Method, system and equipment for auditing specified statement sequence

Abstract

The invention relates to the technical field of statement auditing, and provides a method, system and equipment for auditing a specified statement sequence, and the method comprises the steps: generating a statement sequence auditing strategy through expanding a creation command and a modification command of a unified auditing strategy, and caching the generated statement sequence auditing strategy; creating a corresponding hash table for each session, and configuring entries of the hash table according to a statement sequence auditing strategy; and judging whether the hash table corresponding to the current session has data or not, and matching a corresponding statement sequence auditing strategy for the current session from the hash table or the cache according to a judgment result. According to the method, the system and the equipment for auditing the specified statement sequence, accurate and flexible compliance check can be provided, reliable security vulnerability detection can be realized, data integrity maintenance can be realized, and performance optimization assistance can be realized.

Description

Technical Field

[0001] The present invention relates to the technical field of statement auditing, and in particular to a method, system and device for auditing a specified statement sequence. Background Art

[0002] With the rapid development of information technology, databases are used more and more widely in various fields, and the value of the data stored in them is also increasing. For example, the core business data of industries such as finance, medical care, and e-commerce. The security of this data is of vital importance. Once it suffers from security issues such as leakage and tampering, it will bring huge losses to enterprises and society.

[0003] Enterprises and organizations are facing increasingly complex security challenges, including external malicious attacks, internal data theft, unauthorized operations, and illegal access. Traditional audit methods are often limited to isolated audits of single statements or operations, and cannot fully evaluate the logical integrity and compliance of a series of related operations. Especially when processing complex business processes involving multiple steps such as orders and fund transfers, traditional methods have difficulty in discovering potential security risks and violations, and cannot meet the regulatory needs for complex database operations.

[0004] In order to meet these challenges, how to provide a method to effectively audit specified statement sequences in business processes, ensure the accuracy, completeness and compliance of business processes, and promptly detect potential security risks and violations, better protect core data assets, and reduce risks and losses caused by data security issues has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] In view of this, in order to overcome the deficiencies of the prior art, the present invention aims to provide a method, system and device for auditing a specified statement sequence.

[0006] According to a first aspect of the present invention, a method for auditing a specified statement sequence is provided, the method comprising: By extending the creation and modification commands of the unified audit policy, a statement sequence audit policy is generated, and the generated statement sequence audit policy is cached; Create a corresponding hash table for each session and configure the entries in the hash table according to the statement sequence audit policy; Determine whether the hash table corresponding to the current session has data, and match the corresponding statement sequence audit policy for the current session from the hash table or cache based on the judgment result.

[0007] Preferably, in the method for specifying statement sequence audit of the present invention, a statement sequence audit policy is generated by extending the creation command and modification command of the unified audit policy, including: Add a SQL statement specifying clause at the end of the command to create a unified audit policy. The SQL statement specifying clause is used to specify the first SQL statement in the statement sequence to be audited. An SQL statement supplementary designation clause is added at the end of the unified audit policy modification command. The SQL statement supplementary designation clause is used to successively designate the remaining SQL statements in the statement sequence to be audited.

[0008] Preferably, in the method for auditing a specified statement sequence of the present invention, the generated statement sequence audit policy is cached, including: after the statement sequence audit policy is generated, the statement sequence audit policy and audit policy information are cached in a database dictionary table.

[0009] Preferably, in the method for auditing a specified statement sequence of the present invention, the audit policy information includes the statement sequence, the length of the first SQL statement in the statement sequence, the statement sequence audit policy name, and the object identifier of the statement sequence audit policy.

[0010] Preferably, in the method for auditing a specified statement sequence of the present invention, a corresponding hash table is created for each session, and the entries of the hash table are configured according to the statement sequence audit policy, including: creating a corresponding hash table for each current session, the key of the entry of the hash table is the object identifier of the statement sequence audit policy, the value of the entry of the hash table includes the object identifier of the statement sequence audit policy, the total number of statements in the statement sequence corresponding to the statement sequence audit policy, and the number of statements in the statement sequence corresponding to the statement sequence audit policy that have been successfully matched with the SQL statement in the session.

