Structured query language (SQL) defense method and system and computing equipment

Abstract

The invention discloses an SQL defense method and system and computing equipment, and the method comprises the steps that an SQL defense rule configuration unit configures corresponding SQL defense rules for a plurality of SQL engines through a unified entrance, each SQL defense rule comprises an effective SQL engine and a corresponding execution action, and the formats of the SQL defense rules corresponding to the SQL engines are the same; and the SQL defense rule configuration unit sends the configured SQL defense rules to the corresponding SQL engines according to the valid SQL engines in each SQL defense rule, so that the SQL engines can defend the received SQL statements according to the obtained SQL defense rules. According to the method, the flexibility and expandability of SQL defense can be enhanced.

Description

[0001] This application claims the priority of the Chinese patent application filed with the State Intellectual Property Office on July 4, 2023, with application number 202310813133.X and invention name “SQL Defense Method and System”, the entire contents of which are incorporated by reference in this application. Technical Field

[0002] The present application relates to the field of databases, and more specifically, to a method, system and computing device for structured query language SQL defense. Background Art

[0003] In the current structured query language (SQL) engine, data query services are provided to users by executing the user's SQL statements. With the development of technology, SQL engines emerge in an endless stream. While bringing us a variety of solutions, they also expose certain problems. For example, the quality of SQL statements entered by users varies greatly. Low-quality SQL statements will bring unexpected impacts to the platform or system. Large SQL statements or bad SQL statements will cause system paralysis and service unavailability. Slow SQL statements will affect the stability of the system. The main manifestation is that the server thread pool is full, causing an avalanche effect, and other normal SQL statements cannot be executed normally, resulting in a system pseudo-death phenomenon.

[0004] In the related technical solutions, SQL statements are parsed and defended through the business layer. On the one hand, since SQL statements are parsed and judged in the business layer, the business process of the business layer needs to be transformed. On the other hand, since SQL statements need to be parsed and judged in the business layer, SQL statements that meet the requirements need to be sent to the SQL engine. When the SQL engine processes the SQL statements, it needs to parse the SQL statements again, which results in high performance loss. On the other hand, each SQL engine parses and defends SQL statements based on its own SQL grammar, which not only has poor flexibility and scalability, but also lacks versatility of SQL grammar.

[0005] Therefore, how to enhance the flexibility and scalability of SQL defense has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] The present application provides a structured query language (SQL) defense method, system, and computing device, which can enhance the flexibility and scalability of SQL defense.

[0007] In a first aspect, a structured query language SQL defense method is provided, the method is applied to a SQL defense system, the SQL defense system includes a SQL defense rule configuration unit and multiple SQL engines, the method includes: the SQL defense rule configuration unit configures corresponding SQL defense rules for the multiple SQL engines through a unified entrance, each of the SQL defense rules includes an effective SQL engine and a corresponding execution action, and the formats of the SQL defense rules corresponding to the multiple SQL engines are the same; the SQL defense rule configuration unit sends the configured SQL defense rules to the corresponding SQL engines according to the effective SQL engines in each of the SQL defense rules, so that the SQL engine defends the received SQL statements according to the obtained SQL defense rules.

[0008] In the above technical solution, a unified entry is used to configure and issue SQL defense rules of the same format to multiple SQL engines, and the SQL engine defends the received SQL statements based on the obtained SQL defense rules. In this way, on the one hand, the business layer does not need to parse the SQL statements, and the SQL statements are directly parsed and defended in the SQL engine, which has a relatively low performance loss. On the other hand, since SQL defense rules can be configured for multiple SQL engines, and the format of SQL defense rules is the same, the flexibility, scalability and universality of SQL syntax are enhanced.

[0009] In combination with the first aspect, in certain implementations of the first aspect, the multiple SQL engines include a first SQL engine, and the method also includes: the first SQL engine obtains at least one corresponding SQL defense rule from the SQL defense rule configuration unit, and the at least one SQL defense rule includes a first SQL defense rule; the first SQL engine receives a first SQL statement from the business layer; the first SQL engine executes the action in the first SQL defense rule based on the first SQL statement satisfying the first SQL defense rule.

[0010] In the above technical solution, the SQL engine can defend SQL statements autonomously, avoiding the unpredictable impact of low-quality SQL statements on the big data analysis and processing platform or database, making the defense more accurate. In addition, since the SQL engine directly parses the SQL statements first, there is no need to parse the SQL statements at the business layer, resulting in low performance loss, no business layer modification, and easy implementation.

[0011] In combination with the first aspect, in certain implementations of the first aspect, the SQL defense rule configuration unit automatically sends the configured SQL defense rules to the corresponding SQL engines during the loading cycle according to the SQL engines in which each SQL defense rule is effective.

[0012] In the above technical solution, the configured SQL defense rules are automatically sent to the corresponding SQL engines during the loading cycle. In this way, the SQL engine can automatically load the SQL defense rules during the loading cycle without restarting the SQL engine or interrupting the business.

[0013] In combination with the first aspect, in some implementations of the first aspect, the SQL defense rules include prompt-type SQL defense rules, intercept-type SQL defense rules, and circuit-breaker-type SQL defense rules.

[0014] In combination with the first aspect, in certain implementations of the first aspect, the first SQL defense rule is a SQL defense rule of the prompt class, and the first SQL engine continues to execute the first SQL statement.

[0015] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the first SQL engine displays prompt information of the first SQL statement to the user.

[0016] In the above technical solution, the prompt information of the first SQL statement can be displayed to the user through the client to improve the user's interactive experience.

[0017] In combination with the first aspect, in certain implementations of the first aspect, the first SQL defense rule is a SQL defense rule of the interception class or a SQL defense rule of the circuit breaker class, and the first SQL engine stops executing the first SQL statement.

[0018] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the first SQL engine displays to the user the reason why the execution of the first SQL statement is stopped.

[0019] In the above technical solution, the reason why the execution of the first SQL statement is stopped can be displayed to the user through the client, thereby improving the user's interactive experience.

[0020] In combination with the first aspect, in certain implementations of the first aspect, the first SQL engine automatically loads the at least one SQL defense rule within a loading cycle.

[0021] In the above technical solution, the SQL engine can automatically load SQL defense rules during the loading cycle without restarting the SQL engine or interrupting the business.

[0022] In combination with the first aspect, in certain implementations of the first aspect, the SQL defense rule also includes a list of effective tenants and a rule identification ID.

[0023] In a second aspect, a structured query language SQL defense system is provided, the system comprising an SQL defense rule configuration unit and multiple SQL engines: the SQL defense rule configuration unit is used to configure corresponding SQL defense rules for the multiple SQL engines through a unified entrance, each of the SQL defense rules includes an effective SQL engine and a corresponding execution action, and the formats of the SQL defense rules corresponding to the multiple SQL engines are the same; the SQL defense rule configuration unit is also used to send the configured SQL defense rules to the corresponding SQL engines according to the effective SQL engines in each of the SQL defense rules, so that the SQL engine can defend the received SQL statements according to the obtained SQL defense rules.

