Database data recovery method and database firewall

Abstract

The invention aims to provide a database data recovery method and a database firewall. The SQL operation of the user is detected, when deletion of the data table is involved, the SQL content is replaced, data backup is conducted on the corresponding data table, meanwhile, a response of successful execution is still made to the user, and user operation is not affected; meanwhile, when the protector needs to be recovered, the reverse operation can be executed through the SQL command, and the data can be rapidly recovered; meanwhile, different backup modes are executed according to different database protocols and different types of deletion operations, the advantages of the database can be fully utilized, backup and recovery processing can be accelerated, and the protection efficiency of a database firewall is improved.

Description

Technical Field

[0001] The invention belongs to the technical field of database protection, and in particular relates to a method for recovering database data after it is mistakenly deleted and a database firewall system applying the method. Background Art

[0002] As the core foundation of information technology and an important tool for data storage, databases carry more and more key business systems and are gradually becoming the most strategic assets in business and public security. The safe and stable operation of databases also directly determines whether the business systems can be used normally. Database security threats often come from within the enterprise, such as malicious destruction, illegal operations, and unauthorized access. Moreover, these operations often do not have attack characteristics and are difficult to be identified by ordinary information security protection systems. Once data corruption occurs, it will cause serious losses.

[0003] A database firewall is a device or product that defends against and eliminates database (database) security issues caused by application business logic vulnerabilities or defects. It is usually deployed between the application server and the database server, and is completed by database protocol parsing.

[0004] Therefore, implementing the recovery of data tables that have been accidentally deleted by users on the database firewall has positive significance for solving the problems of difficult database control, no audit records, and preventing dangerous operations, making database operations controllable and accountable, and reducing dangerous database operations. Summary of the invention

[0005] Based on the above background, the present invention aims to provide a database data recovery method and a database firewall.

[0006] On the one hand, a method for recovering database data is proposed, comprising the following steps: Receive SQL requests and parse them. If a delete SQL operation is detected, replace the corresponding delete statement, send the request to the server, and return the result of successful delete execution to the client. The replacing of the corresponding SQL statement includes: renaming the target data table of the SQL and recording information of the renamed table, or copying and renaming the target data table of the SQL and deleting the original table; When the deleted data needs to be restored, the renamed table or the copied table is modified back to the original table name.

[0007] Preferably, the above-mentioned deletion type SQL operation includes at least one of update, alter, delete, truncate, and drop; and if the deletion operation of the SQL is "drop", the SQL content is replaced with a rename operation; if the deletion operation of the SQL is "truncate", the SQL content is replaced with copying and deleting the original table.

[0008] When a delete-type SQL operation is detected, it also includes creating a backup file according to the target data table with a preset configuration of SQL and deleting the original table if the protocol type of the target database is determined to be oracle; when the deleted data needs to be restored, the data is read from the backup file and restored.

[0009] The creation of the backup file specifically includes: turning on the automatic archiving mode, creating a table space and archiving according to the space and path, configuring default archiving, turning on database archiving; and configuring the archiving of the data table.

[0010] Audit the user's SQL commands through the database firewall. When the audit finds that the user performs a delete-type SQL operation, the database firewall replaces the SQL command with a rename operation. When the user finds that the data has been deleted by mistake, the database firewall renames it again to restore the data.

[0011] The database firewall connects the client and the server in reverse proxy mode. When receiving the SQL request from the client, it parses the SQL protocol data packet to determine the SQL operation type.

[0012] It also includes periodic detection of whether the renamed table or copied table exceeds the preset storage time, and deletes it if it exceeds the time.

[0013] On the other hand, a database firewall system is provided, comprising: The SQL detection module is used to receive and parse SQL requests. If a delete-type SQL operation is detected on the database, the corresponding delete statement is replaced, the request is sent to the server, and the result of successful deletion is returned to the client. The data backup module is used to replace the SQL statement of the deletion type, including: renaming the target data table of the SQL and recording the information of the renamed table, or copying and renaming the target data table of the SQL and deleting the original table; The data recovery module modifies the renamed table or the copied table back to the original table name when the deleted data needs to be recovered.

[0014] Preferably, the above-mentioned deletion type SQL operation includes at least one of update, alter, delete, truncate, and drop; if the deletion operation of the SQL is "drop", the SQL content is replaced with a rename operation; if the deletion operation of the SQL is "truncate", the SQL content is replaced with copying and replacing the original table.

[0015] Furthermore, the database firewall system connects the client and the database server in a reverse proxy mode, and upon receiving an SQL request from the client, parses the SQL protocol data packet to determine the SQL operation type.