[0011] Preferably, in the method for auditing a specified statement sequence of the present invention, it is determined whether there is data in the hash table corresponding to the current session, and the corresponding statement sequence audit policy is matched for the current session from the hash table or cache according to the determination result, including: When a SQL statement being executed by the current session is captured, determine whether there is data in the hash table corresponding to the current session; If the hash table corresponding to the current session has data, traverse the entries in the hash table, query and obtain the cached statement sequence according to the key of the entry, and query the first statement to be matched in order from the obtained statement sequence according to the value of the entry; Compare the SQL statement being executed by the current session with the first statement to be matched. If the SQL statement being executed by the current session is equal to the first statement to be matched, determine whether the first statement to be matched is the last statement in the statement sequence. If the first statement to be matched is the last statement in the statement sequence, the statement sequence audit policy is triggered and executed, the corresponding audit log is reported, and the entry is cleared from the hash table; If the first statement to be matched is not the last statement in the statement sequence, the value of the entry in the hash table is updated by adding 1 to the number of statements that have successfully matched the SQL statements in the session; If the SQL statement currently being executed by the session is not equal to the first statement to be matched, clear the entry from the hash table.

[0012] Preferably, in the method for auditing a specified statement sequence of the present invention, it is determined whether there is data in the hash table corresponding to the current session, and the corresponding statement sequence audit policy is matched for the current session from the hash table or cache according to the determination result, including: If the hash table corresponding to the current session has no data, query the database dictionary table cache to obtain the length of the first SQL statement in the statement sequence that is equal to the length of the SQL statement being executed by the current session. All statement sequence audit policies are used as the statement sequence audit policy set; Traverse the statement sequence audit policy set, compare the SQL statement executed by the current session with the first SQL statement in the statement sequence in the statement sequence audit policy, if the SQL statement being executed by the current session is equal to the first SQL statement in the statement sequence of the statement sequence audit policy, determine whether the statement sequence of the statement sequence audit policy has only one SQL statement; If the statement sequence of the statement sequence audit policy has only one SQL statement, the statement sequence audit policy is triggered and executed, and the corresponding audit log is reported; If the statement sequence of the statement sequence audit policy has more than one SQL statement, the statement sequence audit policy is saved in the hash table corresponding to the current session, and the value of the entry in the hash table is updated by adding 1 to the number of statements that have successfully matched the SQL statements in the session.

[0013] Preferably, in the method for auditing a specified statement sequence of the present invention, if the SQL statement being executed by the current session is not equal to the first SQL statement in the statement sequence of the statement sequence audit policy, it is determined that the SQL statement being executed by the current session fails to match the statement sequence audit policy.

[0014] According to a second aspect of the present invention, a system for auditing a specified statement sequence is provided, the system comprising a specified statement sequence audit server, the specified statement sequence audit server being used to: generate a statement sequence audit policy by extending a creation command and a modification command of a unified audit policy, and cache the generated statement sequence audit policy; create a corresponding hash table for each session, and configure entries in the hash table according to the statement sequence audit policy; determine whether the hash table corresponding to the current session has data, and match the corresponding statement sequence audit policy for the current session from the hash table or the cache according to the determination result.

[0015] According to a third aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect of the present invention when executing the program.

[0016] The method, system and device for auditing a specified statement sequence of the present invention have the following beneficial technical effects: 1. It can provide accurate and flexible compliance checks to ensure that database operations comply with regulations and regulatory requirements in multiple fields such as finance, healthcare, and telecommunications. For example, the financial industry needs to conduct detailed audits of database operations related to fund transactions, including statement sequences for a series of operations such as transaction initiation, transaction update, and transaction completion. By auditing these statement sequences, it is possible to check whether there are any illegal fund operations.

[0017] 2. It can realize reliable security vulnerability detection. The specified statement sequence audit can discover abnormal patterns in database operations. When hackers attack the database, they may execute a series of SQL statements with specific patterns to obtain sensitive information or destroy data. By auditing the statement sequence, such abnormal operation patterns can be discovered in time and potential security vulnerabilities can be detected.