[0024] In combination with the second aspect, in certain implementations of the second aspect, the multiple SQL engines include a first SQL engine, and the first SQL engine is used to obtain at least one corresponding SQL defense rule from the SQL defense rule configuration unit, and the at least one SQL defense rule includes a first SQL defense rule; the first SQL engine is also used to receive a first SQL statement from the business layer; the first SQL engine is also used to execute an action in the first SQL defense rule based on the first SQL statement satisfying the first SQL defense rule.

[0025] In combination with the second aspect, in certain implementations of the second aspect, the SQL defense rule configuration unit is specifically used to: automatically send the configured SQL defense rules to the corresponding SQL engines during the loading cycle according to the SQL engines in which each SQL defense rule is effective.

[0026] In combination with the second aspect, in some implementations of the second aspect, the SQL defense rules include prompt-type SQL defense rules, intercept-type SQL defense rules, and circuit-breaker-type SQL defense rules.

[0027] In combination with the second aspect, in certain implementations of the second aspect, the first SQL defense rule is an SQL defense rule of the prompt class, and the first SQL engine is specifically used to: continue executing the first SQL statement.

[0028] In combination with the second aspect, in some implementations of the second aspect, the first SQL engine is further used to display prompt information of the first SQL statement to the user.

[0029] In combination with the second aspect, in certain implementations of the second aspect, the first SQL defense rule is an SQL defense rule of the interception class or an SQL defense rule of the circuit breaker class, and the first SQL engine is specifically used to: stop executing the first SQL statement.

[0030] In combination with the second aspect, in some implementations of the second aspect, the first SQL engine is further used to display to the user the reason why the execution of the first SQL statement is stopped.

[0031] In combination with the second aspect, in certain implementations of the second aspect, the first SQL engine automatically loads the at least one SQL defense rule within a loading cycle.

[0032] In combination with the second aspect, in some implementations of the second aspect, the SQL defense rule also includes a list of effective tenants and a rule identification ID.

[0033] In a third aspect, a computing device cluster is provided, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method in the first aspect or any possible implementation of the first aspect.

[0034] Optionally, the processor may be a general-purpose processor, which may be implemented by hardware or software. When implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor may be a general-purpose processor implemented by reading software code stored in a memory, which may be integrated in the processor or located outside the processor and exist independently.

[0035] In a fourth aspect, a chip is provided, which obtains instructions and executes the instructions to implement the method in the above-mentioned first aspect and any implementation manner of the first aspect.

[0036] Optionally, as an implementation manner, the chip includes a processor and a data interface, and the processor reads instructions stored in the memory through the data interface to execute the method in the above-mentioned first aspect and any implementation manner of the first aspect.

[0037] Optionally, as an implementation method, the chip may also include a memory, in which instructions are stored, and the processor is used to execute the instructions stored in the memory. When the instructions are executed, the processor is used to execute the method in the first aspect and any one of the implementation methods of the first aspect.

[0038] In a fifth aspect, a computer program product comprising instructions is provided. When the instructions are executed by a computing device cluster, the computing device cluster executes the method in the first aspect and any one of the implementations of the first aspect.

[0039] In a sixth aspect, a computer-readable storage medium is provided, comprising computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method in the first aspect and any one of the implementations of the first aspect.

[0040] By way of example, these computer-readable storages include, but are not limited to, one or more of the following: read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), Flash memory, electrically EPROM (EEPROM), and hard drive.

[0041] Optionally, as an implementation manner, the above-mentioned storage medium may specifically be a non-volatile storage medium. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a schematic block diagram of a cloud scenario applicable to an embodiment of the present application.

[0043] Figure 2 It is a schematic block diagram of a system for defending SQL provided in an embodiment of the present application.

[0044] Figure 3 This is a schematic diagram of the classification of SQL defense rules provided in an embodiment of the present application.

[0045] Figure 4 It is a schematic flowchart of a method for defending against SQL statements provided in an embodiment of the present application.

[0046] Figure 5 It is a schematic diagram of an optional SQL defense rule template provided by the unified defense rule definition unit 231 provided in an embodiment of the present application to a system administrator.

[0047] Figure 6 This is a schematic diagram of an administrator configuring an effective SQL defense rule for a SQL engine, provided in an embodiment of the present application.

[0048] Figure 7 It is a schematic diagram of a configuration file of SQL defense rules provided by an embodiment of the present application for reading by an SQL engine.

[0049] Figure 8 It is a schematic flowchart of another method for defending against SQL statements provided in an embodiment of the present application.

[0050] Fig. 9It is a schematic flowchart of a SQL defense rule definition and management system 230 provided in an embodiment of the present application sending a SQL defense rule configuration file to a SQL engine.

[0051] Fig.10 It is a schematic flowchart of an SQL engine provided in an embodiment of the present application for parsing and defending a received SQL statement.

[0052] Fig.11 It is a schematic block diagram of a SQL defense system 1000 provided in an embodiment of the present application.

[0053] Fig.12 It is a schematic diagram of the architecture of a computing device 1500 provided in an embodiment of the present application.

[0054] Fig.13 It is a schematic diagram of the architecture of a computing device cluster provided in an embodiment of the present application.

[0055] Fig.14 It is a schematic diagram of the connection between computing devices 1500A and 1500B via a network provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0057] The present application will present various aspects, embodiments or features around a system including multiple devices, components, modules, etc. It should be understood and appreciated that each system may include additional devices, components, modules, etc., and / or may not include all devices, components, modules, etc. discussed in conjunction with the figures. In addition, combinations of these schemes may also be used.

[0058] In addition, in the embodiments of the present application, words such as "exemplary" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present concepts in a concrete way.

[0059] In the embodiments of the present application, "corresponding (corresponding, relevant)" and "corresponding (corresponding)" can sometimes be used interchangeably. It should be pointed out that when the distinction between them is not emphasized, the meanings they intend to express are consistent.

[0060] The business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can appreciate that, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0061] References to "one embodiment" or "some embodiments" etc. described in this specification mean that a particular feature, structure or characteristic described in conjunction with the embodiment is included in one or more embodiments of the present application. Thus, the phrases "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear at different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0062] In the present application, "at least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: including the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0063] For the convenience of description, the concepts involved in the embodiments of the present application are first explained below.

[0064] 1. Overload

[0065] Overload refers to a state in which the concurrent input of a system exceeds the rated capacity of the system, resulting in the system being unable to provide services in a timely manner. It is usually described by the ratio of actual business request data to the rated business request number, such as 3 times the load, 10 times the load, and 30 times the load.