[0016] The embodiment of the present invention adopting the above technical solution has at least the following beneficial effects: detecting the user's SQL operation, when it involves the deletion of a data table, replacing the SQL content, backing up the corresponding data table while still responding to the user of successful execution, which will not affect the user's operation; at the same time, when the protective gear needs to be restored, the opposite operation can be performed through the SQL command to quickly restore the data; at the same time, different backup methods are executed for different database protocols and different types of deletion operations, which can fully utilize the advantages of the database and speed up the backup and recovery process, which is conducive to the protection efficiency of the database firewall. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a schematic diagram of the overall workflow of a method for recovering accidentally deleted data from a database according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the module composition of the database firewall system of the present invention. Implementation

[0018] In order to make the purpose, technical scheme and effect of the present invention clearer, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are only used to explain the relevant contents of the present application, rather than to limit the application. It should also be noted that only the parts related to the application are shown in the accompanying drawings.

[0019] like Figure 1 The embodiment of a method for restoring database data shown includes the following steps: Receive SQL requests and parse them. If a delete SQL operation is detected, replace the corresponding delete statement, send the request to the server, and return the result of successful delete execution to the client. The replacing of the corresponding SQL statement includes: renaming the target data table of the SQL and recording information of the renamed table, or copying and renaming the target data table of the SQL and deleting the original table; When the deleted data needs to be restored, the renamed table or the copied table is modified back to the original table name.

[0020] In this embodiment, the “deletion” mentioned is a deletion in a broad sense, that is, all operations that may substantially change the current content of the data table can be called “deletion”.

[0021] Preferably, the above-mentioned deletion type SQL operation includes at least one of update, alter, delete, truncate, and drop.

[0022] It should be noted here that in the SQL operation of the database, the same operation using different commands will mean different operation results. For example, in the delete operation: "delete" means deleting the content to release space but not deleting the definition. It can be operated on row data or the entire table, and data can be rolled back; "truncate" means emptying the data in the table, deleting the content to release space but not deleting the definition, that is, retaining the table data structure, taking effect immediately and cannot be rolled back; and "drop" means deleting the content and definition and releasing space. When executed, the structure of this table will be deleted together, which is also effective immediately and cannot be rolled back.

[0023] Therefore, in this embodiment: if the deletion operation of the SQL is "drop", the SQL content is replaced by a rename operation; if the deletion operation of the SQL is "truncate", the SQL content is replaced by copying and deleting the original table.

[0024] As a preferred implementation, when a deletion type SQL operation is detected, it also includes, if it is determined that the protocol type of the target database is oracle, creating a backup file according to the target data table with a preset configuration of SQL, and deleting the original table; when the deleted data needs to be restored, reading the data from the backup file and restoring it.

[0025] Furthermore, the creation of backup files of the above Oracle protocol specifically includes: turning on the automatic archiving mode, creating tablespaces and archiving according to the space and path, configuring default archiving, turning on database archiving; and configuring archiving of data tables.

[0026] As a preferred implementation, this embodiment audits the user's SQL commands through a database firewall. When the audit finds that the user performs a deletion-type SQL operation, the database firewall replaces the SQL command with a rename operation. When the user finds that the data has been deleted by mistake, the data can be restored by renaming it again through the database firewall.

[0027] Furthermore, the database firewall connects the client and the server in a reverse proxy mode, and when receiving the SQL request from the client, it parses the SQL protocol data packet to determine the SQL operation type.

[0028] As a preferred implementation, it is regularly detected whether the above-mentioned rename table or copy table exceeds the preset storage time, and is deleted when the preset storage time is exceeded.

[0029] In the above-mentioned database data recovery method embodiment, the user's SQL operation is detected, and when it involves the deletion of a data table, the SQL content is replaced, the data of the corresponding data table is backed up while still responding to the user of successful execution, which will not affect the user's operation; at the same time, when the protective gear is needed for recovery, the opposite operation can be performed through the SQL command to quickly restore the data; at the same time, different backup methods are executed for different database protocols and different types of deletion operations, which can fully utilize the advantages of the database and speed up the backup and recovery process, which is conducive to the protection efficiency of the database firewall.

[0030] like Figure 2 As shown, an embodiment of a database firewall system includes: The SQL detection module is used to receive and parse SQL requests. If a delete-type SQL operation is detected on the database, the corresponding delete statement is replaced, the request is sent to the server, and the result of successful deletion is returned to the client. The data backup module is used to replace the SQL statement of the deletion type, including: renaming the target data table of the SQL and recording the information of the renamed table, or copying and renaming the target data table of the SQL and deleting the original table; The data recovery module modifies the renamed table or the copied table back to the original table name when the deleted data needs to be recovered.