[0018] 3. Able to maintain data integrity. Complex business operations in the database may involve transactions consisting of multiple SQL statements. Statement sequence auditing can ensure that these statements are executed in the correct order and logic to maintain data integrity. If the audit finds abnormalities in the statement sequence, such as inventory updates before order insertion, problems that may cause data inconsistencies can be discovered and corrected in a timely manner.

[0019] 4. It can assist in performance optimization. By analyzing the statement sequence, we can understand the operation mode of the database. For example, by auditing the frequently executed statement sequences, we can find out which business operations have a greater impact on the database load. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 This is an example diagram of the architecture of a system for auditing a specified statement sequence according to an embodiment of the present invention; Figure 2 A flowchart of a method for auditing a specified statement sequence according to an embodiment of the present invention; Figure 3An example diagram of executing a method for auditing a specified statement sequence according to an embodiment of the present invention; Figure 4 Another example diagram of executing a method for auditing a specified statement sequence according to an embodiment of the present invention; Figure 5 A diagram showing another example of executing a method for auditing a specified statement sequence according to an embodiment of the present invention; Figure 6 This is an example diagram of the application of the method and system for auditing a specified statement sequence in the openGauss database scenario according to this embodiment; Figure 7 A schematic diagram of the structure of the device provided by the present invention. DETAILED DESCRIPTION

[0022] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0023] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.

[0024] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0025] The technical principles of the present invention are as follows: First, define the statement sequence audit strategy, specify the statement sequence to be audited in the strategy, and then identify the statement sequence that meets a certain audit strategy during the operation of the database business, audit it and report the audit log, providing a method for effectively auditing the statement sequence specified in the business process, so as to achieve the purpose of grasping the logical integrity and compliance of the business process-related operations as a whole.

[0026] The present invention supports user management of statement sequence audit policies, including creation, modification and deletion of statement sequence audit policies. The present invention triggers the process of statement sequence audit policies, processes them inside the database, and returns the triggered results to the user. Triggering the statement sequence audit policy includes capturing SQL statements executed by the foreground session and statement sequence audit processing.

[0027] Figure 1 FIG. 4 is an exemplary diagram of the architecture of a system for auditing a specified statement sequence according to an embodiment of the present invention. Figure 1 As shown, the system may include a designated statement sequence audit server 101, a communication network 102 and / or one or more designated statement sequence audit clients 103. Figure 1 The example in FIG. 1 is an audit client 103 for multiple specified statement sequences.

[0028] The designated statement sequence audit server 101 can be any appropriate server for storing information, data, programs and / or any other suitable type of content. In some embodiments, the designated statement sequence audit server 101 can perform appropriate functions. For example, in some embodiments, the designated statement sequence audit server 101 can be used to audit a designated statement sequence. As an optional example, in some embodiments, the designated statement sequence audit server 101 can be used to: generate a statement sequence audit policy by extending the creation command and modification command of the unified audit policy, and cache the generated statement sequence audit policy; create a corresponding hash table for each session, and configure the entries in the hash table according to the statement sequence audit policy; determine whether the hash table corresponding to the current session has data, and match the corresponding statement sequence audit policy for the current session from the hash table or cache according to the determination result.

[0029] As another example, in some embodiments, the designated statement sequence audit server 101 may send a method for auditing a designated statement sequence to the designated statement sequence audit client 103 for user use based on a request of the designated statement sequence audit client 103 .

[0030] As an optional example, in some embodiments, the designated statement sequence audit client 103 is used to provide a visual designated audit interface, which is used to receive a user's selection input operation for the designated statement sequence audit, and, in response to the selection input operation, obtain the designated audit interface corresponding to the option selected by the selection input operation from the designated statement sequence audit server 101 and display the designated audit interface, wherein at least information on the designated statement sequence audit and operation options for the information on the designated statement sequence audit are displayed in the designated audit interface.

[0031] In some embodiments, the communication network 102 can be any suitable combination of one or more wired and / or wireless networks. For example, the communication network 102 can include any one or more of the following: the Internet, an intranet, a wide area network (WAN), a local area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN), and / or any other suitable communication network. The specified statement sequence audit client 103 can be connected to the communication network 102 via one or more communication links (e.g., communication link 104), and the communication network 102 can be linked to the specified statement sequence audit server 101 via one or more communication links (e.g., communication link 105). The communication link can be any communication link suitable for transmitting data between the specified statement sequence audit client 103 and the specified statement sequence audit server 101, such as a network link, a dial-up link, a wireless link, a hard-wired link, any other suitable communication link, or any suitable combination of such links.