[0066] 2. Overload protection

[0067] Overload is a broad term that can refer to excessive load on electrical equipment, excessive force on an object, or the number of business requests for a software service exceeding its design specifications. The protection against these behaviors that exceed the "load" is collectively referred to as overload protection.

[0068] 3. Overload control

[0069] Overload control, also known as flow control, refers to the process in which the system ensures successful processing of part or all of the rated capacity of the business through flow control, degradation, fuse, isolation and elastic scaling when the system is in an overloaded state.

[0070] 4. Structured query language (SQL) interception

[0071] SQL interception is an emerging, high-speed and lightweight security protection technology that performs static and dynamic security monitoring before and after SQL is submitted to the database / SQL engine to help defend against potential security threats. The most common SQL interception method is to conduct a security review at the SQL statement level. Once a malicious statement is found, it can be promptly prevented from being submitted or executed.

[0072] 5. SQL Circuit Breaker

[0073] A SQL statement takes up too many resources, using up the resources of each node or a single node to a high level, resulting in insufficient computing resources or storage resources and causing various problems. SQL fuse is a self-overload protection method for databases / SQL engines. Generally, it refers to the practice of suspending the execution of some SQL statements in order to retain key services when the overall resources are about to be exhausted. It is generally considered from the perspective of overall load.

[0074] In the current SQL engine, data query services are provided to users by executing their SQL statements. With the development of technology, SQL engines emerge in an endless stream. While bringing us a variety of solutions, they also expose certain problems. For example, the quality of SQL statements entered by users varies greatly. Low-quality SQL statements will bring unexpected impacts to the platform or system. Large SQL statements or bad SQL statements will cause system paralysis and service unavailability. Slow SQL statements will affect the stability of the system, mainly manifested in the server thread pool being full, causing an avalanche effect, and other normal SQL statements cannot be executed normally, resulting in system pseudo-death.

[0075] Therefore, how to defend against low-quality SQL statements input by users has become a technical problem that needs to be solved urgently.

[0076] In the related technical solutions, each SQL engine parses and defends SQL statements in the business layer above it. On the one hand, since the SQL statements are parsed and judged in the business layer, the business process of the business layer needs to be transformed. On the other hand, since the SQL statements need to be parsed and judged in the business layer, the SQL statements that meet the requirements need to be sent to the SQL engine. When the SQL engine processes the SQL statements, it needs to parse the SQL statements again, which results in high performance loss. On the other hand, each SQL engine parses and defends SQL statements based on its own SQL grammar, which not only has poor flexibility and scalability, but also lacks versatility of SQL grammar.

[0077] In view of this, an embodiment of the present application proposes a method of SQL defense, which configures and issues SQL defense rules of the same format for multiple SQL engines through a unified entrance, and the SQL engine defends the received SQL statements based on the obtained SQL defense rules. In this way, on the one hand, the business layer does not need to parse the SQL statements, and the SQL statements are directly parsed and defended in the SQL engine, and the performance loss is relatively low. On the other hand, since SQL defense rules can be configured for multiple SQL engines, and the format of SQL defense rules is the same, the flexibility, scalability and universality of SQL syntax are enhanced.

[0078] In a possible implementation, the method provided in the embodiment of the present application can be applied to a cloud service scenario, and the method is executed by a cloud management platform in the cloud service scenario. Figure 1 , describe the cloud service scenarios in detail.

[0079] Figure 1 is a schematic block diagram of a cloud scenario applicable to an embodiment of the present application. Figure 1 As shown, the cloud scenario may include: a cloud management platform 110 , the Internet 120 , and a client 130 .

[0080] like Figure 1 As shown, the cloud management platform 110 is used to manage the infrastructure that provides multiple cloud services. The infrastructure includes multiple cloud data centers, each of which includes multiple servers, each of which includes cloud service resources to provide corresponding cloud services for tenants.

[0081] The cloud management platform 110 may be located in a cloud data center, which may provide an access interface (such as an interface or an application program interface (API)). The tenant may operate the client 130 to remotely access the access interface to register a cloud account and password on the cloud management platform 110, and log in to the cloud management platform 110. After the cloud management platform 110 successfully authenticates the cloud account and password, the tenant may further pay to select and purchase a virtual machine of specific specifications (processor, memory, disk) on the cloud management platform 110. After the paid purchase is successful, the cloud management platform 110 provides the remote login account and password of the purchased virtual machine, and the client 130 may remotely log in to the virtual machine, install and run the tenant's application in the virtual machine. Therefore, the tenant may create, manage, log in and operate a virtual machine in the cloud data center through the cloud management platform 110. Among them, the virtual machine may also be called a cloud server (elastic compute service, ECS) or an elastic instance (different cloud service providers have different names).

[0082] It should be understood that tenants of cloud services can be individuals, enterprises, schools, hospitals, administrative agencies, etc.

[0083] The functions of the cloud management platform 110 include, but are not limited to, user console, computing management service, network management service, storage management service, authentication service, and image management service. The user console provides an interface or API to interact with tenants, the computing management service is used to manage servers running virtual machines and containers and bare metal servers, the network management service is used to manage network services (such as gateways, firewalls, etc.), the storage management service is used to manage storage services (such as data bucket services), the authentication service is used to manage tenant accounts and passwords, and the image management service is used to manage virtual machine images. Tenants can use the client 130 to log in to the cloud management platform 110 through the Internet 120 to manage the rented cloud services.

[0084] Figure 2 Schematic diagram of a SQL defense system provided by an embodiment of the present application. Figure 2 As shown, the system includes a business layer 210, a SQL engine layer 220 and a SQL defense rule definition and management system 230. The functions of each part are described in detail below.

[0085] The SQL defense rule definition and management system 230 includes: a defense rule unified definition unit 231, a rule storage unit 232, and a rule synchronization unit 233. The defense rule unified definition unit 231 is used by the system administrator to define the SQL defense rules of all SQL engines, the rule storage unit 232 is used to store the SQL defense rules of the SQL engine, and the rule synchronization unit 233 is used to automatically synchronize the SQL defense rules to the corresponding SQL engine in the SQL engine layer 220 in the background periodically, and the automatic synchronization period can be set.

[0086] In the present application embodiment, Figure 3 As shown, SQL defense rules can be divided into: SQL defense rules in the prevention and protection category and SQL defense rules in the overload protection category. Among them, SQL defense rules in the prevention and protection category may include but are not limited to: SQL interception type defense rules and SQL prompt type defense rules. SQL defense rules in the overload protection category may include but are not limited to: SQL fuse type defense rules. The following is a detailed introduction to the above various types of SQL defense rules.

