Computer database security evaluation system and method

Abstract

The invention discloses a computer database security evaluation system and method. The system comprises a data acquisition module, an evaluation integration module, an evaluation scoring module, a user access simulation module and a report generation module. In combination with measures of user access behavior simulation and key leakage prevention, it is ensured that a key cannot be leaked in the evaluation process, and abnormity of permission configuration is effectively evaluated; by simulating user access behaviors of different roles and dynamically evaluating authority distribution of the database, it is ensured that each role in the database can only access resources needed by the role, authority abuse and excessive authorization are avoided, the authority problem in the database can be detected and evaluated in real time, and meanwhile, the user experience is improved. By establishing the test environment and establishing the distribution permission for the test personnel, the risk problem of key and data leakage possibly existing in database security evaluation can be prevented.

Description

Technical Field

[0001] This invention relates to the field of computer database technology, and in particular to a computer database security evaluation system and method. Background Technology

[0002] With the rapid development of information technology, databases have become the core platform for storing and managing data in organizations. As database applications become more widespread, database security issues are becoming increasingly prominent, especially in the context of emerging technologies such as cloud computing, big data, and artificial intelligence, where database security faces even greater challenges.

[0003] A key feature of databases is that data can be shared. However, data sharing inevitably brings security challenges. Therefore, data sharing in database systems is generally not set to be unconditional in order to ensure database security.

[0004] According to the search, Chinese patent CN114547198A discloses a dynamic evaluation method and device for distributed transaction databases, which proposes a technical solution to evaluate the performance of distributed transaction databases through dynamic evaluation.

[0005] Chinese patent CN115438244A discloses a method and apparatus for assessing database health. It points out that existing methods for assessing database health are limited by the experience of database administrators and are prone to errors in the assessment results.

[0006] Currently, traditional database security assessment methods mainly focus on static configuration checks and vulnerability scanning. The assessment often emphasizes known vulnerabilities and configuration errors, neglecting the dynamic risks in actual database operation. They lack monitoring and analysis of user access behavior, cannot fully simulate the real behavior of users with different roles, and lack dynamic evaluation of permission allocation in the database. Moreover, when conducting database security assessments, especially using real data from production environments, there is a risk of sensitive data exposure. If appropriate key management strategies and encryption protection measures are not adopted during database security assessments, encryption keys may be leaked, thereby threatening the security of database encryption. Therefore, there is an urgent need for a computer database security assessment system and method to solve the above problems. Summary of the Invention

[0007] The purpose of this invention is to address the deficiencies in the existing technology by proposing a computer database security evaluation system and method.

[0008] To achieve the above objectives, the present invention adopts the following technical solution:

[0009] A computer database security evaluation system includes a data acquisition module, an evaluation integration module, an evaluation scoring module, a user access simulation module, and a report generation module;

[0010] in:

[0011] The data acquisition module is used to connect to the database, collect the database data to be evaluated based on a set period, classify and preprocess the data, and send it to the corresponding module.

[0012] The evaluation integration module is used to integrate at least one evaluation module and corresponding evaluation rules to check and evaluate the database based on the data transmitted by the data acquisition module and the evaluation task.

[0013] The evaluation and scoring module is used to analyze the output data of each evaluation module based on the evaluation result data of the evaluation integration module, score the analysis results of each evaluation module, and generate and output the final evaluation result data.

[0014] The user access simulation module is used to generate user access behavior execution templates for different roles, and set corresponding behavior permissions for each role and user to automatically simulate user access behavior.

[0015] The report generation module is used to automatically generate security assessment reports and establish security assessment report templates. Depending on the location of the report output, the security assessment report is output based on the corresponding report template.

[0016] The user access simulation module connects to the data acquisition module and is used to obtain user role and permission data from the database.

[0017] The user access simulation module connects to the database through the data acquisition module to generate simulated user access behaviors and send requests (queries, updates, deletions, etc.) to the database to verify permission settings.

