Database traffic control method and database firewall
By using reverse proxy technology in the database firewall system, and using proxy ports and gateway programs to achieve database traffic control and auditing, the problems of inconvenient user operation, low encryption and decryption efficiency and limited database types in the existing technology are solved, and the database security protection effect is improved.
Patent Information
- Application Number
- CN202311109455.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-08-31
- Publication Date
- 2025-02-28
AI Technical Summary
The existing database firewall system is based on the client user sid as the only judgment to obtain real server information, resulting in inconvenience of user operation, low efficiency of agent encryption and decryption, limited types of databases supported, and difficult to effectively protect database security.
Reverse proxy technology is adopted, by setting the gateway program to monitor the proxy port, client tools fill in the database firewall IP and preset proxy port when configuring assets, username and password login information are all real information login operations. If bypass is turned on, only pass-through operations are performed, no logging is performed; if bypass is turned off and there is no matching rule, audit records and packet forwarding are performed; if there is matching rule, corresponding response is performed.
The real database information is distinguished through proxy ports, which improves operability and application, and enables operation and maintenance personnel to connect to real database servers through proxy IP and ports, and effectively manage and audit database traffic through proxy programs.
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of database security, and in particular relates to a database traffic control method based on a reverse proxy and a database firewall system applying the method. Background Art
[0002] A database firewall is a device or product that defends against and eliminates database (database) security issues caused by application business logic vulnerabilities or defects. It is usually deployed between the application server and the database server, and is completed by database protocol parsing.
[0003] The proxy solution is used on the database firewall system to solve the problems of difficult database control, no audit records, and prevention of dangerous operations. It makes database operations controllable and responsibility traceable, reduces dangerous database operations, and meets the diverse operation and maintenance needs of clients.
[0004] However, the current database firewall is based on the client user SID as the only way to obtain the real server information. The platform needs to maintain the SID filled in by the client tool, which is not convenient for user operation. In addition, the agent program needs to replace the password, which makes it difficult to encrypt and decrypt efficiently, resulting in limited database types that support protection, which is not conducive to database security protection. Summary of the invention
[0005] In view of the above background, an embodiment of the present invention aims to provide a database traffic control method and a database firewall using the method.
[0006] On the one hand, the present invention provides a method for controlling database traffic, comprising: Through reverse proxy, set up a gateway program to listen to the proxy port, and fill in the database firewall IP and the proxy port preset when configuring assets in the client tool. The username and password login information are all real information to implement the login operation; If bypass is enabled, only transparent transmission is performed and no logging is performed; If bypass is closed and there is no matching rule, audit records and packet forwarding are performed; if there is a matching rule, a corresponding response is made.
[0007] Preferably, the IP filled in by the client tool is the IP of the digital audit firewall, then the data packets of the management port are directly processed by the kernel and then go to the agent program; specifically, KNI technology is used to create a virtual network port and configure an IP, which acts as a proxy IP and sends part of the data packets on the virtual network port to the kernel for processing.
[0008] Preferably, a corresponding rule chain is configured according to the proxy port of the asset configured on the database firewall, so that other data packets that do not meet the conditions are no longer processed redundantly; and the client tool connects to the real server through the database firewall.
[0009] Preferably, the above-mentioned client tool is connected to the real server through the database firewall, including: using the proxy IP and port to connect to the database firewall platform, the proxy program simulates direct remote operation and maintenance to the database server, and the database firewall acts as an intermediate link to audit and control the client operation.
[0010] Preferably, the above-mentioned control method includes the agent program parsing the data message: when the database firewall platform has an effective sql blacklist rule, if the agent program matches the rule, there is no need to send the request packet to the real server, but instead returns a response message to the client indicating that there is no operation permission.
[0011] Furthermore, the proxy program analyzes the data message, including: if the user's execution matches the session blocking rule, the proxy program will disconnect from the client and disconnect from the real server.
[0012] And, the proxy program parses the message, which also includes: in the proxy program, according to the characteristics of the database protocol, parsing the SQL contained in the client tool request package and recording the information for rule matching.
[0013] On the other hand, the present invention provides a database firewall system, the system comprising: The client tool uses the proxy IP and port to connect to the database firewall platform, and connects to the database server through the firewall platform for operation; The firewall platform sets up a gateway program to listen to the proxy port, uses KNI technology to create a virtual network port and configure an IP, which acts as a proxy IP and uploads part of the data packets on the virtual network port to the kernel for processing.
