Cloud scene message processing method, cloud scene database auditing method and gateway

Abstract

The invention relates to a cloud scene message processing method, a cloud scene database auditing method and a gateway, and particularly relates to the technical field of human-computer interaction. The cloud scene message processing method is applied to a gateway and comprises the following steps: acquiring a public and private address translation relation table according to a network address translation table; acquiring a communication message, and storing the public and private address conversion relation table to an extension field of the communication message; the communication message is a message used for operating a target database; and sending the communication message of which the extension field comprises the public and private address conversion relation table to a private network cloud server, so that the private network cloud server analyzes to obtain the public network address of the communication message. According to the method, the gateway side adds the public and private address conversion relation table in the extension field of the communication message, so that a private network cloud server can analyze and obtain the public network address when database auditing is carried out in a cloud scene, and accurate identification of a database auditing object can be realized due to uniqueness of the public network address; and the error alarm rate of database auditing can also be reduced.

Description

Technical Field

[0001] The present application relates to the field of database audit technology, and in particular to a cloud scenario message processing method and a cloud scenario database audit method and gateway, and also to a private network cloud server for implementing the cloud scenario message processing method, a database audit server for implementing the cloud scenario database audit method, and a computer-readable storage medium. Background Art

[0002] Database audit is deployed in a bypass mode, and the audit engine is installed on the database server. When the audit engine is started, it monitors and captures the messages of the monitoring network card in real time. The audit engine parses the captured messages, obtains the five-tuple information of the message, parses the database address, port and other information, and determines the database object to be audited.

[0003] In actual cloud scenarios, the database audit object may be a database deployed from different cloud servers (Elastic Compute Service, ECS). Since cloud servers come from different clouds, the assigned private network addresses may be the same; when the user's traffic message for accessing the database arrives at the internal network from the external network, after Network Address Translation (NAT), it arrives at the network card of the cloud server where the database is located. The destination address of the message will only carry the private network address; in this case, the audit engine captures the message and parses the five-tuple information of the message. There are the following defects and deficiencies: (1) The private network address, database type, and audit port are the same. When the audit engine parses the message and obtains the five-tuple information, the destination address and destination port in the information are the same. After the audit engine parses, the audit log reported is the same database, resulting in the inability to accurately identify the audit object. (2) The audit object identification error leads to the matching error of the built-in audit alarm rule, resulting in an erroneous audit alarm, and the inability to clearly identify the database object with high-risk operation risks. Summary of the invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, the present application provides a cloud scenario message processing method and a cloud scenario database audit method and gateway, which can help the audit engine accurately identify database audit objects.

[0005] In order to achieve the above purpose, the technical solutions provided by the embodiments of the present application are as follows:

[0006] In a first aspect, the present application provides a cloud scenario message processing method, which is applied to a gateway, and the method includes: obtaining a public-private address conversion relationship table according to a network address conversion table; obtaining a communication message, and storing the public-private address conversion relationship table in an extended field of the communication message; the communication message is a message used to operate a target database; and sending the communication message whose extended field includes the public-private address conversion relationship table to a private network cloud server, so that the private network cloud server parses and obtains the public network address of the communication message.

[0007] As an optional implementation method of an embodiment of the present application, a communication message is obtained, and a public-private address conversion relationship table is stored in an extended field of the communication message, including: capturing traffic messages; judging whether the traffic messages are communication messages based on the protocol version number of the traffic messages; if so, storing the public-private address conversion relationship table in the extended field of the communication message.

[0008] In the second aspect, the present application provides a cloud scenario message processing method, which is applied to a private network cloud server, and the method includes: obtaining a communication message sent by a gateway, the extended field of the communication message including a public-private address conversion relationship table; converting a public network address according to the public-private address conversion relationship table and the private network address carried by the communication message; reporting the public network address and the private network address to a database audit server, so that the database audit server identifies and determines the target database as an audit object.