[0031] As a preferred implementation, the above-mentioned deletion type SQL operations include at least one of update, alter, delete, truncate, and drop; if the deletion operation of the SQL is "drop", the SQL content is replaced with a rename operation; if the deletion operation of the SQL is "truncate", the SQL content is replaced with copying and replacing the original table.

[0032] Furthermore, the database firewall system connects the client and the database server in a reverse proxy mode, and upon receiving an SQL request from the client, parses the SQL protocol data packet to determine the SQL operation type.

[0033] In the database firewall system embodiment described above, the detection module detects the user's SQL operation. When it involves the deletion of a data table, the data backup module replaces the SQL content, performs data backup on the corresponding data table while still responding to the user of successful execution, which will not affect the user's operation; at the same time, when equipment recovery is required, the data recovery module can perform the opposite operation through SQL commands to quickly restore data; at the same time, the data backup module executes different backup methods for different database protocols and different types of deletion operations, which can fully utilize the advantages of the database and speed up the backup and recovery process, which is helpful for the audit and protection efficiency of the database firewall.

[0034] A person skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc.

[0035] The above description of the above disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will conform to the broadest scope consistent with the principles disclosed herein.

Claims

1. A method for recovering database data, characterized in that: The following steps are involved: Receive SQL requests and parse them. If a delete SQL operation is detected, replace the corresponding delete statement, send the request to the server, and return the result of successful delete execution to the client. The replacing of the corresponding SQL statement includes: renaming the target data table of the SQL and recording information of the renamed table, or copying and renaming the target data table of the SQL and deleting the original table; When the deleted data needs to be restored, the renamed table or the copied table is modified back to the original table name.

2. The data recovery method according to claim 1, characterized in that: The SQL operation of the deletion type includes at least one of update, alter, delete, truncate, and drop; If the deletion operation of the SQL is "drop", the SQL content is replaced with a rename operation; if the deletion operation of the SQL is "truncate", the SQL content is replaced with copying and replacing the original table.

3. The data recovery method according to claim 1, characterized in that: When a delete-type SQL operation is detected, it also includes creating a backup file according to the target data table with a preset configuration of SQL and deleting the original table if the protocol type of the target database is determined to be oracle; when the deleted data needs to be restored, the data is read from the backup file and restored.

4. The data recovery method according to claim 3, characterized in that: The creation of the backup file specifically includes: turning on the automatic archiving mode, creating a table space and archiving according to the space and path, configuring default archiving, turning on database archiving; and configuring the archiving of the data table.

5. The data recovery method according to claim 1, characterized in that: Audit the user's SQL commands through the database firewall. When the audit finds that the user performs a delete-type SQL operation, the database firewall replaces the SQL command with a rename operation. When the user finds that the data has been deleted by mistake, the database firewall renames it again to restore the data.

6. The data recovery method according to claim 4, characterized in that: The database firewall connects the client and the server in reverse proxy mode. When receiving the SQL request from the client, it parses the SQL protocol data packet to determine the SQL operation type.

7. The data recovery method according to claim 1, characterized in that: It also includes periodic detection of whether the renamed table or copied table exceeds the preset storage time, and deletes it if it exceeds the time.

8. A database firewall system, characterized in that: The system comprises: The SQL detection module is used to receive and parse SQL requests. If a delete-type SQL operation is detected on the database, the corresponding delete statement is replaced, the request is sent to the server, and the result of successful deletion is returned to the client. The data backup module is used to replace the SQL statement of the deletion type, including: renaming the target data table of the SQL and recording the information of the renamed table, or copying and renaming the target data table of the SQL and deleting the original table; The data recovery module modifies the renamed table or the copied table back to the original table name when the deleted data needs to be recovered.

9. The database firewall system according to claim 8, characterized in that: The deletion type SQL operation includes at least one of update, alter, delete, truncate, and drop; if the deletion operation of the SQL is "drop", the SQL content is replaced with a rename operation; if the deletion operation of the SQL is "truncate", the SQL content is replaced with copying and replacing the original table.

10. The database firewall system according to claim 8, characterized in that: The database firewall system connects the client and the database server in reverse proxy mode. When receiving the SQL request from the client, it parses the SQL protocol data packet to determine the SQL operation type.

Images