[0014] Preferably, the above-mentioned firewall platform includes a proxy module to parse the data message: When the database firewall platform has an effective SQL blacklist rule, if the proxy program matches the rule, it does not need to send the request packet to the real server, but returns a response message to the client indicating that the operation is not authorized; If the user's execution matches the session blocking rule, the proxy program will disconnect from the client and disconnect the proxy program from the real server; In the proxy program, according to the characteristics of the database protocol, the SQL contained in the client tool request package is parsed and the information is recorded for rule matching.
[0015] The technical solution of the present invention adopting the above content has at least the following beneficial effects: the real database information is distinguished by the proxy port, which has strong operability and applicability; it can enable operation and maintenance personnel to use the proxy IP proxy port to connect to the real database server through the database firewall; at the same time, the client traffic all passes through the proxy program of the database firewall platform, which can realize effective control and audit of the database traffic. Implementation
[0016] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the present application is further described in detail using embodiments below. It is understood that the specific embodiments described here are only used to explain the relevant contents of the present application, rather than to limit the application.
[0017] First, a brief explanation of technical terms.
[0018] There are two types of proxies: forward proxies and reverse proxies.
[0019] (1) Forward proxy Users use proxy servers to access target servers. The main purposes are: accessing illegal pages (non-permitted hosts use the proxy servers of permitted hosts to access the Internet illegally) and accelerating access (online game accelerators).
[0020] (2) Reverse proxy The server uses a proxy server to provide services to users. The reverse proxy hides the real server. When we request http: / / www.baidu.com, there are thousands of servers behind us serving us. What the reverse proxy server does for us is to forward our requests to the real server. ngnix is a high-performance reverse proxy server, which is often used to achieve load balancing.
[0021] The database proxy implementation of the bastion host is to use the username as the unique data. On the client tool, fill in the bastion host management port IP, the port listened by the proxy program, and the username as the unique SID to generate associated asset information and session on the bastion host platform. A fake password is used as the password. When the client initiates a connection request, the proxy program will reversely check the relevant information of the real database server stored in the bastion host database based on the username field in the request message. The proxy connects to the real server and replaces the login package with the user and password and sends it to the server. After the authentication with the server is passed and the rules are not matched afterwards, the proxy only needs to implement the audit and packet forwarding effects.
[0022] At present, the sid filled in the user name field is the only judgment to obtain the real server information. In this way, the sid filled in by the client tool needs platform maintenance, which is not convenient for users to use. At the same time, the agent needs to replace the user password, and it is necessary to study password encryption and decryption, which is difficult to implement and limits the supported database. Therefore, the following technical solution is proposed.
[0023] Embodiment 1, a method for controlling database traffic based on a reverse proxy, includes: Through reverse proxy, set up a gateway program to listen to the proxy port, and fill in the database firewall IP and the proxy port preset when configuring assets in the client tool. The username and password login information are all real information to implement the login operation; If bypass is enabled, only transparent transmission is performed and no logging is performed; If bypass is closed and there is no matching rule, audit records and packet forwarding are performed; if there is a matching rule, a corresponding response is made.
[0024] As a preferred implementation method, the IP filled in by the client tool is the IP of the digital audit firewall, then the data packets of the management port are directly processed by the kernel and then go to the agent program; specifically, KNI technology is used to create a virtual network port and configure the IP, which acts as a proxy IP and uploads part of the data packets on the virtual network port to the kernel for processing.
[0025] As a preferred implementation, the corresponding rule chain is configured according to the proxy port of the asset configured on the database firewall, so that other data packets that do not meet the conditions are no longer processed redundantly; and the client tool connects to the real server through the database firewall.
[0026] Preferably, the above-mentioned client tool is connected to the real server through the database firewall, including: using the proxy IP and port to connect to the database firewall platform, the proxy program simulates direct remote operation and maintenance to the database server, and the database firewall acts as an intermediate link to audit and control the client operation.
[0027] Preferably, the above-mentioned control method includes the agent program parsing the data message: when the database firewall platform has an effective sql blacklist rule, if the agent program matches the rule, there is no need to send the request packet to the real server, but instead returns a response message to the client indicating that there is no operation permission.
[0028] Furthermore, the proxy program analyzes the data message, including: if the user's execution matches the session blocking rule, the proxy program will disconnect from the client and disconnect from the real server.