[0009] As an optional implementation method of the embodiment of the present application, a communication message sent by the gateway is obtained, and the extended field of the communication message includes a public-private address conversion relationship table, including: obtaining the traffic message sent by the gateway; judging whether the traffic message is a communication message according to the protocol version number of the traffic message; if so, parsing the communication message through the audit engine to obtain the public-private address conversion relationship table.

[0010] On the third aspect, the present application provides a cloud scenario database audit method, which is applied to the database audit server. The method includes: obtaining the public network address and private network address reported by the private network cloud server; analyzing the public network address and private network address, and identifying and determining that the target database corresponding to the public network address is the audit object.

[0011] As an optional implementation of the embodiment of the present application, the method also includes: adding a display field in the audit log to display the public network address and the private network address.

[0012] In a fourth aspect, the present application provides a gateway, the gateway comprising:

[0013] An acquisition module, used for acquiring a public-private address conversion relationship table according to a network address conversion table;

[0014] The processing module is used to obtain the communication message and store the public-private address conversion relationship table in the extended field of the communication message; the communication message is a message used to operate the target database;

[0015] The sending module is used to send the communication message whose extended field includes the public-private address conversion relationship table to the private network cloud server, so that the private network cloud server can parse and obtain the public network address of the communication message.

[0016] In a fifth aspect, the present application provides a private network cloud server, which implements the cloud scenario message processing method described in the second aspect or any optional implementation manner thereof.

[0017] In a sixth aspect, the present application provides a database audit server, which implements the cloud scenario database audit method described in the third aspect or any optional implementation manner thereof.

[0018] In the seventh aspect, the present application provides a computer-readable storage medium, comprising: a computer program is stored on the computer-readable storage medium, and when the computer program is executed by the processor, it implements the cloud scenario message processing method as described in the first aspect or any one of its optional embodiments, or implements the cloud scenario message processing method as described in the second aspect or any one of its optional embodiments, or implements the cloud scenario database audit method as described in the third aspect or any one of its optional embodiments.

[0019] In the eighth aspect, the present application provides a computer program product, including: the computer program product includes a computer program, when the computer program runs on a computer, enables the computer to implement the cloud scenario message processing method as described in the first aspect or any one of its optional embodiments, or implement the cloud scenario message processing method as described in the second aspect or any one of its optional embodiments, or implement the cloud scenario database audit method as described in the third aspect or any one of its optional embodiments.

[0020] Compared with the prior art, the technical solution provided by the embodiments of the present application has the following advantages:

[0021] The embodiment of the present application provides a cloud scenario message processing method and a cloud scenario database audit method and gateway, wherein the cloud scenario message processing method first obtains a public-private address conversion relationship table according to a network address conversion table, then obtains a communication message used to operate a target database, stores the public-private address conversion relationship table in an extended field of the communication message, and then sends the communication message to a private network cloud server, so that the private network cloud server can resolve the public network address of the communication message. In this way, the present application adds a public-private address conversion relationship table to the extended field of the communication message by the gateway side, so that the private network cloud server can resolve the public network address when performing a database audit in a cloud scenario. Due to the uniqueness of the public network address, the database audit object can be accurately identified, and the error alarm rate of the database audit can also be reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0023] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0024] Figure 1 A schematic diagram of a cloud scenario message processing method provided in an embodiment of the present application Figure 1 ;

[0025] Figure 2 A schematic diagram of a cloud scenario message processing method provided in an embodiment of the present application Figure 2 ;

[0026] Figure 3 A flowchart of a cloud scenario database audit method provided in an embodiment of the present application;

[0027] Figure 4 A schematic diagram of the structure of a gateway provided in an embodiment of the present application;

[0028] Figure 5 A schematic diagram of the structure of an electronic device described in an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the technical terms required to be used in the embodiments or the prior art description are briefly introduced below:

[0030] NAT translation table is a data structure used by NAT devices (such as routers) to record and manage network address translation information. When a host in an internal network (usually a private network) communicates with an external network (such as the Internet), the NAT device will translate the IP address and port number according to the rules in the translation table to achieve communication between the internal network and the external network. The NAT translation table includes: Inside Local Address and Port Number, Inside Global Address and Port Number, Outside Local Address and Port Number, Outside Local Address and Port Number.