[0018] The user access simulation module connects to the scoring module and is used to pass simulation results (such as permission exceptions, unauthorized operations, etc.) to the scoring module to generate database permission security scores.

[0019] The user access simulation module connects to the report generation module, which is used to pass the simulation evaluation results and the abnormal behaviors found to the report generation module and output the final report.

[0020] Furthermore, in the data acquisition module, the data acquisition module uses SQL queries or directly connects to the database to be evaluated through a database management system (DBMS) to collect database data, user access behavior data, and key management configuration data.

[0021] The database data includes: database configuration information, access control information, and encryption configuration.

[0022] User role-related data includes user name, role permissions (such as permissions to access tables, permissions to execute SQL operations, etc.), and whether there are special permissions (such as system administrator permissions, data deletion permissions, etc.). User name and role permission information are obtained through SQL queries or extracted through database management tools and passed to the user access simulation module in a standardized format (such as JSON, XML).

[0023] Each user role is configured with a corresponding behavior template, which is transmitted in the form of a configuration file. The behavior template defines the typical operations and limitations that each role can perform.

[0024] Furthermore, in the evaluation integration module, the evaluation modules are: vulnerability scanning module, anomaly detection module, and encryption strength evaluation module;

[0025] The evaluation module and evaluation rules are integrated using a plug-in architecture. The type and number of integrations are user-defined. The evaluation module is used to obtain different evaluation result data.

[0026] Furthermore, the user access simulation module stores and records user access behavior data and related access logs, and sets access permissions. The user access simulation module automatically executes user access behavior by selecting stored users and roles, simulates database access behavior, and obtains access control exception data.

[0027] The roles include administrators, developers, testers, and regular users, with the following corresponding permissions:

[0028] Regular users: can only access their own data, and cannot perform deletion operations;

[0029] Administrator: Has access to all data and can perform any operation;

[0030] Testers: Appropriate operating permissions are assigned in advance by personnel based on evaluation requirements;

[0031] Developers can access data in the development environment, but cannot manipulate data in the production environment;

[0032] Furthermore, the user access simulation module simulates different database accesses based on roles and permissions, mimicking actual user access behavior and comparing it with the permission settings in the database to assess whether any abnormal access behavior exists. Specifically:

[0033] Simulate typical database access behaviors for each role, including performing query, insert, update, and delete operations;

[0034] In a simulated normal scenario, does the different roles engage in access behavior that exceeds their permissions or falls below their authorized scope?

[0035] In simulated abnormal scenarios, whether one or more different roles perform operations beyond their authorized scope, and assess whether there is abnormal access behavior.

[0036] Generate a detailed report, which includes simulated role behavior operation logs, access result records, discovered permission configuration issues, and evaluation result data;

[0037] During the execution of the user access simulation module, the module will automatically verify whether the user's access behavior complies with the role's permission settings. If there is any operation that exceeds the permission limit, it will be marked and recorded.

[0038] Furthermore, based on the abnormal access behavior evaluation results fed back by the user access simulation module, the report generation module provides permission configuration repair suggestions in the generated report, including over-authorization and permission puppetry, and suggests adjusting the least privilege and redefining role permissions;

[0039] The report output includes visualizations such as charts, heatmaps, and risk matrices to present the evaluation results. The report prioritizes remediation recommendations based on risk level and urgency of remediation.

[0040] Furthermore, the evaluation integration module also includes a key evaluation protection module, used to protect the key during security evaluation, specifically including:

[0041] The key management module is used to deploy a key management system (KMS) locally. It defines permissions for different roles through RBAC and ACL, so that only users with high privileges can access the keys.

[0042] The key separation module is used to use different keys for different applications, user roles, and data request services, and to ensure that they are isolated from each other and not shared.

[0043] The key protection module is used to set the key rotation cycle, determine the compatibility of the old and new keys during the transition period, and set up a revocation mechanism to revoke the key in a timely manner when it is leaked or no longer needed.

[0044] The penetration testing module is used to conduct key security testing. It assigns one or more roles to simulate attackers' attack methods to evaluate the security of key management and database.

