Database vulnerability protection method and system based on network blocking and terminal reinforcement

Abstract

The invention provides a database vulnerability protection method and system based on network blocking and terminal reinforcement, and is applied to the technical field of data security. The method comprises the steps that host information and database information of a host where a terminal Agent is located are received, and a database asset information base is formed based on the host information and the database information; matching the database asset information base with the vulnerability information base, and determining a protection strategy based on the successfully matched database information; sending the protection strategy to a terminal Agent and / or a database gateway; the protection strategy is used for indicating the terminal Agent to execute the terminal reinforcement operation of the host where the terminal Agent is located based on the protection strategy, and / or the database gateway performs vulnerability detection and blocking operation on the network flow flowing into and out of the target database in real time based on the protection strategy. According to the method, the problem that the security of a database system is threatened due to the fact that effective security protection cannot be carried out on a terminal side and a database application layer in virtual patch protection is solved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a database vulnerability protection method and system based on network blocking and terminal reinforcement. Background Art

[0002] With the acceleration of technological trends such as digital transformation and new industrialization, databases have become key assets for enterprise operators. The security threats of typical database vulnerabilities such as code injection, unauthorized access, and permission bypass are becoming more severe. Currently, database vulnerability protection is usually repaired by manufacturers releasing patches. However, the patch release cycle is uncertain, resulting in system security risks before the patch is released. For critical database systems that need to run continuously without interruption, it is difficult to have the conditions for patch repair. Therefore, most of them use virtual patch protection technology for security protection.

[0003] The advantage of virtual patch protection technology is that it can protect the database without patching the vulnerability library kernel. However, traditional database vulnerability virtual patch protection methods mainly focus on the network traffic level, generally by deploying firewalls, intrusion detection systems and other network devices to identify and block potential vulnerability exploitation attacks. This method may lead to problems such as high performance consumption and network latency. More importantly, this method does not have the protection capabilities at the terminal side and database application level. There are "blind spots" for security vulnerabilities that require terminal-side reinforcement protection. Once hackers break through the network layer protection and attack the terminal, it will directly threaten system security. Summary of the invention

[0004] In order to overcome the problem that the above-mentioned virtual patch protection cannot effectively protect the terminal side and the database application layer, thereby threatening the security of the database system, the present invention provides a database vulnerability protection system and method based on network blocking and terminal reinforcement.

[0005] In one aspect, the present invention provides a database vulnerability protection method based on network blocking and terminal reinforcement, the method comprising:

[0006] Receiving host information of the host where the terminal Agent is located and database information of the target database sent by the terminal Agent, and forming a database asset information library based on the host information and the database information; the terminal Agent is deployed on the host side of the target database;

[0007] Matching the database asset information library with the preset vulnerability information library for database information, and if the match is successful, determining a protection strategy based on the successfully matched database information;

[0008] Sending the protection strategy to a terminal Agent corresponding to the host information and / or to a database gateway of the target database;

[0009] Among them, the protection strategy is used to instruct the terminal agent to perform terminal hardening operations on its own host based on the protection strategy, and / or, the protection strategy is used to instruct the database gateway to perform vulnerability detection and blocking operations on network traffic flowing into and out of the target database in real time based on the protection strategy.

[0010] Optionally, the process of generating the vulnerability information database includes:

[0011] Collect basic vulnerability information, vulnerability traffic characteristics, and vulnerability reinforcement strategies of the target database by obtaining and / or subscribing to threat intelligence from various vulnerability information sharing platforms and software hosting platform open source communities;

[0012] The vulnerability information library is generated based on the basic vulnerability information, the vulnerability traffic characteristics and the vulnerability reinforcement strategy.

[0013] Optionally, matching the database asset information library with a preset vulnerability information library with respect to database information includes:

[0014] Matching the database type and database version information in the database information with the database type affected by the vulnerability and the database version affected by the vulnerability;

[0015] If the database type and data version information in the database information are the same as the database type affected by the vulnerability and the database version affected by the vulnerability corresponding to any vulnerability in the vulnerability information library, it is determined that the match is successful.

[0016] Optionally, determining a protection strategy based on successfully matched database information includes:

[0017] The protection strategy is determined based on the vulnerability reinforcement strategy corresponding to the successfully matched vulnerability and the basic information of the vulnerability.

[0018] Optionally, the host information includes a host IP address, the basic vulnerability information also includes whether the vulnerability can be remotely exploited, and the protection strategy is determined based on the vulnerability reinforcement strategy corresponding to the successfully matched vulnerability and the basic vulnerability information, including:

[0019] If a vulnerability hardening strategy exists for the successfully matched vulnerability and the vulnerability cannot be remotely exploited, the protection strategy is determined to be a terminal hardening mode;

[0020] If there is no vulnerability hardening strategy for the successfully matched vulnerability, and the vulnerability can be exploited remotely, the protection strategy is determined to be a network blocking mode;

[0021] If a vulnerability reinforcement strategy exists for the successfully matched vulnerability and the vulnerability can be exploited remotely, the protection strategy is determined to be a network blocking combined with terminal reinforcement mode.

[0022] Optionally, sending the protection policy to a terminal Agent corresponding to the host information and / or to a database gateway of the target database includes:

[0023] If the protection strategy is a terminal hardening mode, a terminal protection instruction is generated based on the terminal hardening mode and the vulnerability hardening strategy corresponding to the successfully matched vulnerability, and the terminal protection instruction is sent to the terminal Agent corresponding to the host IP address;

[0024] If the protection strategy is a network blocking mode, a network blocking protection instruction is generated based on the network blocking mode, the vulnerability traffic characteristics corresponding to the successfully matched vulnerability, and the host IP address affected by the successfully matched vulnerability, and the network blocking protection instruction is sent to the database gateway of the target database;

[0025] If the protection strategy is the network blocking combined terminal reinforcement mode, a joint protection instruction is generated based on the network blocking combined terminal reinforcement mode, the vulnerability reinforcement strategy corresponding to the successfully matched vulnerability, the vulnerability traffic characteristics and the host IP address affected by the vulnerability, and the joint protection instruction is respectively sent to the terminal Agent corresponding to the host IP address and the database gateway of the target database.