[0031] When an internal network host (internal local address) initiates an external connection, the NAT device will create a new entry in the NAT translation table for this connection. It will assign an internal global address and port number, and record the corresponding relationship with the internal local address and port number. For example, the internal host 192.168.1.20 uses port 1025 to access an external website. The NAT device translates it into the internal global address 202.100.100.10:6000 and records this mapping relationship in the translation table.

[0032] In order to solve some or all of the technical problems existing in the above-mentioned related technologies, the embodiments of the present application provide a cloud scenario message processing method and a cloud scenario database auditing method and gateway, wherein the cloud scenario message processing first obtains the public-private address conversion relationship table according to the network address conversion table, and then obtains the communication message used to operate the target database, and stores the public-private address conversion relationship table in the extended field of the communication message, and then sends the communication message to the private network cloud server, so that the private network cloud server can resolve the public network address of the communication message. In this way, the present application adds the public-private address conversion relationship table in the extended field of the communication message by the gateway side, so that the private network cloud server can resolve the public network address when performing a database audit in the cloud scenario. Due to the uniqueness of the public network address, the database audit object can be accurately identified, and the error alarm rate of the database audit can also be reduced.

[0033] In order to more clearly understand the above-mentioned purposes, features and advantages of the present application, the scheme of the present application will be further described below. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0034] In the following description, many specific details are set forth to facilitate a full understanding of the present application, but the present application may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only part of the embodiments of the present application, rather than all of the embodiments.

[0035] A cloud scenario message processing method provided in the embodiments of the present application can be implemented by a gateway or an electronic device, and the electronic device includes but is not limited to a vehicle terminal, a server, a personal computer, a laptop computer, a tablet computer, a smart phone, etc. The operating system of the electronic device may include Android, a mobile operating system (iOS) developed by Apple, an operating system (Windows) developed by Microsoft Corporation of the United States, etc., and the embodiments of the present application are not limited to this. The electronic device can be operated alone to implement the present application, or it can be connected to the network and implement the present application through interactive operations with other computer devices in the network. Among them, the network in which the electronic device is located includes but is not limited to the Internet, a wide area network, a metropolitan area network, a local area network, a virtual private network (VPN) network, etc.

[0036] It should be noted that the protection scope of the cloud scenario message processing method and cloud scenario database auditing method described in the embodiments of the present application is not limited to the execution order of the steps listed in the embodiments. All solutions implemented by adding, reducing or replacing steps in the prior art based on the principles of the present application are included in the protection scope of the present application.

[0037] like Figure 1 As shown, Figure 1 A schematic diagram of a cloud scenario message processing method according to an embodiment of the present application Figure 1 , this method can be executed by the gateway. Figure 1 As shown, the method mainly includes the following steps S101 to S103:

[0038] S101. Obtain a public-private address translation relationship table according to a network address translation table.

[0039] The public-private address conversion relationship table indicates the conversion relationship between the public network address and the private network address. The network address conversion table includes the public-private address conversion relationship table, and the gateway extracts the public-private address conversion relationship table from the network address conversion relationship table.

[0040] S102: Acquire a communication message, and store the public-private address conversion relationship table in an extension field of the communication message.

[0041] Among them, the communication message is a message used to operate the target database, such as query message, update message, insert message and delete message. Query message is used to obtain data from the target database, update message is used to modify the existing data in the target database, insert message is used to add new data records to the target database, and delete message is used to delete data records from the target database.

[0042] The extended field of the communication message is an additional part added to the basic message format, which is used to carry more specific information. In this application, the extended field of the communication message is used to carry the public-private address conversion relationship table, so that the private network cloud server can analyze and process the communication message according to the public-private address conversion relationship table, which helps the audit engine deployed on the private network cloud server to accurately identify the audit object.