[0045] According to another aspect of the present invention, a method for evaluating the security of a computer database is also provided.

[0046] A computer database security assessment method includes the following steps:

[0047] S1: Collect database data to be evaluated according to the set time period, classify it into the first set of data, and update it according to the time period;

[0048] Collect user access behavior data and define the access behavior of different roles, which are then classified as the second set of data;

[0049] The configuration data related to key management is obtained and categorized into the third set of data.

[0050] The acquired data will be organized and converted into a standardized format;

[0051] S2: By integrating and configuring the corresponding evaluation modules through a plug-in architecture, the first set of data is input into the system, and the system outputs the analysis results data of different evaluation modules;

[0052] Based on the second set of data, simulate user access behavior, perform access behavior anomaly detection, and output user access behavior evaluation results.

[0053] The system uses third-party data to conduct key security assessments, evaluating whether key leakage will occur during key management, storage, and use, and simulating key leakage scenarios to check whether the system can detect and respond to key leakage in a timely manner.

[0054] S3: Each assessment module generates scoring data based on its analysis results, outputs safety scoring data, and sets weights for the scoring data generated by different assessment modules;

[0055] S4: Determine the final database evaluation score based on the scoring data of each evaluation module, obtain the user access behavior evaluation results and key security evaluation results, and generate an evaluation report.

[0056] Furthermore, in step S2, before acquiring data for analysis and evaluation, data testing and prevention are performed. The specific steps are as follows:

[0057] Sensitive data in the database was anonymized before the evaluation was performed;

[0058] Set up a dynamic data masking module: This module is used to perform real-time masking of sensitive fields in the database during the evaluation process.

[0059] Use test data to replace production data: During the evaluation process, generate the same type of fake data and obfuscated datasets to replace the real data in the production environment;

[0060] Configure access permissions for tester roles based on different evaluation requirements. Tester roles can only access data related to their evaluation tasks.

[0061] Establish isolated testing environments, separating the production environment from the testing environment;

[0062] Perform audit logging and real-time monitoring to record all data access and modification operations. This can help detect and respond to any potential data breaches.

[0063] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0064] By combining user access behavior simulation and key leakage prevention measures, we can ensure that keys are not leaked during the evaluation process and effectively assess any anomalies in permission configurations.

[0065] By simulating user access behavior of different roles, the database permission allocation is dynamically evaluated to ensure that each role in the database can only access the resources it needs, avoiding permission abuse and over-authorization. It can also detect and evaluate permission issues in the database in real time. At the same time, by establishing a test environment and assigning permissions to testers, it can prevent the risk of key and data leakage that may exist during database security evaluation. Attached Figure Description

[0066] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof.

[0067] Figure 1 This is a flowchart illustrating the computer database security evaluation system in an embodiment of the present invention.

[0068] Figure 2 This is a flowchart illustrating the evaluation integration module in an embodiment of the present invention; Detailed Implementation

[0069] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0070] Reference Figure 1-2 The computer database security evaluation system includes a data acquisition module, an evaluation integration module, an evaluation scoring module, a user access simulation module, and a report generation module.

[0071] The data acquisition module is used to connect to the database, collect the database data to be evaluated based on a set period, classify and preprocess the data, and send it to the corresponding module.

[0072] The evaluation integration module is used to integrate at least one evaluation module and corresponding evaluation rules to check and evaluate the database based on the data transmitted by the data acquisition module and the evaluation task.

[0073] The evaluation and scoring module is used to analyze the output data of each evaluation module based on the evaluation result data of the evaluation integration module, score the analysis results of each evaluation module, and generate and output the final evaluation result data.

[0074] The user access simulation module is used to generate user access behavior execution templates for different roles, and set corresponding behavior permissions for each role and user to automatically simulate user access behavior.

[0075] The report generation module is used to automatically generate security assessment reports and establish security assessment report templates. Depending on the location of the report output, the security assessment report is output based on the corresponding report template.

[0076] The user access simulation module is used to generate user access behavior execution templates for different roles, and set corresponding behavior permissions for each role and user to automatically simulate user access behavior.