[0087] For example, the defense rules of SQL interception / prompt include static rules and dynamic rules. Among them, the static rules are pure SQL syntax rules, and the dynamic rules are rules related to table statistics, table metadata, execution plans, SQL types and other information.

[0088] For example, the rules of static classes may include but are not limited to the following specific rules:

[0089] static_0001-The number of count(distinct) occurrences in SQL exceeds the set limit

[0090] static_0002 - Use Not in <subquery>Statements may result in slow SQL

[0091] static_0003-The number of joins in SQL exceeds the limit

[0092] static_0004-Union all times in SQL exceeded the limit

[0093] static_0005-Number of nested subqueries exceeds the limit

[0094] static_0006-SQL string length exceeds limit

[0095] static_0007-Cartesian product exists when multiple tables are associated

[0096] static_0008-Perform alter table update / delete operations at the cluster level (on cluster)

[0097] static_0009-Execute alter table to add / delete columns at the cluster level (on cluster)

[0098] static_0010-Execute optimize final operation at cluster level

[0099] static_0011-When creating a distributed table, the subtable is a distributed table

[0100] For example, dynamic class rules may include but are not limited to the following specific rules:

[0101] dynamic_0001-The number of scanned files exceeds the limit

[0102] dynamic_0002-The number of partitions involved in the delete or alter cascade operation exceeds the limit

[0103] As another example, the SQL circuit breaker defense rule is a rule determined based on the statistical information of the system dimension at runtime. The statistical information of the system dimension may include but is not limited to: CPU, memory, IO, tilt rate, etc.

[0104] For example, SQL circuit breaker defense rules may include but are not limited to the following specific rules:

[0105] Running_0001-The number of result rows returned by a select SQL statement to the client exceeds the limit

[0106] running_0002-The actual number of partitions read by the SQL engine for a single table exceeds the limit

[0107] running_0003-SQL memory usage peak exceeds limit

[0108] running_0004-SQL has been running for a period of time exceeding the limit

[0109] running_0004-SQL has been running for a period of time exceeding the limit

[0110] The SQL engine layer 220 may include multiple SQL engines ( Figure 2 3 SQL engines are used as examples for illustration), each SQL engine may include a rule loading module and a rule verification module. The rule loading module is used to automatically and regularly load the SQL defense rule configuration synchronized by the rule synchronization unit 233 into the engine process memory and make it effective for the SQL execution process. The rule verification module is used to compare the content of the input SQL statement with each SQL defense rule, and if it is found to meet the defense standard, the corresponding action defined by the rule is triggered.

[0111] For example, the SQL engines included in the above-mentioned SQL engine layer 220 may include but are not limited to: hive engine, hetuengine engine, spark engine, presto engine, MySQL engine, gaussDB engine, DWS engine, clickhouse engine, etc. Figure 2 The SQL engine layer 220 including the hive engine, hetuengine engine and DWS engine is used as an example for demonstration.

[0112] The business layer 210 is used to submit the SQL statement input by the user to the corresponding SQL engine in the SQL engine layer 220 according to the original SQL submission interface.

[0113] Below Figure 2 As an example, the system shown in Figure 4 A method for defending against SQL statements provided in an embodiment of the present application is described in detail. It should be understood that Figure 4 The examples are only intended to help those skilled in the art understand the embodiments of the present application, and are not intended to limit the embodiments of the present application to Figure 4 The specific numerical values ​​or specific scenarios shown in the examples. Figure 4 The examples given below are obviously susceptible to various equivalent modifications or changes, and such modifications and changes also fall within the scope of the embodiments of the present application.

[0114] Figure 4 : is a schematic flow chart of a method for defending against SQL statements provided in an embodiment of the present application. Figure 4 As shown, the method includes steps 410-420, and steps 410-420 are described in detail below.

[0115] It should be understood that Figure 4 The method shown can be Figure 2 The SQL defense rule definition and management system 230 are executed.

[0116] Step 410: The administrator configures SQL defense rules for multiple SQL engines through the unified entry provided by the SQL defense rule definition and management system 230.

[0117] As an example, the system administrator can define or configure the SQL defense rules of all SQL engines through the unified defense rule definition unit 231. There are many specific implementation methods, and the embodiments of the present application do not specifically limit this. In one possible implementation method, the unified defense rule definition unit 231 can provide a visualization page to the system administrator, through which the system administrator can define the SQL defense rules of all engines in one stop. In another possible implementation method, the unified defense rule definition unit 231 can also provide a background programming / communication interface to the system administrator, through which the system administrator can define the SQL defense rules of all engines.

[0118] Taking the defense rule unified definition unit 231 providing a visualization page to the system administrator as an example, it can provide an interface to the system administrator, which displays the template of the SQL defense rule that can be selected. As an example, the information in the template of the SQL defense rule may include but is not limited to: the globally unique ID of the SQL defense rule, the content of the SQL defense rule judgment, the list of engines supported or applicable by the SQL defense rule, the defense behavior supported by the SQL defense rule, the threshold parameters triggered by the SQL defense rule, and the reference value of the threshold parameters triggered by the SQL defense rule.

[0119] The defense actions corresponding to the above SQL defense rules may include but are not limited to: prompt, intercept, fuse (also known as blocking), and service degradation. Service degradation can be understood as limiting the total amount of computing resources that can be used by the intercepted SQL statement, and taking a longer time to complete the execution of the SQL statement. The total amount of computing resources may include but are not limited to: CPU, memory, IO, etc.

[0120] It should be understood that one SQL defense rule can correspond to at least one defense behavior. The list of engines supported or applicable to the SQL defense rule can include at least one engine, that is, one SQL defense rule can be effective for one engine, or it can be effective for multiple engines at the same time.

[0121] For example, Figure 5 An example of an optional SQL defense rule template provided by the unified defense rule definition unit 231 to the system administrator. For example, for the SQL defense rule with ID static_0001, its specific rule is to determine whether the number of count (distinct) occurrences in SQL exceeds the set limit; applicable engines include hive, spark, and hetuengine; supported actions include prompts and intercepts; configured parameters include P1 (limit threshold for the number of count (distinct) occurrences in SQL); P1 is recommended to be configured as 5. For another example, for the SQL defense rule with ID dynamic_0001, its specific rule is to determine whether the number of scanned files exceeds the limit; applicable engines include hive, spark, and hetuengine; supported actions include prompts and intercepts; configured parameters include P1 (threshold for the number of files planned to be scanned); P1 has different recommended values ​​for different engines, and Hive is recommended to be configured as 10. For example, for the SQL defense rule with ID running_0001, its specific rule is to determine whether the number of result rows returned to the client by a select-type SQL statement exceeds the limit; applicable engines include hive, spark, hetuengine, and clickhouse; supported actions include blocking; configured parameters include P1 (the threshold for the number of result rows returned to the client); P1 is recommended to be configured as 100000.