[0043] In some embodiments, the format of the extension field of the communication message can be variable length to flexibly carry the public-private address conversion relationship table. The public-private address conversion relationship table can be encoded and written into the extension field of the communication message by binary encoding, text encoding, etc.

[0044] The above embodiment adds a public-private address conversion relationship table in the extended field of the communication message, thereby achieving the function of accurately identifying the database audit object while maintaining compatibility with the original protocol version.

[0045] In some embodiments, encryption algorithm parameters, keys, etc. may also be added to the extended field of the communication message to ensure the confidentiality and integrity of the public-private address conversion relationship table.

[0046] In some embodiments, when executing step S102, the gateway captures the traffic message, and then determines whether the traffic message is a communication message based on the protocol version number of the traffic message, and if so, stores the public-private address translation relationship table in the extended field of the communication message. The protocol version number of the communication message includes but is not limited to the SQL-based protocol version number and the proprietary protocol version number.

[0047] Specifically, the gateway device in this application captures traffic messages, which include but are not limited to communication messages used to operate the target database. This application focuses on these communication messages. After filtering out the communication messages from the traffic messages according to the protocol version number, the extended fields of these communication messages are filled, and the public-private address conversion relationship table is added to the extended field.

[0048] The above-mentioned embodiment filters the captured traffic messages by the protocol version number, thereby filling the extended fields of the communication messages in a targeted manner, avoiding unnecessary operations and reducing resource consumption.

[0049] S103: Send the communication message including the public-private address conversion relationship table in the extended field to the private network cloud server, so that the private network cloud server can parse and obtain the public network address of the communication message.

[0050] After executing step S102 (adding the public-private address conversion relationship table to the extended field of the communication message), since the communication message carries a private network address, the communication message is sent to the private network cloud server corresponding to the private network address according to the private network address, so that the public network address of the communication message can be analyzed by the private network cloud server.

[0051] In summary, the embodiment of the present application provides a cloud scenario message processing method, which is applied to the gateway. First, the public-private address conversion relationship table is obtained according to the network address conversion table, and then the communication message used to operate the target database is obtained, and the public-private address conversion relationship table is stored in the extended field of the communication message, and then the communication message is sent to the private network cloud server, so that the private network cloud server can resolve the public network address of the communication message. In this way, the present application adds the public-private address conversion relationship table to the extended field of the communication message by the gateway side, so that the private network cloud server can resolve the public network address when performing database audit in the cloud scenario. Due to the uniqueness of the public network address, the database audit object can be accurately identified, and the error alarm rate of the database audit can also be reduced.

[0052] like Figure 2 As shown, Figure 2 A schematic diagram of a cloud scenario message processing method provided in an embodiment of the present application Figure 2 , applied to a private network cloud server, the method comprises the following steps S201 to S203:

[0053] S201. Obtain a communication message sent by a gateway.

[0054] The communication message is used to operate the target database, and the extended field of the communication message includes a public-private address conversion relationship table. When the private network cloud server receives the communication message sent by the gateway for operating the target database, the communication message is processed by the gateway, and the audit engine parses the communication message to obtain the public-private address conversion relationship table included in its extended field.

[0055] In some embodiments, the private network cloud server receives the traffic message sent by the gateway, and then determines whether the traffic message is a communication message based on the protocol version number of the traffic message. If so, the communication message is parsed by the audit engine to obtain a public-private address conversion relationship table.

[0056] S202: Convert the public network address to a public network address according to the public-private address conversion relationship table and the private network address carried in the communication message.

[0057] The private network cloud server converts the private network address carried in the communication message according to the private network address and the public-private address conversion relationship table obtained by parsing to obtain the corresponding public network address.

[0058] S203: Report the public network address and the private network address to the database audit server, so that the database audit server can identify the target database as the audit object based on the public network address.