[0026] On the other hand, the present invention also provides a database vulnerability protection method based on network blocking and terminal reinforcement, comprising:

[0027] The terminal agent obtains the host information of the host where it is located and the database information of the target database, and uploads the host information and the database information to the vulnerability response protection center;

[0028] Receive the protection strategy issued by the vulnerability response protection center, and perform terminal hardening operations on the host where the terminal Agent is located based on the protection strategy;

[0029] Among them, the protection strategy is that the vulnerability response protection center matches the database asset information library with the preset vulnerability information library for database information, and is determined based on the successfully matched database information; the database asset information library is formed by the vulnerability response protection center based on the host information and the database information.

[0030] Optionally, the performing a terminal hardening operation on a host where the terminal Agent is located based on the protection strategy includes:

[0031] According to the operating system information and database information of the host where the terminal Agent is located, select and execute the reinforcement script corresponding to the protection strategy;

[0032] The terminal hardening operation includes at least one of password policy strengthening, access control strengthening and user authority configuration.

[0033] On the other hand, the present invention also provides a database vulnerability protection system based on network blocking and terminal reinforcement, comprising: a terminal agent deployed on the host side of a target database, a vulnerability response protection center and a database gateway, the terminal agent and the database gateway being respectively connected to the vulnerability response protection center for communication;

[0034] The terminal Agent is used to implement any of the above methods;

[0035] The vulnerability response and protection center is used to implement any of the aforementioned methods;

[0036] The database gateway is used to perform vulnerability detection and blocking operations on the network traffic flowing into and out of the target database in real time based on the protection strategy sent by the vulnerability response protection center.

[0037] Optionally, the database gateway is specifically used for:

[0038] By calling the intrusion prevention system function, the host IP address and vulnerability traffic characteristics in the protection strategy are configured as vulnerability traffic blocking rule conditions; and vulnerability detection and blocking operations are performed on the network traffic whose target address is the host IP address affected by the vulnerability;

[0039] The blocking operation includes at least one of discarding a data packet, sending a reset RST data packet, and blocking an attack source IP address.

[0040] On the other hand, the present invention also provides an electronic device, comprising: at least one processor and a memory; the memory and the processor are connected via a bus;

[0041] The memory is used to store one or more programs;

[0042] When the one or more programs are executed by the at least one processor, any one of the above methods is implemented.

[0043] On the other hand, the present invention further provides a readable storage medium having an execution program stored thereon, and when the execution program is executed, any one of the methods described above is implemented.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] The present invention provides a database vulnerability protection method and system based on network blocking and terminal reinforcement. By installing a terminal agent on the host side of the database, a vulnerability response protection center matches the database asset information base formed based on the host information of the terminal agent and the database information of the target database sent by the terminal agent with the preset vulnerability information base for database information. If the match is successful, a protection strategy is generated and issued based on the matching result. The terminal agent performs the terminal reinforcement operation of the host where it is located based on the protection strategy, and / or the database gateway performs vulnerability detection and blocking operations of real-time network traffic based on the protection strategy. Through the terminal reinforcement operation, deep protection of the database system is achieved, which can not only instantly identify and block malicious traffic at the network level, but also improve the system's anti-attack capability through reinforcement measures at the terminal level, thereby providing comprehensive security protection before and after the attack occurs, and can quickly respond to database vulnerability threats, and provide system instant protection without modifying the database code or structure. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 This is one of the flow diagrams of a database vulnerability protection method based on network blocking and terminal reinforcement of the present invention;

[0047] Figure 2 This is a second flow chart of a database vulnerability protection method based on network blocking and terminal reinforcement of the present invention;

[0048] Figure 3 It is a structural schematic diagram of a database vulnerability protection system based on network blocking and terminal reinforcement of the present invention;

[0049] Figure 4 It is a schematic structural diagram of the electronic device of the present invention. DETAILED DESCRIPTION

[0050] The specific implementation modes of the present invention are further described in detail below with reference to the accompanying drawings.

[0051] Example 1

[0052] The present invention provides a database vulnerability protection method based on network blocking and terminal reinforcement, such as Figure 1 As shown, the following steps are included:

[0053] Step S110, receiving the host information of the host where the terminal Agent is located and the database information of the target database sent by the terminal Agent, and forming a database asset information library based on the host information and the database information; the terminal Agent is deployed on the host side of the target database;

[0054] Step S120, matching the database asset information library with the preset vulnerability information library with respect to database information, and determining a protection strategy based on the successfully matched database information;

[0055] Step S130, sending the protection policy to the terminal Agent corresponding to the host information and / or to the database gateway of the target database; the protection policy is used to instruct the terminal Agent to perform terminal hardening operations on its own host based on the protection policy, and / or, the protection policy is used to instruct the database gateway to perform vulnerability detection and blocking operations on network traffic flowing into and out of the target database in real time based on the protection policy.

