Implementation method and system of application level data security access proxy engine based on SQL analysis and access control strategy

Abstract

The invention relates to the technical field of access control strategy management, in particular to an implementation method and system for an application level data security access proxy engine based on SQL analysis and an access control strategy, and the method comprises the following steps: receiving an SQL query statement input by a user; parsing the SQL query statement into an AST (abstract syntax tree) by using an SQL parser; according to a preset access control strategy, an AST node is traversed through a permission executor, and whether SQL query meets the access control requirement or not is checked; the method and the system for realizing the application level data security access proxy engine based on the SQL analysis and the access control strategy, which are provided by the invention, have the beneficial effects that the security access of the data is realized at the application level without depending on the security control capability of the database level; and in combination with an access control strategy, only authorized users or systems can access specific resources, and unauthorized access is intercepted at the same time, so that the confidentiality, integrity and availability of data are protected.

Description

Technical Field

[0001] The present invention relates to the technical field of access control policy management, and in particular to a method and system for implementing an application-level data security access proxy engine based on SQL parsing and access control policy. Background Art

[0002] Usually, the database has its own data control management module, which manages which data users can access and which operations they can perform through account management and permission allocation. However, in actual business, the database-level data security management module usually encounters the following problems:

[0003] (1) The database security control module usually requires a professional database administrator (DBA) to maintain it, and business personnel do not have professional database knowledge and experience.

[0004] (2) The security control modules of different databases vary greatly. Some non-relational databases, such as HBase, do not have their own data security control modules and need to rely on external components to implement them.

[0005] Usually, the functions of database security control modules are relatively weak, generally only supporting role-based access control (RBAC) but not attribute-based access control (ABAC), which cannot meet the needs of complex control scenarios; in order to solve the differences in database security control and enhance the ability of database security access, it is very difficult to start from the database level. On the one hand, strengthening security control capabilities from the database level is very costly to implement, and you need to be very familiar with the database code before you can modify the code; on the other hand, there are many types of databases on the market, and the adaptation work is extremely heavy. Summary of the invention

[0006] The purpose of the present invention is to provide a method and system for implementing an application-level data security access proxy engine based on SQL parsing and access control strategy to solve the problems raised in the above-mentioned background technology.

[0007] To achieve the above object, the present invention provides the following technical solution: a method for implementing an application-level data security access proxy engine based on SQL parsing and access control strategy, the method comprising the following steps:

[0008] Step A: Receive SQL query statements input by users;

[0009] Step B: Use the SQL parser to parse the SQL query statement into an abstract syntax tree AST;

[0010] Step C: According to the preset access control policy, the permission executor traverses the AST nodes to check whether the SQL query meets the access control requirements;

[0011] Step D: If a violation node is found, modify the AST or throw a permission exception according to the policy; if it complies with the policy, continue;

[0012] Step E: Use the SQL deparser to convert the modified AST back into an SQL query statement, pass it to the database for execution, and return the query result to the user.

[0013] Preferably, step B further comprises:

[0014] Verify the syntax correctness of SQL query statements;

[0015] If the syntax is correct, generate the corresponding abstract syntax tree AST.

[0016] Preferably, the access control policy in step C is based on RBAC or ABAC principles, and the specific steps include:

[0017] Match user roles with predefined permission sets;

[0018] Check whether the operation type of the SQL query is within the allowed range;

[0019] Verify that the queried resources and fields comply with resource restrictions and field restrictions.

[0020] Preferably, the violation handling in step D includes:

[0021] When a field that does not comply with the policy is found, the corresponding column node is removed from the AST or the query condition is modified;

[0022] If the entire query cannot be executed due to insufficient permissions, a permission exception containing error information is thrown;

[0023] For internal resource restriction rules, additional AST fragments are generated and assembled onto the original AST to form an expanded AST containing all necessary restriction conditions.

[0024] Preferably, the method further comprises the following steps:

[0025] Record all intercepted and successfully executed SQL query requests in the audit log;

[0026] Feedback access control results to users, including error prompts for insufficient permissions or notifications of successful queries;

[0027] Optimize the process of SQL parsing, permission checking, and SQL reverse parsing to improve overall processing efficiency and system response speed.