[0059] The audit engine reports the public network address and private network address to the database audit server, so that the database audit server can accurately identify the corresponding target database based on the unique public network address and take the target database as the audit object.

[0060] In the above embodiment, the private network cloud server obtains the processed communication message sent by the gateway side. The extended field of the communication message includes a public-private address conversion relationship table. The private network cloud server converts the public network address based on the public-private address conversion relationship table and the private network address carried by the communication message, and then reports the public network address and the private network address to the database audit server so that the database audit server can accurately determine the target database as the audit object according to the public network address to conduct database audit. In this way, the database audit in the cloud scenario can accurately identify the audit object, avoid misidentification and reduce the false alarm rate.

[0061] like Figure 3 As shown, Figure 3 A flowchart of a cloud scenario database audit method provided in an embodiment of the present application is applied to a database audit server. The method includes the following steps S301 to S302:

[0062] S301. Obtain the public network address and private network address reported by the private network cloud server;

[0063] S302: Analyze the public network address and the private network address, and identify the target database corresponding to the public network address as the audit object.

[0064] Due to the uniqueness of the public network address, the database audit server can determine which private cloud server's database the communication message comes from based on the public network address, determine the target database corresponding to the public network address based on the public network address, and take the target database corresponding to the public network address as the audit object. This enables the database audit server to accurately identify the audit object, so that when conducting data audits, it monitors the user's operations in the target database to ensure data security, detects abnormal behaviors in the target database and handles them in a timely manner, and records all data changes in the target database to ensure data integrity and traceability, and generates audit logs to help managers understand the security status and audit results of the target database. In addition, when the database audit server detects suspicious operations or operations that violate audit rules in the target database, it can issue an alarm to notify the operation and maintenance personnel to take measures.

[0065] In some embodiments, the database audit server adds a display field in the audit log to display the public network address and the private network address. In this way, in the case of an audit alarm, if the private network address is the same, the public network address can be used to accurately locate which cloud environment the high-risk database comes from, so that operation and maintenance personnel can track risks.

[0066] The database audit service end of the above embodiment can accurately identify the audit object, thereby monitoring all operations in the target database, timely discovering and preventing abnormal activities, and preventing data from being leaked, tampered with, and destroyed, protecting the confidentiality, integrity, and availability of the data. The audit object can be accurately identified, thereby reducing false alarms.

[0067] like Figure 4 As shown, Figure 4 A schematic diagram of a gateway structure provided in an embodiment of the present application, the gateway comprising:

[0068] The acquisition module 401 is used to acquire the public-private address translation relationship table according to the network address translation table;

[0069] The processing module 402 is used to obtain a communication message and store the public-private address conversion relationship table in an extended field of the communication message; the communication message is a message used to operate the target database;

[0070] The sending module 403 is used to send the communication message whose extended field includes the public-private address conversion relationship table to the private network cloud server, so that the private network cloud server can parse and obtain the public network address of the communication message.

[0071] As an optional implementation in the embodiment of the present application, the acquisition module 401 is specifically used to: capture traffic packets; determine whether the traffic packets are communication packets based on the protocol version number of the traffic packets; if so, store the public-private address conversion relationship table in the extended field of the communication packet.

[0072] For the specific limitations of the gateway, please refer to the limitations of the cloud scenario message processing method above, which will not be repeated here. Each module in the above-mentioned gateway can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to the above modules.

[0073] In one embodiment, the present application provides a private network cloud server, which implements the cloud scenario message processing method above or any optional implementation method thereof, and can achieve the same technical effect, which will not be repeated here.

[0074] In one embodiment, the present application provides a database audit server, which implements the above-mentioned cloud scenario database audit method or any optional implementation method thereof, and can achieve the same technical effect, which will not be elaborated here.

[0075] In one embodiment, the present application provides an electronic device, which may be a terminal, and its internal structure diagram may be as follows: Figure 5 As shown. The electronic device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. Among them, the processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the electronic device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, an operator network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a cloud scene message processing method is implemented. The display screen of the electronic device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the electronic device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the housing of the electronic device, or an external keyboard, touchpad or mouse.

