w n }, set the current position pointer p = 1, that is, point to the first DSC service; 4.2 Calculate the real-time load, divided into: a) Calculate the load factor: For s i CPU usage of the server C i , the corresponding CPU load factor For s i The memory usage of the server M i , the corresponding memory load factor is b) Calculate real-time load: The combined load factor of CPU and memory is 4.3 Weight Update: Calculating Average Load The weight update strategy is in, w′ i is the updated weight, w i is the weight before updating. 4.4 Select server: w′ p >0.5, select DSC service p Processing request, p and w′ p are the DSC services pointed to by pointer p and their weights respectively; w p When ′≤0.5, move the pointer p back one position and repeat this step until a DSC service with a weight greater than 0.5 is found or all DSC services are traversed; if there is no DSC service with a weight greater than 0.5, select the DSC service with the highest weight; 4.5 Processing request: Sending the request to the selected DSC servers p ; 4.6 Update pointer: Move pointer p back one position. If pointer p has reached the end of the list, reset it to the beginning of the list. 4.7 Return to step 4.2 to continue processing new user requests.

3. A database security management and control system including a network partitioning function, characterized in that: The system includes: (1) User request module: In this module, the user submits an access request to the database security management and control platform through a Web browser. The request contains the ID of the target database to be accessed. (2) Interceptor interception request module: The interceptor in this module finds that the user request module contains the ID of the target database, queries the subnet information corresponding to the target database, and attaches the subnet information to the request module; (3) Nginx server routing request module: This module routes the request to the DSC service in the corresponding subnet according to the subnet information in the above request module. (4) Intra-subnet load balancing module: When the Nginx server routing request module routes the user access request to the corresponding subnet, if the subnet has deployed multiple sets of DSC services, the module will perform selection calculations through load balancing and ultimately determine the optimal DSC service to provide to the user.

4. A database security management and control system including a network partitioning function as claimed in claim 3, characterized in that: In the load balancing module within the subnet, the load balancing process is: 4.1 Initialization: The DSC service set is S = {s1, s2, ..., s n }, where n is the total number of DSC services in the subnet, s i For the i-th DSC service, 1≤i≤n, w i is the weight of the ith DSC service, the initial weight is 0.5, and the initial weight list W is set to {w1,w2,…,w n }, set the current position pointer p = 1, that is, point to the first DSC service; 4.2 Calculate the real-time load, divided into: a) Calculate the load factor: For s i CPU usage of the server C i , the corresponding CPU load factor For s i The memory usage of the server M i , the corresponding memory load factor is b) Calculate real-time load: The combined load factor of CPU and memory is 4.3 Weight Update: Calculating Average Load The weight update strategy is in, w′ i is the updated weight, w i is the weight before updating. 4.4 Select server: w′ p >0.5, select DSC service p Processing request, p and w′ p are the DSC services pointed to by pointer p and their weights; w′ p When ≤0.5, move the pointer p back one position and repeat this step until a DSC service with a weight greater than 0.5 is found or all DSC services are traversed; if there is no DSC service with a weight greater than 0.5, select the DSC service with the highest weight; 4.5 Processing request: Sending the request to the selected DSC servers p ; 4.6 Update pointer: Move pointer p back one position. If pointer p has reached the end of the list, reset it to the beginning of the list. 4.7 Return to step 4.2 to continue processing new user requests.

Images