[0028] A system for implementing an application-level data security access proxy engine based on SQL parsing and access control strategy, the system comprising:

[0029] SQL parsing module, used to receive SQL query statements input by users and parse them into abstract syntax trees (AST);

[0030] The access control policy module contains preset access control policies, which are used to define user access rights to resources based on RBAC or ABAC principles;

[0031] The permission executor, based on the parsed AST and the rules in the access control policy module, traverses the AST nodes, checks whether the SQL statement requested by the user complies with the access control policy, and intercepts it if a violation is found;

[0032] SQL deparser, which converts the AST processed and possibly modified by the permission enforcer back into a SQL query statement that contains all necessary access control conditions;

[0033] The database interface passes the de-parsed SQL query statement to the database for execution and returns the query result to the user.

[0034] Preferably, the SQL parsing module further includes:

[0035] Syntax analyzer, used to verify the syntactic correctness of SQL statements;

[0036] AST generator, which converts syntactically correct SQL statements into an abstract syntax tree.

[0037] Preferably, the access control policy module also includes:

[0038] The rule definition interface allows administrators to define and update access control policies, including object attributes, resource attributes, operation types, and environment attributes;

[0039] Rule interpreter, used to parse and verify access control policies to ensure the consistency and effectiveness of policies.

[0040] Preferably, the permission executor further includes:

[0041] Node traverser, used to traverse each node of the AST, matching and checking according to the node type and the rules in the access control policy;

[0042] The rule applicator is used to modify the AST according to the policy rules, add necessary access control conditions, or directly throw a permission exception when a violation node is detected;

[0043] The extended AST generator is used to convert internal resource restriction rules into AST fragments and assemble them onto the original AST to form an extended AST.

[0044] Preferably, the system further comprises:

[0045] Audit log module, used to record all intercepted SQL query requests and successfully executed SQL query requests for subsequent auditing and monitoring;

[0046] Feedback mechanism, used to provide users with feedback on access control results, including error messages about insufficient permissions or notifications of successful query execution;

[0047] The performance optimization module is used to optimize the SQL parsing, permission checking and SQL reverse parsing processes to improve the overall processing speed and system responsiveness.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] The implementation method and system of the application-level data security access proxy engine based on SQL parsing and access control strategy proposed in the present invention do not rely on the security control capabilities of the database level, realize secure access to data at the application level, and combined with the access control strategy, can ensure that only authorized users or systems can access specific resources, while blocking unauthorized access, thereby protecting the confidentiality, integrity and availability of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 Design an architecture diagram for the data security access proxy engine of the present invention;

[0051] Figure 2 Schematic diagram of SQL parsing into an abstract syntax tree in the present invention;

[0052] Figure 3 This is a schematic diagram of a DSL sample of the access strategy of the present invention;

[0053] Figure 4 A schematic diagram of the SQL abstract syntax tree extended by the present invention;

[0054] Figure 5 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose and technical solution of the present invention clearly and completely described, and the advantages more clearly understood, the embodiments of the present invention are further described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present invention, rather than all of the embodiments, and are only used to explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] For example, see Figures 1 to 5The present invention provides a technical solution comprising the following steps:

[0057] 1. SQL parsing

[0058] If we want to get the information we want from SQL, we must parse SQL. Through the SQL parsing tool JSqlParser, we can convert a SQL statement into an abstract syntax tree and get the information we need from it. For example, if a user wants to query the name (name), age (age), gender (sex), mobile phone number (phone), home address (address) and ID card (id_card) in a personnel registration form (tb_register), the query SQL statement may be as follows:

[0059] select name,age,sex,phone,address,id_card from tb_register;

[0060] The SQL parser will parse the above SQL statement and generate the following Figure 2 AST syntax tree. The abstract syntax tree is a tree structure. If we continue to observe this tree structure, we will get the following conclusions.

[0061] (1) No matter how complex the SQL statement entered by the user is, as long as the syntax is correct, it can always be parsed to generate such an abstract syntax tree with limited nodes.

[0062] (2) An abstract syntax tree always has a root node as the entry point. After a SQL statement is parsed, it always has the statements node as the root node.