[0032] The designated statement sequence audit client 103 may include any one or more clients that present an interface related to the designated statement sequence audit in an appropriate form for use and operation by a user. In some embodiments, the designated statement sequence audit client 103 may include any suitable type of device. For example, in some embodiments, the designated statement sequence audit client 103 may include a mobile device, a tablet computer, a laptop computer, a desktop computer, and / or any other suitable type of client device.

[0033] Although the designated statement sequence audit server 101 is illustrated as one device, in some embodiments, any appropriate number of devices may be used to perform the functions performed by the designated statement sequence audit server 101. For example, in some embodiments, multiple devices may be used to implement the functions performed by the designated statement sequence audit server 101. Alternatively, a cloud service may be used to implement the functions of the designated statement sequence audit server 101.

[0034] Based on the above system, an embodiment of the present invention provides a method for auditing a specified statement sequence, which is described below through the following embodiments.

[0035] Figure 2 1 is a flowchart of a method for auditing a specified statement sequence according to an embodiment of the present invention. The method for auditing a specified statement sequence according to this embodiment can be executed at a specified statement sequence auditing server, such as Figure 2 As shown, the method for auditing a specified statement sequence includes the following steps: Step S201: Generate a statement sequence audit policy by extending the creation command and modification command of the unified audit policy, and cache the generated statement sequence audit policy.

[0036] As an optional example, this embodiment adds a SQL statement specification clause at the end of the unified audit policy creation command, and the SQL statement specification clause is used to specify the first SQL statement in the statement sequence to be audited; and adds a SQL statement supplement specification clause at the end of the unified audit policy modification command, and the SQL statement supplement specification clause is used to successively specify the remaining SQL statements in the statement sequence to be audited.

[0037] For example, this embodiment extends the commands for creating a unified audit policy and modifying a unified audit policy in the openGauss database, and the extension content is as follows: Add the sequence_audit_clause clause SEQUENCE BY to the end of the command CREATE AUDIT POLICY for creating a unified audit policy, and specify a SQL statement to be audited after SEQUENCE BY; expand the command ALTER AUDIT POLICY for modifying the unified audit policy to ALTER AUDIT POLICY ADD, add the sequence_audit_clause clause SEQUENCE BY to the end of the command, and specify a SQL statement to be audited after SEQUENCE BY.

[0038] The specific usage of the above command is: for the statement sequence [SQL1,...,SQLn] that needs to be audited, there are n SQL statements in the sequence, first use the sequence_audit_clause clause in the CREATEAUDIT POLICY command to specify the first SQL statement SQL1 in the statement sequence, and the subsequent n-1 SQL statements in the sequence are specified by the sequence_audit_clause clause in the ALTER AUDIT POLICY ADD command, and each ALTER AUDIT POLICY ADD command can only specify one SQL statement, and the subsequent n-1 SQL statements need to use n-1 ALTER AUDIT POLICY ADD commands. In this embodiment, a statement sequence audit policy is defined by the joint use of the create command and the modify command. If the statement sequence that needs to be audited has only one SQL statement, then only one CREATEAUDIT POLICY command is needed to define the statement sequence audit policy.

[0039] After generating the statement sequence audit policy, this embodiment caches the statement sequence audit policy and audit policy information into the database dictionary table. It should be noted that the audit policy information of this embodiment includes the statement sequence, the length of the first SQL statement in the statement sequence, the name of the statement sequence audit policy, and the object identifier of the statement sequence audit policy. For example, after completing the creation of the statement sequence audit policy, this embodiment records the policy-related information into the database dictionary table for use in the subsequent triggering of the statement sequence policy processing. This embodiment adds a dictionary table gs_auditing_policy_sequence, and the records in the dictionary table include: the statement sequence in the statement sequence audit policy, the length of the first SQL statement in the statement sequence, the name of the statement sequence audit policy, the object identifier of the statement sequence audit policy (i.e., OID, each OID in the database is a unique integer, hereinafter referred to as the policy OID) and other information.