[0056] In this example implementation, the terminal agent can be deployed on the target database server or application server, or in the virtual machine of the target database. The terminal agent can be deployed on a host with an independent operating system in the target database. The terminal agent is used to obtain and upload the host information and the configuration version information of the database system, receive the protection strategy (including the terminal reinforcement strategy) issued by the vulnerability response protection center, and automatically perform the reinforcement operation. The host information includes the host IP address and the host operating system, the database information includes the database type and the database version information, and the protection strategy includes the terminal reinforcement strategy, the network traffic blocking strategy and the terminal reinforcement combined with the network traffic blocking strategy. The vulnerability response protection center can be linked with the database gateway and the terminal agent in real time. The vulnerability response protection center has a built-in vulnerability information library, a terminal reinforcement strategy library and a protection strategy decision engine. According to the collected vulnerability information, it intelligently judges and selects the most appropriate protection strategy to be issued. The database gateway is a network device deployed at the front end of the database, which monitors the network traffic in and out of the database in real time, and implements network-level blocking measures when the vulnerability exploitation traffic is identified. The present invention breaks through the traditional way of virtual patch protection that only relies on network blocking, and achieves deep protection of the database system by introducing intelligent terminal reinforcement technology. Not only can it instantly identify and block malicious traffic at the network level, but it can also improve the system's anti-attack capabilities through reinforcement measures at the terminal level, thus providing comprehensive security protection before and after the attack occurs. By combining network blocking and terminal reinforcement technology, comprehensive protection against database vulnerabilities is achieved.

[0057] Exemplarily, the database asset information can be maintained regularly or in real time. Specifically, the terminal Agent deployed on the database host side obtains the IP address, operating system information and database information of the host by reading the database configuration file and executing the operating system query command, and uploads the obtained information to the vulnerability response and protection center, and forms a database asset information library Asset_DB{Asset_ip,OS_info,DB_info} in the vulnerability response and protection center, where the terminal / host IP address Asset_ip is the specific network IP address of the database terminal / host, and the operating system information OS_info includes the terminal operating system type and version information, such as ubuntu16.04, Ubuntu 18.04, Cenos7, Cenos8, Window XP, Window7, Window Server 2016, etc. The database information DB_info includes the database product type and version information, such as MySQL5.7, MySQL8.0, Oracle 18c, PostgreSQL 10, SQL Server 2016, Redis 6.0, etc.

[0058] In an example implementation, the process of generating the vulnerability information database includes: collecting basic vulnerability information, vulnerability traffic characteristics, and vulnerability reinforcement strategies of the target database by acquiring and / or subscribing to threat intelligence from various vulnerability information sharing platforms and software hosting platform open source communities;

[0059] The vulnerability information library is generated based on the basic vulnerability information, the vulnerability traffic characteristics and the vulnerability reinforcement strategy.

[0060] In this example implementation, the vulnerability information sharing platform includes the China National Vulnerability Database (CNVD), the China National Vulnerability Database of Information Security (CNNVD), the Ministry of Industry and Information Technology's network security threat and vulnerability information sharing platform (NVDB), the software hosting platform open source community includes the GitHub open source community, and threat intelligence subscription refers to obtaining vulnerability information by subscribing to messages with system threats. Collect and obtain basic information, traffic characteristics, and reinforcement strategies for database vulnerabilities, and after analysis, form a vulnerability information database corresponding to the database, which is stored and maintained by the vulnerability response and protection center. The vulnerability information database can be expressed as VULN_DB{vuln_id,vnln_description,ips_signature,agent_policy}, where vuln_id represents the unique identifier of the vulnerability, vnln_description represents the basic information of the vulnerability, ips_signature represents the traffic characteristics, agent_policy represents the terminal hardening policy, and the basic information of the vulnerability vnln_description includes but is not limited to the vulnerability name, vulnerability number, CVSS (Common Vulnerability Scoring System) hazard score, the name of the database affected by the vulnerability, the database version affected by the vulnerability, whether the vulnerability can be remotely exploited, etc. The traffic characteristics ips_signature are described using Suricate or Snort syntax rules, including protocol, source / destination, port, keywords, etc., as the rule characteristics of vulnerability network blocking. The specific blocking operation domain includes operations such as discarding data packets, sending reset RST packets, and blocking the attack source IP address. The terminal hardening policy agent_policy is implemented through hardening scripts according to the database system type and the operating system type of the terminal. It is divided into bash, bat, ps1, sql, etc. The specific operation domains include password policy enhancement, access control enhancement, user permission configuration, and other configuration updates.

[0061] In an example implementation, the step S120 of matching the database asset information library with a preset vulnerability information library with respect to database information includes:

[0062] Matching the database type and database version information in the database information with the database type affected by the vulnerability and the database version affected by the vulnerability;

[0063] If the database type and data version information in the database information are the same as the database type affected by the vulnerability and the database version affected by the vulnerability corresponding to any vulnerability in the vulnerability information library, it is determined that the match is successful.

[0064] In this example implementation, the vulnerability response protection center associates and matches the basic vulnerability information description in the vulnerability information library VULN_DB of the database with the database information DB_info. If it is found that the database type and version information affected by a vulnerability are consistent with the database information, it means that the match is successful, that is, the database needs to be protected by a vulnerability virtual patch, and the vulnerability virtual patch protection is started.

[0065] In an example implementation, the basic vulnerability information also includes whether the vulnerability can be remotely exploited, and the determining of the protection strategy based on the successfully matched database information in step S120 includes:

[0066] The protection strategy is determined based on the vulnerability reinforcement strategy corresponding to the successfully matched vulnerability and the basic information of the vulnerability.

[0067] In this example implementation, the protection strategies include traffic blocking, terminal hardening, and network blocking combined with terminal hardening, and the vulnerability response protection center makes intelligent judgments to select the protection strategies.

[0068] Exemplarily, the host information includes a host IP address, and the protection strategy is determined based on the vulnerability reinforcement strategy corresponding to the successfully matched vulnerability and the basic vulnerability information, including:

[0069] If a vulnerability hardening strategy exists for the successfully matched vulnerability and the vulnerability cannot be remotely exploited, the protection strategy is determined to be a terminal hardening mode;

[0070] If there is no vulnerability hardening strategy for the successfully matched vulnerability, and the vulnerability can be exploited remotely, the protection strategy is determined to be a network blocking mode;

[0071] If a vulnerability reinforcement strategy exists for the successfully matched vulnerability and the vulnerability can be exploited remotely, the protection strategy is determined to be a network blocking combined with terminal reinforcement mode.