[0076] Those skilled in the art will understand that Figure 5 The structure shown in the figure is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0077] In one embodiment, the gateway provided by the present application can be implemented in the form of a computer program. The computer program can be Figure 5 The electronic device shown in the figure is run. The memory of the electronic device can store various program modules constituting the gateway. The computer program composed of various program modules enables the processor to execute the steps of the cloud scenario message processing method of each embodiment of the present application described in this specification.

[0078] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed, the steps of the cloud scenario message processing method of each embodiment of the present application described in this specification are implemented, or the steps of the cloud scenario database auditing method of each embodiment of the present application described in this specification are implemented.

[0079] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media that include computer-usable program code.

[0080] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0081] In the present application, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0082] In this application, memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0083] In this application, computer-readable media includes permanent and non-permanent, removable and non-removable storage media. Storage media can be implemented by any method or technology to store information, and the information can be computer-readable instructions, data structures, modules of programs or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. According to the definition in this article, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0084] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0085] The above is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to these embodiments herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A cloud scenario message processing method, characterized in that: Applied to gateways, including: According to the network address translation table, obtain the public-private address translation relationship table; Acquire a communication message, and store the public-private address conversion relationship table in an extended field of the communication message; the communication message is a message used to operate a target database; The communication message including the public-private address conversion relationship table in the extended field is sent to the private network cloud server, so that the private network cloud server can parse and obtain the public network address of the communication message.

2. The method according to claim 1, characterized in that The acquiring of the communication message and storing the public-private address conversion relationship table in the extended field of the communication message includes: Capture traffic packets; Determining whether the traffic message is the communication message according to the protocol version number of the traffic message; If so, the public-private address conversion relationship table is stored in the extension field of the communication message.

3. A cloud scenario message processing method, characterized in that: Applicable to private cloud servers, including: Acquire a communication message sent by the gateway, wherein the extended field of the communication message includes a public-private address conversion relationship table; Convert the public network address to a public network address according to the public-private address conversion relationship table and the private network address carried by the communication message; The public network address and the private network address are reported to the database audit service end, so that the database audit service end identifies and determines the target database as an audit object.

4. The method according to claim 3, characterized in that The communication message sent by the acquisition gateway, wherein the extended field of the communication message includes a public-private address conversion relationship table, including: Obtaining the traffic message sent by the gateway; Determining whether the traffic message is the communication message according to the protocol version number of the traffic message; If so, the communication message is parsed by the audit engine to obtain the public-private address conversion relationship table.

5. A cloud scenario database audit method, characterized in that: Applied to database audit server, including: Get the public network address and private network address reported by the private network cloud server; The public network address and the private network address are analyzed to identify and determine that the target database corresponding to the public network address is the audit object.

6. The method according to claim 5, characterized in that The method also includes: adding a display field in the audit log to display the public network address and the private network address.

7. A gateway, characterized in that: include: An acquisition module, used for acquiring a public-private address conversion relationship table according to a network address conversion table; A processing module, used for acquiring a communication message, and storing the public-private address conversion relationship table in an extension field of the communication message; The communication message is a message used to operate the target database; The sending module is used to send the communication message whose extended field includes the public-private address conversion relationship table to the private network cloud server, so that the private network cloud server can parse and obtain the public network address of the communication message.

8. A private network cloud server, characterized in that: The private network cloud server implements the cloud scenario message processing method as described in any one of claims 3 to 4.

9. A database audit server, characterized in that: The database audit server implements the cloud scenario database audit method as described in any one of claims 5 to 6.

10. A computer-readable storage medium, characterized in that: include: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, it implements the cloud scenario message processing method as described in any one of claims 1 to 2, or 3 to 4; or, it implements the cloud scenario database auditing method as described in any one of claims 5 to 6.

Images