[0040] Step S202: Create a corresponding hash table for each session, and configure entries in the hash table according to the statement sequence audit policy.

[0041] As an optional example, this embodiment creates a corresponding hash table for each current session, the key of the entry in the hash table is the object identifier of the statement sequence audit policy, and the value of the entry in the hash table includes the object identifier of the statement sequence audit policy, the total number of statements in the statement sequence corresponding to the statement sequence audit policy, and the number of statements in the statement sequence corresponding to the statement sequence audit policy that have been successfully matched with the SQL statement in the session.

[0042] For example, this embodiment creates a hash table dedicated to each foreground session, and the hash table stores information related to the audit policy of the statement sequence that may be triggered by the session but has not yet been triggered. The entries in the hash table are composed of two parts, one is the key, that is, the policy OID, and the other is the value, which contains the following information: a. Policy OID, b. The total number of statements included in the statement sequence specified by the policy, c. The number of statements that have been successfully matched in the statement sequence of the policy. The matching in this embodiment refers to matching the SQL statements in the session with the SQL contained in the statement sequence of the policy.

[0043] The following example is used to illustrate the meaning of "the hash table stores information related to the audit policy of statement sequences that may be triggered by the session but have not yet been triggered" in this embodiment.

[0044] Assume that there is a statement sequence audit policy P. The statement sequence to be audited specified by policy P is [SQLx, SQLy, SQLz]. This means that the policy requires the execution of these three SQL statements in sequence for auditing. At this time, the total number of statements is 3. After session A executes SQLx, an entry is recorded in the hash table of session A. The key of this entry is the OID of policy P, and the value includes the following: first, the OID of policy P; second, the total number of statements contained in the statement sequence of policy P, which is 3; finally, the information indicating that in session A, there is already a statement (i.e., SQLx) that has been successfully matched in the statement sequence of policy P, so the number of successfully matched statements is 1. Since the number of successfully matched statements, 1, is less than the total number of statements, 3, contained in the statement sequence of policy P, the entry is still recorded in the hash table; when session A then executes SQLy, the value will update the number of successfully matched statements to 2. Similarly, 2 is less than 3, so the entry is still recorded in the hash table; when session A then executes SQLz, the value will update the number of successfully matched statements to 3. At this time, the number of successfully matched statements is 3, which is equal to the total number of statements, 3, contained in the statement sequence of policy P, which means that session A has triggered policy P, so the entry needs to be deleted from the hash table.

[0045] Step S203: determine whether the hash table corresponding to the current session has data, and match the corresponding statement sequence audit policy for the current session from the hash table or cache according to the determination result.

[0046] Figure 3 FIG. 1 is an example diagram of an execution of a method for auditing a specified statement sequence according to an embodiment of the present invention. Figure 3 As shown, when the database captures a SQL statement being executed by the foreground session, it will enter the process of triggering the statement sequence audit policy. In the process, first determine whether there is data in the hash table dedicated to the session. If there is data in the hash table, it means that there is a policy that may be triggered by the session but has not been triggered yet. Then the SQL statement captured at this time may trigger the policy saved in the hash table. Therefore, the policy saved in the hash table must be processed first to avoid missing the trigger policy. If there is no data in the hash table, it means that there is no policy that may be triggered for the session. The system cache of the dictionary table gs_auditing_policy_sequence is directly queried to obtain the existing statement sequence audit policy from the cache and match it with the SQL statement captured at this time.