[0122] In the embodiment of the present application, the administrator can configure the SQL defense rules of all SQL engines according to the template of the selectable SQL defense rules provided by the defense rule unified definition unit 231. Specifically, the administrator can define the effective scope of the SQL defense rules at the engine and tenant levels, and one rule can be selected to be effective for multiple engines at the same time, and multiple "defense actions" and triggering thresholds can be configured in one rule at the same time.

[0123] For example, Figure 6 This is an example of an interface for administrators to configure effective SQL defense rules for the SQL engine. Figure 6 As shown, the administrator can select a specific SQL defense rule through the visualization page and select the tenant that uses the rule. The administrator can also click "Add" in the visualization page to enter the "Add Service and Action" interface, where the administrator selects the engine that uses the rule and can also set the trigger threshold corresponding to the defense action (for example, prompt, intercept) of the selected SQL defense rule.

[0124] Step 420: The SQL defense rule definition and management system 230 sends the configured SQL defense rules to the corresponding SQL engine in the SQL engine layer 220 according to the SQL engine that is effective in each of the SQL defense rules.

[0125] In the embodiment of the present application, after the system administrator configures the SQL defense rules through the SQL defense rule definition and management system 230, the SQL defense rule definition and management system 230 can send the configured SQL defense rules to the corresponding SQL engine in the SQL engine layer 220. Specifically, the rule synchronization unit 233 in the SQL defense rule definition and management system 230 can automatically synchronize the SQL defense rules to the corresponding SQL engine in the SQL engine layer 220 in the background periodically, and the period of the automatic synchronization can be set.

[0126] As an example, a common, universal format SQL defense rule configuration template may be agreed upon among all SQL engines. The SQL defense rule definition and management system 230 may convert the SQL defense rules configured in the SQL defense rule interface into corresponding SQL defense rule configuration files according to the configuration template agreed upon among all SQL engines, and the rule synchronization unit 233 may automatically synchronize the SQL defense rule configuration files in the universal format to the corresponding SQL engines in the SQL engine layer 220 at regular intervals in the background.

[0127] It should be understood that the above-mentioned general format SQL defense rule configuration template may include but is not limited to: the ID of the SQL defense rule, the list of tenants for which the SQL defense rule is effective, the actions to be taken when the SQL defense rule is matched, and the corresponding trigger thresholds.

[0128] In the above technical solution, the SQL defense rule configuration file synchronized to the SQL engine is standardized, so that it can be used among multiple SQL engines to avoid reinventing the wheel.

[0129] For example, Figure 7 As shown, one configuration file of SQL defense rules for SQL engine to read is: Rule-id1|tenant:a,b,c|hint P1:5,P2:10|intercept P1:20,P2:30; another configuration file of SQL defense rules for SQL engine to read is: Rule-id2|tenant:a,e|intercept P1:20,P2:30; another configuration file of SQL defense rules for SQL engine to read is: Rule-id3|tenant:A|hint P1:5,P2:10; another configuration file of SQL defense rules for SQL engine to read is: Rule-id4|tenant:f|intercept; another configuration file of SQL defense rules for SQL engine to read is: Rule-id5|tenant:f|fuse P1:500.

[0130] It should be noted that Figure 7 The configuration file of the SQL defense rule for the SQL engine to read is only an example, and does not limit the specific content and format of the configuration file of the SQL defense rule.

[0131] It should be understood that in addition to using the above-mentioned private format, the configuration file of the SQL defense rule can also use a standard data format, which may include but is not limited to: JS object notation (Java script object notation, JSON), YAML, etc.

[0132] It should also be understood that the configuration file of the above-mentioned SQL defense rules can be transmitted in the form of a file, or it can be stored in a database in the form of a structured table. The embodiment of the present application does not make specific limitations on this.

[0133] Taking "Rule-id1|tenant:a,b,c|hint P1:5,P2:10|intercept P1:20,P2:30" as an example, "Rule-id1" indicates the ID of the SQL defense rule, "tenant:a,b,c" indicates the tenant for which the SQL defense rule takes effect, "hintP1:5,P2:10" indicates the prompt action and the corresponding trigger threshold that need to be taken when the SQL defense rule is matched, and "interceptP1:20,P2:30" indicates the interception action and the corresponding trigger threshold that need to be taken when the SQL defense rule is matched.

[0134] It should be noted that the "|" in the configuration file of the above SQL defense rules is an example of a separator, and other separators can also be used. The embodiment of the present application does not limit the specific form of the separator.

[0135] Below Figure 2 As an example, the system shown in Figure 8 Another method for defending against SQL statements provided in an embodiment of the present application is described in detail. It should be understood that Figure 8 The examples are only intended to help those skilled in the art understand the embodiments of the present application, and are not intended to limit the embodiments of the present application to Figure 8 The specific numerical values ​​or specific scenarios shown in the examples. Figure 8 The examples given below are obviously susceptible to various equivalent modifications or changes, and such modifications and changes also fall within the scope of the embodiments of the present application.

[0136] Figure 8 FIG. 1 is a schematic flow chart of another method for defending against SQL statements provided in an embodiment of the present application. Figure 8 As shown, the method includes steps 810-820, and steps 810-820 are described in detail below.

[0137] It should be understood that Figure 8 The method shown can be Figure 2 The SQL engine in the SQL engine layer 220 executes.

[0138] Step 810: The rule loading module in the SQL engine actively and regularly loads the SQL defense rule configuration file synchronized by the rule synchronization unit 233.

[0139] In the embodiment of the present application, each SQL engine in the SQL engine layer 220 includes a rule loading module, which can periodically and dynamically update the configuration file of the SQL defense rule under the premise of supporting business load. After the configuration file of the SQL defense rule is loaded and takes effect, the next SQL statement can apply the new version of the SQL defense rule.

[0140] Specifically, in a possible implementation, Fig. 9 As shown, the SQL defense rule definition and management system 230 sends the SQL defense rule configuration file to the SQL engine. In one case, if the rule loading module in the SQL engine supports the update of the SQL defense rule configuration file, the rule loading module parses and loads the SQL defense rule configuration file, and adds a new SQL defense rule and completes the initialization when the parameter verification is met. The current loading cycle is completed and waits for the next loading cycle. In another case, if the rule loading module in the SQL engine does not support the update of the SQL defense rule configuration file, then the rule loading module will determine whether it supports the update of the SQL defense rule configuration file in the next loading cycle. In another case, if the above parameter verification is not met, wait for the next loading cycle. In another case, if the initialization is not completed after the SQL defense rule is added, then retain the original configuration and wait for the next loading cycle.

[0141] Step 820: The rule verification module in the SQL engine executes the actions in the SQL defense rules for the SQL statements that meet the SQL defense rules.