[0072] The step S130 of sending the protection policy to the terminal Agent corresponding to the host information and / or to the database gateway of the target database includes:

[0073] If the protection strategy is a terminal hardening mode, a terminal protection instruction is generated based on the terminal hardening mode and the vulnerability hardening strategy corresponding to the successfully matched vulnerability, and the terminal protection instruction is sent to the terminal Agent corresponding to the host IP address;

[0074] If the protection strategy is a network blocking mode, a network blocking protection instruction is generated based on the network blocking mode, the vulnerability traffic characteristics corresponding to the successfully matched vulnerability, and the host IP address affected by the successfully matched vulnerability, and the network blocking protection instruction is sent to the database gateway of the target database;

[0075] If the protection strategy is a network blocking combined terminal reinforcement mode, a joint protection instruction is generated based on the network blocking combined terminal reinforcement mode, the vulnerability reinforcement strategy corresponding to the successfully matched vulnerability, the vulnerability traffic characteristics and the host IP address affected by the vulnerability, and the joint protection instruction is respectively sent to the terminal Agent corresponding to the host IP address and the database gateway of the target database.

[0076] In this example implementation, if the successfully matched vulnerability agent_policy exists, and the vulnerability in vnln_description cannot be exploited remotely, the terminal reinforcement mode is used alone to send terminal reinforcement protection instructions to the terminal agent, and the terminal agent implements the corresponding terminal reinforcement policy agent_policy. If the successfully matched vulnerability agent_policy does not exist, and the vulnerability in vnln_description can be exploited remotely, the network blocking mode is used alone to send network blocking protection instructions to the database gateway. The network blocking protection instructions may include network blocking implementation instructions and corresponding traffic features ips_signature, and the terminal IP address Asset_ip affected by the vulnerability. If the successfully matched vulnerability agent_policy exists, and the vulnerability in vnln_description can be exploited remotely, the network blocking and terminal reinforcement joint protection mode is used to jointly send implementation instructions to the database gateway and the terminal agent, as well as the corresponding reinforcement strategy agent_policy, the corresponding traffic features ips_signature, and the terminal IP address Asset_ip affected by the vulnerability. In addition, if the successfully matched vulnerability agent_policy does not exist and the vulnerability in vnln_description cannot be remotely exploited, the vulnerability risk is marked and no instructions are issued.

[0077] The protection strategy in this example can be determined by the protection strategy decision engine. The protection strategy decision engine can realize comprehensive correlation and comparative analysis of the massively tracked database vulnerability information library and the real-time acquired and maintained database asset information library, and intelligently judge and select the vulnerability virtual patch protection mode of traffic blocking, terminal reinforcement or a combination of the two, thus realizing the automation and intelligence of security protection.

[0078] In an example implementation, the database gateway is specifically used for:

[0079] By calling the intrusion prevention system function, the host IP address and vulnerability traffic characteristics in the protection instruction are configured as vulnerability traffic blocking rule conditions;

[0080] Perform vulnerability detection and blocking operations on network traffic whose target address is the host IP address affected by the vulnerability.

[0081] In this example implementation, if the database gateway receives an instruction from the vulnerability response protection center, it immediately downloads and analyzes the traffic feature ips_signature and the terminal IP address Asset_ip affected by the vulnerability, calls the database gateway IPS (Intrusion Prevention System) function, and configures Asset_ip and ips_signature as vulnerability traffic blocking rule conditions. Afterwards, the database gateway continues to use deep packet inspection (DPI), deep flow inspection (DFI) and other technologies to perform real-time vulnerability detection and blocking interception for the portion of traffic whose target address is the terminal IP address Asset_ip affected by the vulnerability. Once traffic matching the vulnerability feature is found, the operation in the blocking operation domain is immediately executed, such as discarding data packets or sending RST packets. By intelligently matching vulnerability information with database asset information, and using the database gateway to analyze part of the traffic for assets affected by the vulnerability, targeted protection for specific IP assets affected by the vulnerability can be achieved, greatly reducing the traffic objects that need to be detected and analyzed, and effectively saving network and computing resources.

[0082] Example 2

[0083] Based on the same inventive concept, the present invention also provides a database vulnerability protection method based on network blocking and terminal reinforcement, comprising the following steps:

[0084] The terminal agent obtains the host information of the host where it is located and the database information of the target database, and uploads the host information and the database information to the vulnerability response protection center;

[0085] Receive the protection strategy issued by the vulnerability response protection center, and perform terminal hardening operations on the host where the terminal Agent is located based on the protection strategy;

[0086] Among them, the protection strategy is that the vulnerability response protection center matches the database asset information library with the preset vulnerability information library for database information, and is determined based on the successfully matched database information; the database asset information library is formed by the vulnerability response protection center based on the host information and the database information.

[0087] In an example implementation, the host information includes operating system information, and the step S220 of performing a terminal hardening operation on the host where the terminal Agent is located based on the protection policy includes:

[0088] According to the operating system information and database information of the host where the terminal Agent is located, select and execute the reinforcement script corresponding to the protection strategy.

[0089] In this example implementation, if the terminal Agent receives a terminal reinforcement instruction from the vulnerability response protection center, it immediately downloads and analyzes the reinforcement script in the reinforcement policy agent_policy, and selects to execute the corresponding script according to the local operating system information OS_info and database information DB_info. For example, if the operating system information OS_info is Windows XP, Window7, etc., the vulnerability reinforcement script in bat or ps1 format is executed; if the operating system information OS_info is Cenos7, Cenos8, ubuntu16.04, etc., the vulnerability reinforcement script in bash format is executed; for the sql format reinforcement script of the vulnerability, the corresponding database type has been clarified, and there is no need to choose to execute it directly. Through the above host-side vulnerability reinforcement, operations in the terminal reinforcement operation domain are executed, such as password policy strengthening, access control strengthening, user authority configuration, etc. At least one of the above operations, the malicious exploitation conditions of the vulnerability are destroyed, and the vulnerability can be quickly protected without restarting the service or system.