[0047] As an optional example, when a SQL statement being executed by the current session is captured, determine whether the hash table corresponding to the current session has data; if the hash table corresponding to the current session has data, traverse the entries in the hash table, query and obtain the cached statement sequence according to the key of the entry, and query the first statement to be matched in order from the obtained statement sequence according to the value of the entry; compare the SQL statement being executed by the current session with the first statement to be matched, if the SQL statement being executed by the current session is equal to the first statement to be matched, determine whether the first statement to be matched is the last statement in the statement sequence; if the first statement to be matched is the last statement in the statement sequence, trigger and execute the statement sequence audit policy, report the corresponding audit log, and clear the entry from the hash table; if the first statement to be matched is not the last statement in the statement sequence, update the value of the entry in the hash table by adding 1 to the number of statements that have successfully matched the SQL statement in the session; if the SQL statement being executed by the current session is not equal to the first statement to be matched, clear the entry from the hash table. Figure 4 FIG. 4 is another example diagram of executing a method for auditing a specified statement sequence according to an embodiment of the present invention. Figure 4 As shown, this embodiment traverses the hash table entries, and for each entry, queries the system cache of gs_auditing_policy_sequence according to the key (policy OID) to obtain the statement sequence [SQL1, SQL2, ..., SQLn] of the policy; then, according to the value, finds the matched statement [SQLx] from the statement sequence [SQL1, SQL2, ..., SQLn], then the SQL being executed in the current session needs to be compared with [SQLx+1], and the comparison content is all characters except spaces: (1) If they are equal, the two are considered to match successfully. At this time, it is determined whether [SQLx+1] is the last SQL [SQLn] in the statement sequence of the strategy: a. If x+1 is equal to n, the policy is determined to be matched and allowed to be triggered. The audit log recording interface is immediately called to report the audit log and the entry is cleared from the hash table.

[0048] b. If [SQLx+1] is not the last SQL in the statement sequence of the strategy, then the strategy has not been matched yet, but the number of matched statements increases by 1, and the hash table value is updated.

[0049] (2) If they are not equal, it is determined that the two fail to match and the policy fails to match, and the entry is cleared from the hash table.

[0050] As an optional example, if the hash table corresponding to the current session has no data, query the database dictionary table cache, obtain all statement sequence audit policies whose length of the first SQL statement in the statement sequence is equal to the length of the SQL statement being executed by the current session as a statement sequence audit policy set; traverse the statement sequence audit policy set, compare the SQL statement executed by the current session with the first SQL statement in the statement sequence in the statement sequence audit policy, and if the SQL statement being executed by the current session is equal to the first SQL statement in the statement sequence of the statement sequence audit policy, determine whether the statement sequence of the statement sequence audit policy has only one SQL statement; if the statement sequence of the statement sequence audit policy has only one SQL statement, trigger and execute the statement sequence audit policy, and report the corresponding audit log; if the statement sequence of the statement sequence audit policy has more than one SQL statement, save the statement sequence audit policy to the hash table corresponding to the current session, and update the value of the entry in the hash table by adding 1 to the number of statements that have successfully matched the SQL statement in the session. If the SQL statement being executed by the current session is not equal to the first SQL statement in the statement sequence of the statement sequence audit policy, determine that the SQL statement being executed by the current session fails to match the statement sequence audit policy.

[0051] Figure 5 FIG. 4 is another example of an execution of a method for auditing a specified statement sequence according to an embodiment of the present invention. Figure 5 As shown, the gs_auditing_policy_sequence dictionary table of this embodiment records the statement sequence in each statement sequence audit policy, the length of the first SQL statement in the statement sequence, the policy name, the policy OID and other information. When querying the cache, in order to improve the query efficiency, the statement sequence audit policy that meets the following conditions is searched: the length of the first SQL in the statement sequence of the policy is equal to the length of the SQL executed by the current session. The policy found in this way may be triggered by the current session. The list of policies that meet this condition is traversed, that is, the SQL being executed by the current session is compared with the first SQL in the statement sequence of the policy, and the comparison content is all characters except spaces: (1) If they are equal, the two are considered to match successfully. At this time, determine whether the strategy has only one SQL statement: a. If the policy has only one SQL statement, the policy is considered matched and allowed to be triggered. The audit log recording interface is immediately called to report the audit log.

[0052] b. If the statement sequence of the policy contains more than one SQL statement, the policy is considered not to have been matched yet, but may be triggered by the session, so the policy is saved in the hash table of the session. The key of the hash table is the policy OID, and the value is the statement sequence record that matches the policy in the current session: policy OID, the number of statements in the statement sequence of the policy, and the number of matched statements 1. When the SQL statement is captured next time, the policy saved in the hash table is processed first.

[0053] (2) If they are not equal, then the current session SQL is considered not to match the policy.

[0054] The method and system for auditing a specified statement sequence of this embodiment are applicable to various open source relational databases. The following further describes the application of the method and system for auditing a specified statement sequence of this embodiment in the openGauss database scenario.