[0063] (3) Each node in the abstract syntax tree represents a structural unit in SQL. For example, field information such as name, age, sex, phone, address, and id_card will all be parsed into column nodes.

[0064] The above conclusions provide a theoretical basis for implementing secure SQL data access, especially conclusion (3), which can greatly simplify the complexity of the code. For example, the ID card number in the user registration information is sensitive information and users are not allowed to query it. In this case, we only need to monitor the column node. If the column node has the id_card value, a permission exception is thrown. We will describe the security control implementation in detail in conjunction with the access control strategy later.

[0065] 2. Access control policy analysis

[0066] Access control policies are divided into two types: RBAC and ABAC.

[0067] RBAC access rights are granted based on the roles to which users belong. Roles are predefined and associated with specific sets of permissions. Users are assigned to one or more roles to gain access rights.

[0068] ABAC access rights are determined based on a combination of a series of attributes, which may involve objects, resources, operations, environments, and other aspects.

[0069] (1) Object: The object is the user who is currently requesting access to resources. The user's attributes include ID, personal resources, role, department, and organization membership, etc.

[0070] (2) Resource: The data resource that the current object wants to access, including tables, views, etc. Resources can be restricted. For example, in a SASS system, a tenant can only view the data under the tenant.

[0071] (3) Operation: The operation that the user attempts to perform on the resource. Common operations in SQL statements include SELECT, INSERT, UPDATE, DELETE, CREATE TABLE, CREATE VIEW, DROP, etc.

[0072] (4) Environment: The environment is the context of each access request. The environment attributes include the time and location of the access attempt, the device of the object, the communication protocol, and the encryption strength.

[0073] ABAC access policies are typically defined using a domain-specific language (DSL) that allows policy rules to be written in a structured and easy-to-understand manner. Figure 3 This is a simplified ABAC policy DSL example that illustrates how to define a policy rule:

[0074] like Figure 3 The following is a sample policy about administrators accessing users under 35 years old. This policy includes restrictions on objects, resources, operations, environments, and other attributes. The DSL format of the access policy is easy for business users to read and use. For the SQL permission executor, it will summarize this into the following restriction rules:

[0075] (1) Object restriction rules only allow administrators to access.

[0076] (2) Resource restriction rules only allow access to the tb_register table.

[0077] (3) Resource restriction rule: only user data with tenan_id = 'A001' and age < 35 is allowed to be accessed.

[0078] (4) Resource restriction rules only allow access to fields such as name, age, sex, phone, and address.

[0079] (5) Operation restriction rules: only SELECT operations are allowed.

[0080] (6) Environmental restriction rules: access is only allowed between 2024-03-05 00:00 and 2024-03-20 24:00.

[0081] If effect is equal to allow, it means that access is allowed when the above restrictions are met; if effect is equal to deny, it means that access is allowed when the above restrictions are not met.

[0082] 3. Access security control implementation

[0083] Among the above restriction rules, only resource restrictions (2), (3), (4) and operation restrictions (5) are related to the database. In the introduction of this invention, we only consider this part.

[0084] Because the AST syntax tree of all SQL statements uses the statements node as the entry, the SQL permission executor starts from here and performs a security scan of the node. The specific process is as follows:

[0085] (1) The select_stmt node indicates that this is a select query operation. Here, we check whether the operation restriction rules are met (5).

[0086] (2) The clauses node is a connection node and has no meaning in security checking and can be skipped.

[0087] (3) The select_clause node indicates that the query content is to be filtered, which is very important for determining whether the field is a query content field, a query condition field, or an order-by field.

[0088] (4) The column node contains all the information about the field, which may be the query content field, the query condition field, or the order-by field, etc. Since it is a child node of select_clause, it is the query content field, so it is possible to check whether the restriction rule (4) is satisfied here.

[0089] (5)The from_clause node is also a connection node and can be skipped.

[0090] (6) The table node indicates the table that the user wants to query. Here you can check whether the restriction rule (2) is met.