[0142] In an embodiment of the present application, after the SQL engine receives the SQL statement (also referred to as SQL statement) sent by the client, it can determine whether there is an SQL statement that meets the conditions based on the loaded SQL defense rules, and perform corresponding actions on the SQL statement that meets the conditions.

[0143] It should be understood that according to the actions in the SQL defense rule configuration file, SQL defense rules can be divided into: prompt type SQL defense rules, intercept type SQL defense rules, and fuse type SQL defense rules.

[0144] It should be noted that if the SQL statement meets the triggering threshold of any one of the interception-type SQL defense rules or the fuse-type SQL defense rules, the execution process of the current SQL statement ends immediately. If the SQL statement meets the prompt-type SQL defense rules, the execution process of the SQL statement will not be interrupted.

[0145] Optionally, the embodiment of the present application can also interact with the client about the results of SQL statement defense. For example, for a SQL statement that meets the SQL defense rules of the interception class, the execution of the SQL statement will be directly terminated, and the reason for being intercepted will be displayed on the client. For another example, for a SQL statement that meets the SQL defense rules of the prompt class, the execution of the SQL statement will continue, and a warm reminder will be displayed on the client, that is, the prompt information for the SQL statement will be displayed on the client.

[0146] In the above technical solution, the SQL engine can understand and control SQL overload autonomously, so the defense is more precise, the performance loss is low, the business does not need to be modified, and it is easy to implement. In addition, since the SQL statement defense is carried out in the SQL engine, there is no need to modify the original SQL business submission process and interface, and the performance impact on the original SQL business is low.

[0147] For example, Fig.10 As shown, after receiving the SQL statement, the SQL engine parses the SQL statement. For example, if there are unverified SQL defense rules of the prompt class or SQL defense rules of the intercept class in the loaded SQL defense rules, the SQL engine selects a SQL defense rule of the prompt class or SQL defense rule of the intercept class. If the SQL statement meets the interception condition in the SQL defense rule of the intercept class, the SQL engine stops executing the SQL statement and returns relevant information to the client. If the SQL statement does not meet the interception condition in the SQL defense rule of the intercept class, it continues to determine whether it meets the prompt condition in the SQL defense rule of the prompt class. If it does, the SQL engine continues to execute the SQL statement and sends relevant prompt information to the client. For another example, if there are unverified SQL defense rules of the fuse class in the loaded SQL defense rules, the SQL engine selects a SQL defense rule of the fuse class. If the SQL statement meets the fuse condition in the SQL defense rule of the fuse class, the SQL engine stops executing the SQL statement and returns relevant information to the client. If the SQL statement does not meet the fuse condition in the SQL defense rule of the fuse class, the SQL engine continues to execute the SQL statement until the task is completed.

[0148] It should be understood that the circuit breaker conditions in the circuit breaker SQL defense rules mainly examine the system resources in various dimensions. For example, the system resources may include but are not limited to: duration, consumed computing resources (memory / CPU, etc.), data access volume, network transmission volume, etc.

[0149] Combination of the above Figures 1 to 10 , describes in detail the method provided by the embodiment of the present application, and will be combined with Figure 11-Figure 14 , describes in detail the embodiment of the system of the present application. It should be understood that the description of the method embodiment corresponds to the description of the system embodiment, so the parts not described in detail can refer to the previous method embodiment.

[0150] Fig.11 It is a schematic block diagram of a system 1000 for SQL defense provided in an embodiment of the present application. The system 1000 can be implemented by software, hardware, or a combination of the two. The system 1000 provided in an embodiment of the present application can implement the method flow shown in the embodiment of the present application, and the system 1000 includes: a SQL defense rule configuration unit 1010 and multiple SQL engines 1020. Among them, the SQL defense rule configuration unit 1010 is used to configure corresponding SQL defense rules for the multiple SQL engines through a unified entrance, each of the SQL defense rules includes an effective SQL engine and a corresponding execution action, and the format of the SQL defense rules corresponding to the multiple SQL engines is the same; the SQL defense rule configuration unit 1010 is also used to send the configured SQL defense rules to the corresponding SQL engines according to the effective SQL engines in each of the SQL defense rules, so that the SQL engine can defend the received SQL statements according to the obtained SQL defense rules.

[0151] Optionally, the system 1000 also includes a business layer, and the multiple SQL engines 1020 include a first SQL engine, which is used to obtain at least one corresponding SQL defense rule from the SQL defense rule configuration unit, and the at least one SQL defense rule includes a first SQL defense rule; the first SQL engine is also used to receive a first SQL statement from the business layer; the first SQL engine is also used to execute an action in the first SQL defense rule based on the first SQL statement satisfying the first SQL defense rule.

[0152] Optionally, the SQL defense rule configuration unit 1010 is specifically used to: automatically send the configured SQL defense rules to the corresponding SQL engines during the loading cycle according to the SQL engines that are effective in each of the SQL defense rules.

[0153] Optionally, the SQL defense rules include prompt-type SQL defense rules, intercept-type SQL defense rules, and fuse-type SQL defense rules.

[0154] Optionally, the first SQL defense rule is an SQL defense rule of the prompt class, and the first SQL engine is specifically used to: continue executing the first SQL statement.

[0155] Optionally, the first SQL engine is further used to display prompt information of the first SQL statement to the user.

[0156] Optionally, the first SQL defense rule is an SQL defense rule of the interception type or an SQL defense rule of the circuit breaker type, and the first SQL engine is specifically used to stop executing the first SQL statement.

[0157] Optionally, the first SQL engine is further used to display to the user the reason why the execution of the first SQL statement is stopped.

[0158] Optionally, the first SQL engine automatically loads the at least one SQL defense rule within a loading cycle.

[0159] Optionally, the SQL defense rule also includes a list of effective tenants and a rule identification ID.

[0160] The system 1000 here can be embodied in the form of functional modules. The term "module" here can be implemented in the form of software and / or hardware, and is not specifically limited to this.

[0161] For example, the "SQL defense rule configuration unit 1010" can be a software program, a hardware circuit, or a combination of the two to implement the above functions. Exemplarily, the implementation of the SQL defense rule configuration unit 1010 is introduced below by taking the SQL defense rule configuration unit 1010 as an example. Similarly, the implementation of other modules, such as multiple SQL engines 1020, can refer to the implementation of the SQL defense rule configuration unit 1010.

[0162] The SQL defense rule configuration unit 1010 is taken as an example of a software functional unit. The SQL defense rule configuration unit 1010 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the SQL defense rule configuration unit 1010 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including a data center or multiple data centers with close geographical locations. Among them, usually a region may include multiple AZs.