[0055] The openGauss database is an open-source relational database management system that is based on the open-source database PostgreSQL. The audit module is one of the built-in security capabilities of the openGauss database. The openGauss provides the ability to audit and track user SQL behaviors, and supports auditing of DDL, DML statements, and key behaviors (login, logout, system startup, stop, and recovery). The audit module is loaded into the thread during the initialization phase of each working thread. The audit execution trigger principle is to assign the audit function to the Hook at different stages of the SQL life cycle. When the thread executes to a specific stage of the SQL processing flow, the audit execution judgment logic will be performed. The unified audit mechanism allows users with POLADMIN or SYSADMIN attributes to formulate audit policies and generate customized audit logs. The unified audit policy can cover common user management activities, DDL and DML behaviors, monitor SQL statements executed by users through the client, and will not record SQL statements inside the database.

[0056] The method and system for auditing a specified statement sequence of this embodiment are implemented based on the audit module and unified audit mechanism of the openGauss database. The user defines the statement sequence audit strategy in the openGauss database, and the database internally processes the statement sequence audit strategy. Figure 6 This is an example diagram of the application of the method and system for auditing a specified statement sequence in the openGauss database scenario.

[0057] The method and system for auditing a specified statement sequence of this embodiment have the following beneficial technical effects: 1. It can provide accurate and flexible compliance checks to ensure that database operations comply with regulations and regulatory requirements in multiple fields such as finance, healthcare, and telecommunications. For example, the financial industry needs to conduct detailed audits of database operations related to fund transactions, including statement sequences for a series of operations such as transaction initiation, transaction update, and transaction completion. By auditing these statement sequences, it is possible to check whether there are any illegal fund operations.

[0058] 2. It can realize reliable security vulnerability detection. The specified statement sequence audit can discover abnormal patterns in database operations. When hackers attack the database, they may execute a series of SQL statements with specific patterns to obtain sensitive information or destroy data. By auditing the statement sequence, such abnormal operation patterns can be discovered in time and potential security vulnerabilities can be detected.

[0059] 3. Able to maintain data integrity. Complex business operations in the database may involve transactions consisting of multiple SQL statements. Statement sequence auditing can ensure that these statements are executed in the correct order and logic to maintain data integrity. If the audit finds abnormalities in the statement sequence, such as inventory updates before order insertion, problems that may cause data inconsistencies can be discovered and corrected in a timely manner.

[0060] 4. It can assist in performance optimization. By analyzing the statement sequence, we can understand the operation mode of the database. For example, by auditing the frequently executed statement sequences, we can find out which business operations have a greater impact on the database load.

[0061] like Figure 7 As shown, the present invention also provides a device, including a processor 310, a communication interface 320, a memory 330 for storing a processor executable computer program, and a communication bus 340. The processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 implements the above-mentioned method of auditing a specified statement sequence by running the executable computer program.

[0062] Among them, the computer program in the memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0063] The system embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected based on actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0064] Through the description of the above implementation modes, those skilled in the art can clearly understand that each implementation mode can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on such an understanding, the above technical solution can essentially or in other words be embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0065] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for auditing a specified statement sequence, characterized in that: The method comprises: By extending the creation and modification commands of the unified audit policy, a statement sequence audit policy is generated, and the generated statement sequence audit policy is cached; Create a corresponding hash table for each session and configure the entries in the hash table according to the statement sequence audit policy; Determine whether the hash table corresponding to the current session has data, and match the corresponding statement sequence audit policy for the current session from the hash table or cache based on the judgment result.

2. The method for auditing a specified statement sequence according to claim 1, characterized in that: By extending the creation and modification commands of the unified audit policy, a statement sequence audit policy is generated, including: Adding a SQL statement specifying clause at the end of the command for creating a unified audit policy, wherein the SQL statement specifying clause is used to specify the first SQL statement in the statement sequence to be audited; An SQL statement supplementary designation clause is added at the end of the modification command of the unified audit policy, and the SQL statement supplementary designation clause is used to successively designate the remaining SQL statements in the statement sequence to be audited.