[0077] The report generation module is used to automatically generate security assessment reports and establish security assessment report templates. Depending on the location of the report output, it outputs the security assessment report based on the corresponding report template.

[0078] The user access simulation module connects to the data acquisition module and is used to obtain user role and permission data from the database.

[0079] The user access simulation module connects to the database through the data acquisition module to generate simulated user access behaviors and send requests (queries, updates, deletions, etc.) to the database to verify permission settings.

[0080] The user access simulation module connects to the scoring module and is used to pass simulation results (such as permission exceptions, unauthorized operations, etc.) to the scoring module to generate database permission security scores.

[0081] The user access simulation module connects to the report generation module, which is used to pass the simulation evaluation results and the abnormal behaviors found to the report generation module and output the final report.

[0082] Use existing automated testing tools to simulate user database operations, including Selenium and Apache JMeter.

[0083] In a specific embodiment of this application, the data acquisition module uses SQL queries or directly connects to the database to be evaluated through a database management system (DBMS) to collect database data, user access behavior data, and key management configuration data.

[0084] The database data includes: database configuration information, access control information, and encryption configuration.

[0085] User access behavior data and user role-related data include user name, role permissions (such as permissions to access tables, permissions to execute SQL operations, etc.), and whether there are special permissions (such as system administrator permissions, data deletion permissions, etc.). User name and role permission information are extracted through SQL queries or database management tools and passed to the user access simulation module in a standardized format (such as JSON, XML).

[0086] Each user role is configured with a corresponding behavior template, which is transmitted in the form of a configuration file. The behavior template defines the typical operations and limitations that each role can perform.

[0087] Key management configuration data includes key generation configuration data, key storage configuration data, key distribution configuration data, key usage configuration data, key destruction configuration data, and key backup and recovery configuration data.

[0088] In a specific embodiment of this application, the evaluation integration module is used to integrate at least one evaluation module and corresponding evaluation rules to check and evaluate the database based on the data transmitted by the data acquisition module and the evaluation task.

[0089] The evaluation module and evaluation rules are integrated using a plug-in architecture. The type and number of integrations are user-defined. The evaluation module is used to obtain different evaluation result data.

[0090] The evaluation modules are: vulnerability scanning module (V), anomaly detection module (A), and encryption strength evaluation module (E).

[0091] The vulnerability scanning module (V) is used to automatically detect known vulnerabilities in database systems via SQL injection or cross-site scripting attacks.

[0092] Scoring is based on the number and severity of detected vulnerabilities, with 5 points deducted for each low-risk vulnerability, 10 points for each medium-risk vulnerability, and 20 points for each high-risk vulnerability.

[0093] The score SV for the vulnerability scanning module (V) is:

[0094] SV = 100 - (5L + 10M + 20H)

[0095] Among them, 5L represents L low-risk vulnerabilities, 10M represents M medium-risk vulnerabilities, and 20H represents H high-risk vulnerabilities.

[0096] The anomaly detection module (A) is used to analyze the database access patterns and identify abnormal behaviors by different abnormal access behaviors.

[0097] Scoring is based on the number and type of detected abnormal behavior.

[0098] Each minor anomaly deducts 2 points, a moderate anomaly deducts 5 points, and a major anomaly deducts 10 points, for a total of 100 points.

[0099] Abnormal behaviors include:

[0100] Unauthorized access attempts: such as attempting to log in to the database but failing.

[0101] Abnormal data transmission: such as a large amount of data being transmitted at an abnormal time.

[0102] Unauthorized data manipulation: such as unauthorized deletion or modification of data.

[0103] Abnormal network traffic: such as access from unknown or suspicious IP addresses.

[0104] Database configuration error: such as incorrect permission settings.

[0105] Abuse of system resources: such as abnormally high CPU or memory usage.