[0163] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0164] The SQL defense rule configuration unit 1010 is taken as an example of a hardware functional unit, and the SQL defense rule configuration unit 1010 may include at least one computing device, such as a server, etc. Alternatively, the SQL defense rule configuration unit 1010 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The above-mentioned PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0165] The multiple computing devices included in the SQL defense rule configuration unit 1010 can be distributed in the same region or in different regions. The multiple computing devices included in the SQL defense rule configuration unit 1010 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the SQL defense rule configuration unit 1010 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0166] Therefore, the modules of each example described in the embodiments of the present application can be implemented with electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present application.

[0167] It should be noted that: when the system provided in the above embodiment executes the above method, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the system can be divided into different functional modules to complete all or part of the functions described above.

[0168] In addition, the system and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation processes are detailed in the method embodiments above, which will not be repeated here.

[0169] The method provided in the embodiment of the present application can be performed by a computing device, which can also be referred to as a computer system. It includes a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer. The hardware layer includes hardware such as a processing unit, a memory and a memory control unit, and then the function and structure of the hardware are described in detail. The operating system is any one or more computer operating systems that implement business processing through a process, for example, a Linux operating system, a Unix operating system, an Android operating system, an iOS operating system, or a windows operating system. The application layer includes applications such as a browser, an address book, a word processing software, and an instant messaging software. In addition, optionally, the computer system is a handheld device such as a smart phone, or a terminal device such as a personal computer, and the present application is not particularly limited, as long as the method provided by the embodiment of the present application can be used. The execution subject of the method provided in the embodiment of the present application can be a computing device, or a functional module in a computing device that can call a program and execute a program.

[0170] Combine the following Fig.12 , a computing device provided in an embodiment of the present application is described in detail.

[0171] Fig.12 1 is a schematic diagram of the architecture of a computing device 1500 provided in an embodiment of the present application. The computing device 1500 may be a server or a computer or other device with computing capabilities. Fig.12 The computing device 1500 shown includes at least one processor 1510 and a memory 1520 .

[0172] It should be understood that the present application does not limit the number of processors and memories in the computing device 1500 .

[0173] The processor 1510 executes the instructions in the memory 1520, so that the computing device 1500 implements the method provided by the present application. Alternatively, the processor 1510 executes the instructions in the memory 1520, so that the computing device 1500 implements the functional modules provided by the present application, thereby implementing the method provided by the present application.

[0174] Optionally, the computing device 1500 further includes a communication interface 1530. The communication interface 1530 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 1500 and other devices or a communication network.

[0175] Optionally, the computing device 1500 further includes a system bus 1540, wherein the processor 1510, the memory 1520, and the communication interface 1530 are respectively connected to the system bus 1540. The processor 1510 can access the memory 1520 through the system bus 1540. For example, the processor 1510 can read and write data or execute code in the memory 1520 through the system bus 1540. The system bus 1540 is a peripheral component interconnect express (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus 1540 is divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.12 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0176] In a possible implementation, the function of the processor 1510 is mainly to interpret the instructions (or codes) of the computer program and process the data in the computer software. The instructions of the computer program and the data in the computer software can be stored in the memory 1520 or the cache 1516.

[0177] Optionally, the processor 1510 may be an integrated circuit chip with signal processing capabilities. As an example and not a limitation, the processor 1510 is a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. Among them, the general-purpose processor is a microprocessor, etc. For example, the processor 1510 is a central processing unit (CPU).

[0178] Optionally, each processor 1510 includes at least one processing unit 1512 and a memory control unit 1514 .

[0179] Optionally, the processing unit 1512 is also called a core or kernel, which is the most important component of the processor. The processing unit 1512 is manufactured from single crystal silicon using a certain production process, and all calculations, command reception, command storage, and data processing of the processor are performed by the core. The processing units run program instructions independently and use the ability of parallel computing to speed up the running speed of the program. Various processing units have a fixed logical structure. For example, the processing unit includes logical units such as a first-level cache, a second-level cache, an execution unit, an instruction-level unit, and a bus interface.

[0180] In one implementation example, the memory control unit 1514 is used to control data interaction between the memory 1520 and the processing unit 1512. Specifically, the memory control unit 1514 receives a memory access request from the processing unit 1512, and controls access to the memory based on the memory access request. As an example and not a limitation, the memory control unit is a device such as a memory management unit (MMU).

[0181] In one implementation example, each memory control unit 1514 addresses the memory 1520 through the system bus. And an arbiter ( Fig.12 ), which is responsible for handling and coordinating competing accesses of multiple processing units 1512.

[0182] In an implementation example, the processing unit 1512 and the memory control unit 1514 are connected to each other through connection lines inside the chip, such as address lines, so as to achieve communication between the processing unit 1512 and the memory control unit 1514.

[0183] Optionally, each processor 1510 also includes a cache 1516, wherein the cache is a buffer for data exchange (called cache). When the processing unit 1512 wants to read data, it will first search for the required data from the cache. If it is found, it will be executed directly. If it is not found, it will be searched from the memory. Since the running speed of the cache is much faster than the memory, the role of the cache is to help the processing unit 1512 run faster.

[0184] The memory 1520 can provide a running space for the processes in the computing device 1500. For example, the computer program (specifically, the program code) used to generate the process is stored in the memory 1520. After the computer program is executed by the processor to generate the process, the processor allocates a corresponding storage space for the process in the memory 1520. Furthermore, the above storage space further includes a text segment, an initialized data segment, a bit initialized data segment, a stack segment, a heap segment, etc. The memory 1520 stores the data generated during the running of the process in the storage space corresponding to the above process, such as intermediate data, process data, etc.

[0185] Optionally, the storage is also called memory, and its function is to temporarily store the operation data in the processor 1510 and the data exchanged with the external storage such as the hard disk. As long as the computer is running, the processor 1510 will transfer the data to be calculated to the memory for calculation, and when the calculation is completed, the processing unit 1512 will transmit the result.

[0186] As an example and not limitation, memory 1520 is a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory is a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory is a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchlink DRAM (SLDRAM), and direct rambus RAM (DRRAM). It should be noted that the memory 1520 of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0187] The structure of the computing device 1500 listed above is only an example, and the present application is not limited thereto. The computing device 1500 of the embodiment of the present application includes various hardware in the computer system in the prior art. For example, the computing device 1500 also includes other memories besides the memory 1520, such as disk storage, etc. Those skilled in the art should understand that the computing device 1500 may also include other devices necessary for normal operation. At the same time, according to specific needs, those skilled in the art should understand that the above-mentioned computing device 1500 may also include hardware devices for implementing other additional functions. In addition, those skilled in the art should understand that the above-mentioned computing device 1500 may also include only the devices necessary to implement the embodiment of the present application, and does not necessarily include Fig.12 All devices shown in .