3. The method for auditing a specified statement sequence according to claim 1, characterized in that: The generated statement sequence audit policy is cached, including: after the statement sequence audit policy is generated, the statement sequence audit policy and audit policy information are cached in a database dictionary table.

4. The method for auditing a specified statement sequence according to claim 3, characterized in that: The audit policy information includes the statement sequence, the length of the first SQL statement in the statement sequence, the statement sequence audit policy name, and the object identifier of the statement sequence audit policy.

5. The method for auditing a specified statement sequence according to claim 1, characterized in that: A corresponding hash table is created for each session, and entries of the hash table are configured according to the statement sequence audit policy, including: creating a corresponding hash table for each current session, the key of the entry of the hash table is the object identifier of the statement sequence audit policy, the value of the entry of the hash table includes the object identifier of the statement sequence audit policy, the total number of statements in the statement sequence corresponding to the statement sequence audit policy, and the number of statements in the statement sequence corresponding to the statement sequence audit policy that have been successfully matched with the SQL statement in the session.

6. The method for auditing a specified statement sequence according to claim 1, characterized in that: Determine whether the hash table corresponding to the current session has data, and match the corresponding statement sequence audit policy for the current session from the hash table or cache based on the judgment result, including: When a SQL statement being executed by the current session is captured, determine whether there is data in the hash table corresponding to the current session; If the hash table corresponding to the current session has data, traverse the entries in the hash table, query and obtain the cached statement sequence according to the key of the entry, and query the first statement to be matched in order from the obtained statement sequence according to the value of the entry; Compare the SQL statement being executed by the current session with the first statement to be matched. If the SQL statement being executed by the current session is equal to the first statement to be matched, determine whether the first statement to be matched is the last statement in the statement sequence. If the first statement to be matched is the last statement in the statement sequence, trigger and execute the statement sequence audit policy, report the corresponding audit log, and clear the entry from the hash table; If the first statement to be matched is not the last statement in the statement sequence, the value of the entry in the hash table is updated by adding 1 to the number of statements that have successfully matched the SQL statement in the session; If the SQL statement currently being executed by the session is not equal to the first statement to be matched, clear the entry from the hash table.

7. The method for auditing a specified statement sequence according to claim 1, characterized in that: Determine whether the hash table corresponding to the current session has data, and match the corresponding statement sequence audit policy for the current session from the hash table or cache based on the judgment result, including: If the hash table corresponding to the current session has no data, query the database dictionary table cache to obtain the length of the first SQL statement in the statement sequence that is equal to the length of the SQL statement being executed by the current session. All statement sequence audit policies are used as the statement sequence audit policy set; Traverse the statement sequence audit policy set, compare the SQL statement executed by the current session with the first SQL statement in the statement sequence in the statement sequence audit policy, if the SQL statement being executed by the current session is equal to the first SQL statement in the statement sequence of the statement sequence audit policy, determine whether the statement sequence of the statement sequence audit policy has only one SQL statement; If the statement sequence of the statement sequence audit policy has only one SQL statement, the statement sequence audit policy is triggered and executed, and the corresponding audit log is reported; If the statement sequence of the statement sequence audit policy has more than one SQL statement, the statement sequence audit policy is saved in the hash table corresponding to the current session, and the value of the entry in the hash table is updated by adding 1 to the number of statements that have successfully matched the SQL statements in the session.

8. The method for auditing a specified statement sequence according to claim 7, characterized in that: If the SQL statement being executed by the current session is not equal to the first SQL statement in the statement sequence of the statement sequence audit policy, it is determined that the SQL statement being executed by the current session fails to match the statement sequence audit policy.

9. A system for auditing a specified statement sequence, characterized in that: The system includes a designated statement sequence audit server, which is used to: generate a statement sequence audit policy by extending a creation command and a modification command of a unified audit policy, and cache the generated statement sequence audit policy; Create a corresponding hash table for each session, and configure the entries in the hash table according to the statement sequence audit policy; determine whether the hash table corresponding to the current session has data, and match the corresponding statement sequence audit policy for the current session from the hash table or cache based on the determination result.

10. A computer device, characterized in that: The computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the method according to any one of claims 1 to 8 when executing the program.

Images