[0029] And, the proxy program parses the message, which also includes: in the proxy program, according to the characteristics of the database protocol, parsing the SQL contained in the client tool request package and recording the information for rule matching.
[0030] Embodiment 2, a database firewall system embodiment, the system includes: The client tool uses the proxy IP and port to connect to the database firewall platform, and connects to the database server through the firewall platform for operation; The firewall platform sets up a gateway program to listen to the proxy port, uses KNI technology to create a virtual network port and configure an IP, which acts as a proxy IP and uploads part of the data packets on the virtual network port to the kernel for processing.
[0031] Preferably, the above-mentioned firewall platform includes a proxy module to parse the data message: When the database firewall platform has an effective SQL blacklist rule, if the proxy program matches the rule, it does not need to send the request packet to the real server, but returns a response message to the client indicating that the operation is not authorized; If the user's execution matches the session blocking rule, the proxy program will disconnect from the client and disconnect the proxy program from the real server; In the proxy program, according to the characteristics of the database protocol, the SQL contained in the client tool request package is parsed and the information is recorded for rule matching.
[0032] The database traffic control method embodiment and database firewall system embodiment of the present invention as described above use proxy ports to distinguish real database information, and have strong operability and applicability; they can enable operation and maintenance personnel to use proxy IP proxy ports to connect to the real database server through the database firewall; at the same time, the client traffic all passes through the proxy program of the database firewall platform, which can achieve effective control and audit of database traffic.
[0033] A person skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc.
[0034] The above description of the above disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will conform to the broadest scope consistent with the principles disclosed herein.
Claims
1. A method for controlling database traffic, characterized in that: include: Through reverse proxy, set up a gateway program to listen to the proxy port, and the client tool fills in the database firewall IP and the proxy port preset when configuring assets. The username and password login information are all real information to implement the login operation; If bypass is enabled, only transparent transmission is performed and no logging is performed; If bypass is closed and there is no matching rule, audit records and packet forwarding are performed; if there is a matching rule, a corresponding response is made.
2. The database traffic control method according to claim 1, characterized in that: If the IP filled in by the client tool is the IP of the digital audit firewall, the data packets of the management port are directly processed by the kernel and then go to the agent program; specifically, KNI technology is used to create a virtual network port and configure an IP, which acts as a proxy IP and sends part of the data packets on the virtual network port to the kernel for processing.
3. The database traffic control method according to claim 1, characterized in that: According to the proxy port of the asset configured on the database firewall, the corresponding rule chain is configured so that other data packets that do not meet the conditions are no longer processed redundantly; and the client tool connects to the real server through the database firewall.
4. The database traffic control method according to claim 3 is characterized in that: The client is connected to the real server through the database firewall, including: using the proxy IP and port to connect to the database firewall platform, the proxy program simulates direct remote operation and maintenance to the database server, and the database firewall acts as an intermediate link to audit and control the client operations.
5. The database traffic control method according to claim 1, characterized in that: Including the agent program to parse the data message: When the database firewall platform has an effective SQL blacklist rule, if the proxy program matches the rule, it does not need to send the request packet to the real server, but returns a response message to the client indicating that the operation permission is not granted.
6. The database traffic control method according to claim 5, characterized in that: The proxy program analyzes the data message and further includes: if the user's execution matches the session blocking rule, the proxy program will disconnect from the client and disconnect from the real server.
7. The database traffic control method according to claim 5, characterized in that: The agent program parses the message, and further includes: in the agent program, according to the characteristics of the database protocol, parsing the SQL contained in the client tool request package and recording the information for rule matching.
8. A database firewall system, characterized in that: The system comprises: The client tool uses the proxy IP and port to connect to the database firewall platform, and connects to the database server through the firewall platform for operation; The firewall platform sets up a gateway program to listen to the proxy port, uses KNI technology to create a virtual network port and configure an IP, which acts as a proxy IP and uploads part of the data packets on the virtual network port to the kernel for processing.
9. The database firewall system according to claim 8, characterized in that: The platform includes a proxy module to parse data messages: When the database firewall platform has an effective SQL blacklist rule, if the proxy program matches the rule, it does not need to send the request packet to the real server, but returns a response message to the client indicating that the operation is not authorized; If the user's execution matches the session blocking rule, the proxy program will disconnect from the client and disconnect the proxy program from the real server; In the proxy program, according to the characteristics of the database protocol, the SQL contained in the client tool request package is parsed and the information is recorded for rule matching.