[0091] The SQL permission executor performs a secure traversal of the AST syntax tree of the SQL statement. If any node does not meet the corresponding restriction rules, it will be considered that the user is trying to access beyond the authority and perform a security interception. Even if the SQL permission executor successfully traverses all the AST syntax tree nodes, it cannot directly access the database. This only shows that the SQL of the user's access to resources is safe, but it does not mean that the user can obtain the desired data. Because there may be some internal resource restriction rules that impose conditional restrictions on the accessed data, such as the restriction rule (3) above. Restriction rule (3) is not involved when traversing the AST syntax tree for security checks, because it is an internal restriction and will not be reflected in the AST syntax tree formed by the user's SQL.

[0092] So how to make the internal resource restriction rules effective? The SQL permission executor converts these restriction policies into AST syntax tree fragments, and assembles these AST syntax tree fragments into the AST syntax tree originally generated by the user SQL to form an extended AST syntax tree.

[0093] For example, the restriction rule (3) above will generate Figure 4 The AST syntax tree fragment within the dotted line in , and assemble it into the original AST syntax tree to form an extended AST syntax tree.

[0094] The extended SQL abstract syntax tree will be deparsed by the SQL deparser to generate restricted SQL. For example, Figure 4 The SQL abstract syntax tree expanded in the above code is reversed to generate the following LimitedSQL:

[0095] select name,age,sex,phone,address from tb_register where tenant_id='A001'and age<35;

[0096] This SQL query is for the name, age, sex, phone, and address fields in the t_register table, but does not include the sensitive field id_card. In addition, based on the user SQL, internal resource restrictions are added: tenant_id = 'A001' and age < 35.

[0097] The SQL deparser will pass LimitedSQL to the database for execution, and the returned safe data will be returned directly to the user.

[0098] Embodiment 2, based on embodiment 1, proposes a system for implementing an application-level data security access proxy engine based on SQL parsing and access control strategy, the system comprising:

[0099] The SQL parsing module is used to receive the SQL query statement input by the user and parse it into an abstract syntax tree AST; further comprising:

[0100] Syntax analyzer, used to verify the syntactic correctness of SQL statements;

[0101] AST generator, which converts syntactically correct SQL statements into an abstract syntax tree.

[0102] The access control policy module contains preset access control policies that define user access rights to resources based on RBAC or ABAC principles; it also includes:

[0103] The rule definition interface allows administrators to define and update access control policies, including object attributes, resource attributes, operation types, and environment attributes;

[0104] Rule interpreter, used to parse and verify access control policies to ensure the consistency and effectiveness of policies.

[0105] The permission executor, based on the parsed AST and the rules in the access control policy module, traverses the AST nodes, checks whether the SQL statement requested by the user complies with the access control policy, and intercepts it when a violation is found; it also includes:

[0106] Node traverser, used to traverse each node of the AST, matching and checking according to the node type and the rules in the access control policy;

[0107] The rule applicator is used to modify the AST according to the policy rules, add necessary access control conditions, or directly throw a permission exception when a violation node is detected;

[0108] The extended AST generator is used to convert internal resource restriction rules into AST fragments and assemble them onto the original AST to form an extended AST.

[0109] SQL deparser, which converts the AST processed and possibly modified by the permission enforcer back into a SQL query statement that contains all necessary access control conditions;

[0110] The database interface passes the de-parsed SQL query statement to the database for execution and returns the query result to the user.

[0111] The system also includes:

[0112] Audit log module, used to record all intercepted SQL query requests and successfully executed SQL query requests for subsequent auditing and monitoring;

[0113] Feedback mechanism, used to provide users with feedback on access control results, including error messages about insufficient permissions or notifications of successful query execution;

[0114] The performance optimization module is used to optimize the SQL parsing, permission checking and SQL reverse parsing processes to improve the overall processing speed and system responsiveness.

[0115] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for implementing an application-level data security access proxy engine based on SQL parsing and access control strategy, characterized in that: The method comprises the following steps: Step A: Receive SQL query statements input by users; Step B: Use the SQL parser to parse the SQL query statement into an abstract syntax tree AST; Step C: According to the preset access control policy, the permission executor traverses the AST nodes to check whether the SQL query meets the access control requirements; Step D: If a violation node is found, modify the AST or throw a permission exception according to the policy; if it complies with the policy, continue; Step E: Use the SQL deparser to convert the modified AST back into an SQL query statement, pass it to the database for execution, and return the query result to the user.