[0090] For example, refer to Figure 2 , the implementation process of the database vulnerability protection method based on network blocking and terminal reinforcement of the present invention is described as follows:

[0091] (1) The terminal agent maintains database asset information;

[0092] The agent deployed on the database system terminal reads the database configuration file and executes the operating system query command to obtain the IP address, operating system and database type version of the terminal, and uploads it to the vulnerability response and protection center to form a database asset information library.

[0093] (2) The Vulnerability Response and Protection Center obtains and analyzes vulnerability information;

[0094] Basic information, traffic characteristics, and reinforcement strategies of database vulnerabilities are collected and obtained from the National Information Security Vulnerability Sharing Platform (CNVD), the National Information Security Vulnerability Database, the Network Security Threat and Vulnerability Information Sharing Platform (NVDB) of the Ministry of Industry and Information Technology, the GitHub open source community, and threat intelligence subscriptions. The database vulnerability information database VULN_DB{vuln_id, vnln_description, ips_signature, agent_policy} is analyzed and formed, and the Vulnerability Response and Protection Center is responsible for information storage, maintenance, and management.

[0095] The basic vulnerability information vnln_description shall include but is not limited to the vulnerability name, vulnerability number, CVSS hazard score, affected product name, affected product version, whether it can be remotely exploited, etc.

[0096] The traffic feature ips_signature is described using Suricate or Snort syntax rules, including protocol, source / destination, port, keywords, etc., as the rule feature for blocking the vulnerable network. The specific blocking operation domain includes discarding data packets, sending RST packets, blocking the attack source IP address, etc.

[0097] The hardening strategy agent_policy is implemented through hardening scripts according to the database system type and the operating system type of the terminal. It is divided into bash, bat, ps1, sql, etc. The specific operation domains include password policy enhancement, access control enhancement, user permission configuration, and other configuration updates.

[0098] (3) The vulnerability response and protection center makes intelligent protection strategy decisions;

[0099] The vulnerability response protection center compares the basic vulnerability information description in the database vulnerability information library VULN_DB with the operating system information OS_info and database information DB_info in the database asset information library Asset_DB. Once it is found that the product and version affected by a vulnerability are consistent with the database asset information, the vulnerability virtual patch protection is initiated.

[0100] The vulnerability virtual patch protection mode includes three modes: traffic blocking, terminal hardening, and a combination of the two. The vulnerability response protection center makes intelligent judgments and selections. The decision logic is as follows:

[0101] ① If the vulnerability agent_policy exists and the vulnerability in vnln_description cannot be exploited remotely, the terminal hardening mode is used alone to send implementation instructions and the corresponding hardening strategy agent_policy to the terminal agent.

[0102] ② If the vulnerability agent_policy does not exist and the vulnerability in vnln_description can be exploited remotely, the network blocking mode is used alone to send implementation instructions to the database gateway, as well as the corresponding traffic feature ips_signature and the terminal IP address Asset_ip affected by the vulnerability.

[0103] ③ If the vulnerability agent_policy exists and the vulnerability in vnln_description can be exploited remotely, a joint protection mode of network blocking and terminal reinforcement is adopted to jointly issue implementation instructions to the database gateway and terminal agent, as well as the corresponding reinforcement strategy agent_policy, the corresponding traffic feature ips_signature, and the terminal IP address Asset_ip affected by the vulnerability.

[0104] ④ If the vulnerability agent_policy does not exist and the vulnerability in vnln_description cannot be exploited remotely, the vulnerability risk is marked and no instructions are issued.

[0105] In the above decision-making process, if the decision result involves terminal reinforcement, implementation instructions and reinforcement strategies are sent to the terminal Agent. If the decision result involves network blocking, implementation instructions and traffic signature ips_signature and the terminal IP address Asset_ip affected by the vulnerability are sent to the database gateway.

[0106] (4) Rapid terminal reinforcement operations;

[0107] If the terminal agent receives the instruction from the vulnerability response protection center, it will immediately download and analyze the hardening script in the hardening policy agent_policy, and select and execute the corresponding script according to the local operating system information OS_info and database information DB_info to destroy the malicious exploitation conditions of the vulnerability.

[0108] ① If the operating system information OS_info is Windows XP, Window7, etc., execute the vulnerability reinforcement script in bat or ps1 format;

[0109] ② If the operating system information OS_info is Cenos7, Cenos8, ubuntu16.04, etc., execute the vulnerability hardening script in bash format;

[0110] ③ For the SQL format hardening script for a certain vulnerability, the corresponding database type has been clearly identified and can be executed directly without selection.

[0111] (5) Database gateway implements real-time network blocking;

[0112] If the database gateway receives instructions from the vulnerability response protection center, it will immediately download and analyze the traffic signature ips_signature and the terminal IP address Asset_ip affected by the vulnerability, call the database gateway IPS function, and configure Asset_ip and ips_signature as vulnerability traffic blocking rule conditions. After that, the database gateway continues to use deep packet inspection (DPI), deep flow inspection (DFI) and other technologies to perform real-time vulnerability detection and blocking for the traffic whose target address is the terminal IP address Asset_ip affected by the vulnerability. Once traffic matching the vulnerability signature is found, the operation in the blocking operation domain is immediately executed, such as dropping data packets or sending RST packets.

[0113] Following the above steps (1)-(5) in a continuous cycle, the vulnerability response protection center, database gateway, and terminal agent perform virtual patch protection on known and unknown database vulnerabilities, quickly reinforce terminals, detect abnormal vulnerability exploitation behaviors and attack results in real time, and implement comprehensive security monitoring and vulnerability response.