[0188] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device may be a server. In some embodiments, the computing device may also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0189] like Fig.13 As shown, the computing device cluster includes at least one computing device 1500. The memory 1520 in one or more computing devices 1500 in the computing device cluster may store the same instructions for executing the above method.

[0190] In some possible implementations, the memory 1520 in one or more computing devices 1500 in the computing device cluster may also store some instructions for executing the above method. In other words, the combination of one or more computing devices 1500 may jointly execute the instructions of the above method.

[0191] It should be noted that the memory 1520 in different computing devices 1500 in the computing device cluster can store different instructions, which are respectively used to execute part of the functions of the above-mentioned system. That is, the instructions stored in the memory 1520 in different computing devices 1500 can realize the functions of one or more modules in the above-mentioned system.

[0192] In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network. Fig.14 A possible implementation is shown. Fig.14 As shown, two computing devices 1500A and 1500B are connected via a network. Specifically, they are connected to the network via a communication interface in each computing device.

[0193] It should be understood that Fig.14 The functionality of the computing device 1500A shown in FIG. 1 may also be implemented by multiple computing devices 1500. Similarly, the functionality of the computing device 1500B may also be implemented by multiple computing devices 1500.

[0194] In this embodiment, a computer program product including instructions is also provided, and the computer program product may be software or a program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on a computing device, the computing device is caused to execute the method provided above, or the computing device is caused to implement the functions of the system provided above.

[0195] In this embodiment, a computer-readable storage medium is also provided. The computer-readable storage medium may be any available medium that can be stored by a computing device or a data storage device such as a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions. When the instructions in the computer-readable storage medium are executed on a computing device, the computing device executes the method provided above.

[0196] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0197] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0198] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0199] In the several embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0200] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0201] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0202] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0203] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.< / subquery>

Claims

1. A structured query language SQL defense method, characterized in that: The method is applied to a SQL defense system, the SQL defense system includes a SQL defense rule configuration unit and multiple SQL engines, and the method includes: The SQL defense rule configuration unit configures corresponding SQL defense rules for the multiple SQL engines through a unified entry, each of the SQL defense rules includes an effective SQL engine and a corresponding execution action, and the SQL defense rules corresponding to the multiple SQL engines have the same format; The SQL defense rule configuration unit sends the configured SQL defense rules to the corresponding SQL engines according to the SQL engines that are effective in each of the SQL defense rules, so that the SQL engines can defend the received SQL statements according to the obtained SQL defense rules.

2. The method according to claim 1, characterized in that The plurality of SQL engines include a first SQL engine, and the method further includes: The first SQL engine obtains at least one corresponding SQL defense rule from the SQL defense rule configuration unit, wherein the at least one SQL defense rule includes a first SQL defense rule; The first SQL engine receives a first SQL statement from the business layer; The first SQL engine executes the action in the first SQL defense rule according to that the first SQL statement satisfies the first SQL defense rule.

3. The method according to claim 1 or 2, characterized in that: The SQL defense rule configuration unit sends the configured SQL defense rules to the corresponding SQL engines respectively according to the effective SQL engines in each of the SQL defense rules, including: The SQL defense rule configuration unit automatically sends the configured SQL defense rules to the corresponding SQL engines during the loading cycle according to the SQL engines that are effective in each of the SQL defense rules.

4. The method according to any one of claims 1 to 3, characterized in that The SQL defense rules include prompt-type SQL defense rules, intercept-type SQL defense rules, and fuse-type SQL defense rules.

5. The method according to claim 4, characterized in that The first SQL defense rule is the SQL defense rule of the prompt class. The first SQL engine executes the action in the first SQL defense rule including: The first SQL engine continues to execute the first SQL statement.

6. The method according to claim 5, characterized in that The method further comprises: The first SQL engine displays prompt information of the first SQL statement to the user.

7. The method according to claim 4, characterized in that The first SQL defense rule is the interception-type SQL defense rule or the circuit-breaker-type SQL defense rule. The first SQL engine executes the action in the first SQL defense rule including: The first SQL engine stops executing the first SQL statement.

8. The method according to claim 7, characterized in that The method further comprises: The first SQL engine displays to the user the reason why the execution of the first SQL statement is stopped.

9. The method according to any one of claims 1 to 8, characterized in that The SQL defense rule also includes a list of effective tenants and a rule identification ID.

10. A structured query language SQL defense system, characterized in that: The system includes a SQL defense rule configuration unit and multiple SQL engines: The SQL defense rule configuration unit is used to configure corresponding SQL defense rules for the multiple SQL engines through a unified entry, each of the SQL defense rules includes an effective SQL engine and a corresponding execution action, and the SQL defense rules corresponding to the multiple SQL engines have the same format; The SQL defense rule configuration unit is also used to send the configured SQL defense rules to the corresponding SQL engines according to the SQL engines that are effective in each of the SQL defense rules, so that the SQL engines can defend the received SQL statements according to the obtained SQL defense rules.

11. The system according to claim 10, characterized in that The plurality of SQL engines include a first SQL engine, The first SQL engine is used to obtain at least one corresponding SQL defense rule from the SQL defense rule configuration unit, wherein the at least one SQL defense rule includes a first SQL defense rule; The first SQL engine is further configured to receive a first SQL statement from the business layer; The first SQL engine is also used to execute the action in the first SQL defense rule according to that the first SQL statement satisfies the first SQL defense rule.

12. The system according to claim 10 or 11, characterized in that The SQL defense rule configuration unit is specifically used for: According to the SQL engines that are effective in each of the SQL defense rules, the configured SQL defense rules are automatically sent to the corresponding SQL engines during the loading cycle.

13. The system according to any one of claims 10 to 12, characterized in that The SQL defense rules include prompt-type SQL defense rules, intercept-type SQL defense rules, and fuse-type SQL defense rules.

14. The system according to claim 13, characterized in that The first SQL defense rule is the SQL defense rule of the prompt class. The first SQL engine is specifically used to: continue to execute the first SQL statement.

15. The system according to claim 14, characterized in that The first SQL engine is also used to display prompt information of the first SQL statement to the user.

16. The system according to claim 13, characterized in that The first SQL defense rule is the interception-type SQL defense rule or the circuit-breaker-type SQL defense rule. The first SQL engine is specifically used to: stop executing the first SQL statement.

17. The system according to claim 16, characterized in that The first SQL engine is also used to display to the user the reason why the execution of the first SQL statement is stopped.

18. The system according to any one of claims 10 to 17, characterized in that The SQL defense rule also includes a list of effective tenants and a rule identification ID.

19. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 9.

20. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster is caused to perform the method according to any one of claims 1 to 9.

21. A computer-readable storage medium, characterized in that: The method comprises computer program instructions, and when the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method according to any one of claims 1 to 9.

Images