2. According to claim 1, a method for implementing an application-level data security access proxy engine based on SQL parsing and access control strategy, characterized in that: Step B further comprises: Verify the syntax correctness of SQL query statements; If the syntax is correct, generate the corresponding abstract syntax tree AST.

3. The method for implementing an application-level data security access proxy engine based on SQL parsing and access control strategy according to claim 1 is characterized in that: The access control policy in step C is based on the RBAC or ABAC principle. The specific steps include: Match user roles with predefined permission sets; Check whether the operation type of the SQL query is within the allowed range; Verify that the queried resources and fields comply with resource restrictions and field restrictions.

4. The method for implementing an application-level data security access proxy engine based on SQL parsing and access control strategy according to claim 1 is characterized in that: Violation handling in step D includes: When a field that does not comply with the policy is found, the corresponding column node is removed from the AST or the query condition is modified; If the entire query cannot be executed due to insufficient permissions, a permission exception containing error information is thrown; For internal resource restriction rules, additional AST fragments are generated and assembled onto the original AST to form an expanded AST containing all necessary restriction conditions.

5. The method for implementing an application-level data security access proxy engine based on SQL parsing and access control strategy according to claim 1 is characterized in that: The following steps are also included: Record all intercepted and successfully executed SQL query requests in the audit log; Feedback access control results to users, including error prompts for insufficient permissions or notifications of successful queries; Optimize the process of SQL parsing, permission checking, and SQL reverse parsing to improve overall processing efficiency and system response speed.

6. A method for implementing an application-level data security access proxy engine based on SQL parsing and access control policy according to any one of claims 1 to 5, and a system for implementing an application-level data security access proxy engine based on SQL parsing and access control policy, characterized in that: The system comprises: SQL parsing module, used to receive SQL query statements input by users and parse them into abstract syntax trees (AST); The access control policy module contains preset access control policies, which are used to define user access rights to resources based on RBAC or ABAC principles; The permission executor, based on the parsed AST and the rules in the access control policy module, traverses the AST nodes, checks whether the SQL statement requested by the user complies with the access control policy, and intercepts it if a violation is found; SQL deparser, which converts the AST processed and possibly modified by the permission enforcer back into a SQL query statement that contains all necessary access control conditions; The database interface passes the de-parsed SQL query statement to the database for execution and returns the query result to the user.

7. The implementation system of the application-level data security access proxy engine based on SQL parsing and access control strategy according to claim 6 is characterized by: The SQL parsing module further includes: Syntax analyzer, used to verify the syntactic correctness of SQL statements; AST generator, which converts syntactically correct SQL statements into an abstract syntax tree.

8. The implementation system of the application-level data security access proxy engine based on SQL parsing and access control strategy according to claim 6 is characterized by: The access control policy module also includes: The rule definition interface allows administrators to define and update access control policies, including object attributes, resource attributes, operation types, and environment attributes; Rule interpreter, used to parse and verify access control policies to ensure the consistency and effectiveness of policies.

9. The implementation system of the application-level data security access proxy engine based on SQL parsing and access control strategy according to claim 6 is characterized by: The permission enforcer also includes: Node traverser, used to traverse each node of the AST, matching and checking according to the node type and the rules in the access control policy; The rule applicator is used to modify the AST according to the policy rules, add necessary access control conditions, or directly throw a permission exception when a violation node is detected; The extended AST generator is used to convert internal resource restriction rules into AST fragments and assemble them onto the original AST to form an extended AST.

10. The implementation system of the application-level data security access proxy engine based on SQL parsing and access control strategy according to claim 6 is characterized by: The system also includes: Audit log module, used to record all intercepted SQL query requests and successfully executed SQL query requests for subsequent auditing and monitoring; Feedback mechanism, used to provide users with feedback on access control results, including error messages about insufficient permissions or notifications of successful query execution; The performance optimization module is used to optimize the SQL parsing, permission checking and SQL reverse parsing processes to improve the overall processing speed and system responsiveness.

Images