[0114] The present invention realizes the transformation of database security protection from a single network layer to a comprehensive protection combining network and terminal, and builds a deep defense system covering multiple attack stages; at the same time, the linkage between network blocking and terminal reinforcement can realize targeted protection of specific IP assets affected by vulnerabilities, which can greatly reduce the detection traffic objects and effectively save network and computing resources. The present invention provides a virtual patch method that can quickly respond to database vulnerability threats and provide instant protection without modifying the database code or structure. By combining network blocking and terminal reinforcement technology, comprehensive protection against database vulnerabilities is achieved.

[0115] Taking the Redis database as an example, the method of the present invention is applied to protect the unauthorized access vulnerability of the Redis database as an example to be described in detail, which specifically includes the following steps:

[0116] (1) Database asset information maintenance

[0117] Deploy the terminal agent on the Redis server. The agent obtains the following information by reading the redis.conf configuration file and executing system commands (such as ifconfig and uname -a):

[0118] Asset_ip: IP address of the Redis server.

[0119] OS_info: operating system type and version, such as Linux Ubuntu 18.04.

[0120] DB_info: Redis database version information, such as Redis 6.0.

[0121] Information upload: Upload the collected information to the vulnerability response and protection center to form Asset_DB.

[0122] (2) Vulnerability Information Acquisition and Analysis

[0123] Collect information about Redis unauthorized access vulnerabilities from platforms such as CNVD, NVDB, and GitHub. Organize the collected information into VULN_DB, which contains the following fields:

[0124] vuln_id: unique vulnerability identifier, such as CVE-2023-XXXX.

[0125] vnln_description: vulnerability description, including vulnerability name, CVSS score, affected products, etc.

[0126] ips_signature: Traffic signature, described in Suricate syntax, used to identify possible unauthorized access attempts to Redis. The signature is set to have the source address be any address on the internal network and the destination address be port 6379 (the default port for Redis) on the external network. The specific description is as follows:

[0127] alert tcp$HOME_NET any->$EXTERNAL_NET 6379(msg:"Potential RedisUnauthorized Access Detected"; flow:established; content: "|*|"; depth:1; nocase; sid:1000001; rev:1;)

[0128] agent_policy: hardening policy, including setting passwords, restricting IP access, etc.

[0129] (3) Intelligent protection strategy decision-making

[0130] The Vulnerability Response and Protection Center matches the vulnerability information in VULN_DB with the information in Asset_DB and finds that a Redis database with an IP address of 192.168.XX may have the vulnerability. Based on the decision logic, the joint protection mode is selected.

[0131] (4) Rapid terminal reinforcement implementation

[0132] The terminal agent receives the reinforcement instruction from the vulnerability response protection center. For the Linux system, execute the bash script to set Redis to use the authentication password to log in: config set requirepass newPassword; second, restrict IP access, edit the configuration file, and add bind 127.0.0.1.

[0133] (5) Real-time network blocking implementation

[0134] The database gateway receives instructions from the vulnerability response and protection center. According to the ips_signature, the traffic blocking rules are configured, and the traffic of the Redis database with the IP address of 192.168.XX is detected and analyzed, and the unauthorized access characteristics of Redis are monitored and blocked in real time.

[0135] (6) Continuous monitoring and response

[0136] The terminal agent and database gateway continuously monitor the traffic and status of the Redis server. Once unauthorized access attempts are found, blocking measures are immediately implemented and logs are recorded for analysis.

[0137] This embodiment effectively improves the protection effect of the database system against the Redis unauthorized access vulnerability. Through the fusion analysis and intelligent decision-making methods mentioned in the present invention, the virtual patch protection form of the vulnerability is clarified. The implementation of the agent reinforcement method significantly improves the security of the Redis server. The implementation of the database firewall and network blocking, on the basis of greatly saving the consumption of traffic analysis resources, also ensures the timely discovery and blocking of external vulnerability exploitation behaviors, and has a good protection effect.

[0138] The present invention uses dual protection mechanisms and dynamic virtual patch technology, and intelligent decision-making of protection modes based on multi-source information fusion to achieve rapid response and effective protection to database vulnerabilities. It has high adaptability, flexibility and efficiency, and enhances the defense capability against new attacks. An integrated protection strategy covering the network and terminal side is proposed, combining network blocking technology with terminal reinforcement technology to form an integrated database protection strategy, which can provide security protection at both the network level and the terminal level, integrating the advantages of the two methods and building a deep defense system covering multiple attack stages.

[0139] Example 3

[0140] Based on the same inventive concept, the present invention also provides a vulnerability response protection center, including:

[0141] A receiving module, used for receiving the host information of the host where the terminal Agent is located and the database information of the target database sent by the terminal Agent, and forming a database asset information library based on the host information and the database information; the terminal Agent is deployed on the host side of the target database;

[0142] An information matching module, used to match the database asset information library with a preset vulnerability information library for database information, and determine a protection strategy based on successfully matched database information;

[0143] A policy delivery module, used to send the protection policy to the terminal Agent corresponding to the host information and / or to the database gateway of the target database;

[0144] Among them, the protection strategy is used to instruct the terminal agent to perform terminal hardening operations on its own host based on the protection strategy, and / or, the protection strategy is used to instruct the database gateway to perform vulnerability detection and blocking operations on network traffic flowing into and out of the target database in real time based on the protection strategy.

[0145] In a possible implementation, the vulnerability response protection center further includes:

[0146] An information collection module is used to collect basic vulnerability information, vulnerability traffic characteristics and vulnerability reinforcement strategies of the target database by acquiring and / or subscribing to threat intelligence from various vulnerability information sharing platforms and software hosting platform open source communities;

[0147] The information base generation module is used to generate the vulnerability information base based on the basic information of the vulnerability, the vulnerability traffic characteristics and the vulnerability reinforcement strategy.

[0148] In a possible implementation manner, the information matching module is specifically used to:

[0149] The database type and database version information in the database information are matched with the database type affected by the vulnerability and the database version affected by the vulnerability. If the database type and database version information in the database information are the same as the database type affected by the vulnerability and the database version affected by the vulnerability corresponding to any vulnerability in the vulnerability information library, the match is determined to be successful.

[0150] In a possible implementation manner, the information matching module is specifically used to:

[0151] The protection strategy is determined based on the vulnerability reinforcement strategy corresponding to the successfully matched vulnerability and the basic information of the vulnerability.

[0152] In a possible implementation, the host information includes a host IP address, the basic vulnerability information also includes whether the vulnerability can be remotely exploited, and the information matching module is further used to:

[0153] If a vulnerability hardening strategy exists for the successfully matched vulnerability and the vulnerability cannot be remotely exploited, the protection strategy is determined to be a terminal hardening mode;

[0154] If there is no vulnerability hardening strategy for the successfully matched vulnerability, and the vulnerability can be exploited remotely, the protection strategy is determined to be a network blocking mode;

[0155] If a vulnerability reinforcement strategy exists for the successfully matched vulnerability and the vulnerability can be exploited remotely, the protection strategy is determined to be a network blocking combined with terminal reinforcement mode;

[0156] The policy delivery module is specifically used for:

[0157] For the terminal hardening mode, a terminal protection instruction is generated based on the terminal hardening mode and the vulnerability hardening strategy corresponding to the successfully matched vulnerability, and the terminal protection instruction is sent to the terminal Agent corresponding to the host IP address;

[0158] For the network blocking mode, based on the network blocking mode, the vulnerability traffic characteristics corresponding to the successfully matched vulnerability and the host IP address affected by the successfully matched vulnerability, a network blocking protection instruction is generated, and the network blocking protection instruction is sent to the database gateway of the target database;

[0159] For the network blocking joint terminal reinforcement mode, a joint protection instruction is generated based on the network blocking joint terminal reinforcement mode, the vulnerability reinforcement strategy corresponding to the successfully matched vulnerability, the vulnerability traffic characteristics and the host IP address affected by the vulnerability, and the joint protection instruction is respectively issued to the terminal Agent corresponding to the host IP address and the database gateway of the target database.

[0160] Example 4

[0161] Based on the same inventive concept, the present invention also provides a terminal Agent, including:

[0162] The acquisition module is used for the terminal agent to obtain the host information of the host where it is located and the database information of the target database, and upload the host information and the database information to the vulnerability response protection center;

[0163] The terminal reinforcement module is used to receive the protection strategy issued by the vulnerability response protection center, and perform the terminal reinforcement operation of the host where the terminal Agent is located based on the protection strategy;

[0164] Among them, the protection strategy is that the vulnerability response protection center matches the database asset information library with the preset vulnerability information library for database information, and is determined based on the successfully matched database information; the database asset information library is formed by the vulnerability response protection center based on the host information and the database information.

[0165] In a possible implementation manner, the terminal reinforcement module is specifically used for:

[0166] According to the operating system information and database information of the host where the terminal Agent is located, select and execute the reinforcement script corresponding to the protection strategy.

[0167] In a possible implementation, the terminal hardening operation includes at least one of password policy strengthening, access control strengthening, and user authority configuration.

[0168] Example 5

[0169] Based on the same inventive concept, the present invention also provides a database vulnerability protection system based on network blocking and terminal reinforcement, such as Figure 3 As shown, it includes: a terminal agent, a vulnerability response protection center and a database gateway deployed on the host side of the target database, and the terminal agent and the database gateway are respectively connected to the vulnerability response protection center for communication;

[0170] The terminal Agent is used to implement the method described in the above embodiment 2;

[0171] The vulnerability response protection center is used to implement the method described in the above embodiment 1;

[0172] The database gateway is used to perform vulnerability detection and blocking operations on the network traffic flowing into and out of the target database in real time based on the protection strategy sent by the vulnerability response protection center.

[0173] In a possible implementation manner, the database gateway is specifically used for:

[0174] By calling the intrusion prevention system function, the host IP address and vulnerability traffic characteristics in the protection strategy are configured as vulnerability traffic blocking rule conditions; and vulnerability detection and blocking operations are performed on the network traffic whose target address is the host IP address affected by the vulnerability.

[0175] In a possible implementation manner, the blocking operation includes: at least one of discarding a data packet, sending a reset RST data packet, and blocking an attack source IP address.

[0176] Example 6

[0177] like Figure 4As shown, the present invention also provides an electronic device, which may be a computer device, a single-chip device, an intelligent mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, the processor, and the transceiver component are connected via a bus; the memory may be used to store an execution program, and an exemplary execution program may include instructions; the processor is used to execute the instructions stored in the memory. The memory may also be used to store data, which may be called and / or modified when the instructions are executed.

[0178] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in a storage medium to implement corresponding method flows or corresponding functions, so as to implement the steps of a database vulnerability protection method based on network blocking and terminal reinforcement in the above-mentioned embodiment.

[0179] Example 7

[0180] Based on the same inventive concept, the present invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory), which is a memory device in an electronic device for storing programs and data. It can be understood that the storage medium here can include both built-in storage media in electronic devices and, of course, extended storage media supported by electronic devices. The storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by a processor are also stored in the storage space, and these instructions can be one or more execution programs (including program codes). It should be noted that the storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor loads and executes one or more instructions stored in the storage medium, which can implement the steps of a database vulnerability protection method based on network blocking and terminal reinforcement in the above embodiment.

[0181] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0182] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0183] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0184] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0185] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit its protection scope. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that after reading the present invention, those skilled in the art can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the application, but these changes, modifications or equivalent substitutions are all within the protection scope of the claims to be approved.

Claims

1. A database vulnerability protection method based on network blocking and terminal reinforcement, characterized in that: include: Receive host information of the host where the terminal Agent is located and database information of the target database, and form a database asset information library based on the host information and the database information; The terminal Agent is deployed on the host side of the target database; Matching the database asset information library with a preset vulnerability information library for database information, and determining a protection strategy based on the successfully matched database information; Sending the protection strategy to a terminal Agent corresponding to the host information and / or to a database gateway of the target database; Among them, the protection strategy is used to instruct the terminal agent to perform terminal hardening operations on its own host based on the protection strategy, and / or, the protection strategy is used to instruct the database gateway to perform vulnerability detection and blocking operations on network traffic flowing into and out of the target database in real time based on the protection strategy.

2. The method according to claim 1, characterized in that The generation process of the vulnerability information database includes: Collect basic vulnerability information, vulnerability traffic characteristics, and vulnerability reinforcement strategies of the target database by obtaining and / or subscribing to threat intelligence from various vulnerability information sharing platforms and software hosting platform open source communities; The vulnerability information library is generated based on the basic vulnerability information, the vulnerability traffic characteristics and the vulnerability reinforcement strategy.

3. The method according to claim 1, characterized in that The matching of the database asset information library with the preset vulnerability information library with respect to the database information includes: Matching the database type and database version information in the database information with the database type affected by the vulnerability and the database version affected by the vulnerability; If the database type and data version information in the database information are the same as the database type affected by the vulnerability and the database version affected by the vulnerability corresponding to any vulnerability in the vulnerability information library, it is determined that the match is successful.

4. The method according to claim 3, characterized in that The determining of the protection strategy based on the successfully matched database information includes: The protection strategy is determined based on the vulnerability reinforcement strategy corresponding to the successfully matched vulnerability and the basic information of the vulnerability.

5. The method according to claim 4, characterized in that The host information includes the host IP address, the basic vulnerability information also includes whether the vulnerability can be remotely exploited, and the vulnerability reinforcement strategy corresponding to the successfully matched vulnerability and the basic vulnerability information are determined to include: If a vulnerability hardening strategy exists for the successfully matched vulnerability and the vulnerability cannot be remotely exploited, the protection strategy is determined to be a terminal hardening mode; If there is no vulnerability hardening strategy for the successfully matched vulnerability, and the vulnerability can be exploited remotely, the protection strategy is determined to be a network blocking mode; If a vulnerability reinforcement strategy exists for the successfully matched vulnerability and the vulnerability can be exploited remotely, the protection strategy is determined to be a network blocking combined with terminal reinforcement mode.

6. The method according to claim 5, characterized in that The sending the protection strategy to the terminal Agent corresponding to the host information and / or to the database gateway of the target database includes: If the protection strategy is the terminal hardening mode, a terminal protection instruction is generated based on the terminal hardening mode and the vulnerability hardening strategy corresponding to the successfully matched vulnerability, and the terminal protection instruction is sent to the terminal Agent corresponding to the host IP address; If the protection strategy is the network blocking mode, a network blocking protection instruction is generated based on the network blocking mode, the vulnerability traffic characteristics corresponding to the successfully matched vulnerability, and the host IP address affected by the successfully matched vulnerability, and the network blocking protection instruction is sent to the database gateway of the target database; If the protection strategy is the network blocking combined terminal reinforcement mode, a joint protection instruction is generated based on the network blocking combined terminal reinforcement mode, the vulnerability reinforcement strategy corresponding to the successfully matched vulnerability, the vulnerability traffic characteristics and the host IP address affected by the vulnerability, and the joint protection instruction is respectively sent to the terminal Agent corresponding to the host IP address and the database gateway of the target database.

7. A database vulnerability protection method based on network blocking and terminal reinforcement, characterized in that: include: The terminal agent obtains the host information of the host where it is located and the database information of the target database, and uploads the host information and the database information to the vulnerability response protection center; Receive the protection strategy issued by the vulnerability response protection center, and perform terminal hardening operations on the host where the terminal Agent is located based on the protection strategy; Among them, the protection strategy is that the vulnerability response protection center matches the database asset information library with the preset vulnerability information library for database information, and is determined based on the successfully matched database information; the database asset information library is formed by the vulnerability response protection center based on the host information and the database information.

8. The method according to claim 7, characterized in that The terminal hardening operation of the host where the terminal Agent is located is performed based on the protection strategy, including: According to the operating system information and database information of the host where the terminal Agent is located, select and execute the reinforcement script corresponding to the protection strategy; The terminal hardening operation includes at least one of password policy strengthening, access control strengthening and user authority configuration.

9. A database vulnerability protection system based on network blocking and terminal reinforcement, characterized in that: include: A terminal agent, a vulnerability response protection center, and a database gateway deployed on the host side of the target database, wherein the terminal agent and the database gateway are respectively connected to the vulnerability response protection center for communication; The terminal Agent is used to implement the method described in any one of claims 6 to 8; The vulnerability response protection center is used to implement the method described in any one of claims 1 to 5; The database gateway is used to perform vulnerability detection and blocking operations on the network traffic flowing into and out of the target database in real time based on the protection strategy sent by the vulnerability response protection center.

10. The system according to claim 9, characterized in that The database gateway is specifically used for: By calling the intrusion prevention system function, the host IP address and vulnerability traffic characteristics in the protection strategy are configured as vulnerability traffic blocking rule conditions; And perform vulnerability detection and blocking operations on network traffic whose target address is the host IP address affected by the vulnerability; The blocking operation includes at least one of discarding a data packet, sending a reset RST data packet, and blocking an attack source IP address.

Images