[0106] Among them, system resource abuse, unauthorized access attempts, and abnormal data transmission behavior are judged as minor anomalies. A check is performed every 20 minutes. If no anomaly is detected, points are deducted within 2 hours and accumulated. Based on the number of anomalies and the total accumulated points, the judgment is changed to minor anomaly, medium anomaly, or major anomaly.

[0107] Illegal data operations, abnormal network traffic, and database configuration errors are classified as medium anomalies. These are detected every 10 minutes. If no anomaly is detected, points will be deducted within one hour and accumulated. Based on the number of anomalies and the total accumulated points, the classification will be changed to medium or major anomalies.

[0108] Anomaly detection scoring (SA) is as follows: minor anomalies deduct 2 points, moderate anomalies deduct 5 points, and major anomalies deduct 10 points, specifically:

[0109] SA = 100 - (2S + 5M + 10L)

[0110] Among them, 2S represents S minor anomalies, 5M represents M moderate anomalies, and 10L represents L major anomalies.

[0111] The encryption strength assessment module (E) is used to assess the security of the encryption keys used by the database;

[0112] Known attack analysis: This involves analyzing whether the current encryption method has been successfully attacked in the past and determining whether the current database encryption method has any publicly known weaknesses or vulnerabilities.

[0113] In a specific embodiment of this application, the evaluation module comprises: a vulnerability scanning module (V), an anomaly detection module (A), and an encryption strength evaluation module (E);

[0114] The weights for each evaluation module are set as follows: and and The rating for each module is S. V S A and S E The maximum score is 100 points.

[0115] The formula for calculating the final score (F) is:

[0116]

[0117] The security level of the database is determined based on the final score F and the set threshold. A total score of 0-50 is considered "insecure", 51-80 is considered "medium" and 81-100 is considered "secure".

[0118] Among them, the vulnerability scanning module (V) has a score weight of 0.4, the anomaly detection module (A) has a score weight of 0.3, and the encryption strength assessment module (E) has a score weight of 0.3.

[0119] To further explain, the process by which the encryption strength assessment module (E) assesses key security is as follows:

[0120] The key generation, key storage, key distribution, and key destruction processes are examined separately. The specific processes are as follows:

[0121] Check the strength and randomness of the key generation algorithm to ensure that the key is generated by a random or pseudo-random number generator and that the generation process is secure enough.

[0122] Check whether the key was distributed using a secure channel and protocol to ensure that the key is not intercepted or leaked during the distribution process;

[0123] Check whether the key has been overwritten or physically destroyed, and ensure that keys that are no longer in use are securely destroyed to prevent future leaks;

[0124] Check the key storage to ensure it is stored in a secure hardware security module and assess the security of the key storage.

[0125] If one of the processes is found to be abnormal, the key is evaluated as having strong security. For each additional abnormal check result, the security evaluation level is reduced by one, in the order of strong security, medium security, and weak security.

[0126] If an anomaly occurs in the key storage check process, it indicates improper key management; otherwise, the management is deemed satisfactory.

[0127] Using a weak security key will result in a deduction of 20 points, a medium security key will result in a deduction of 10 points, and a strong security key will result in no deduction; improper key management will result in a deduction of 10 points.

[0128] The encryption strength score (SE) is:

[0129] The security key level is E (weak-1, medium-2, strong-3), and the key management quality is K (good management-1, poor management-2).

[0130] SE = 100 - (E*20 + K*10).

[0131] In a specific embodiment of this application, the user access simulation module is used to generate user access behavior execution templates for different roles, and set corresponding behavior permissions for each role and user to automatically simulate user access behavior;

[0132] The specific steps for users to access the simulation module are as follows:

[0133] Select different roles and users to perform user access, store and record user and role access logs, and obtain access control exception data.

[0134] In this context, a role refers to the identity of the user accessing the service, and a user is categorized into a user account under a role.

[0135] Roles include administrators, developers, and regular users, with corresponding permissions as follows:

[0136] Regular users: can only access their own data, and cannot perform deletion operations.

[0137] Administrator: Has access to all data and can perform any operation.

[0138] Developers can access data in the development environment, but cannot manipulate data in the production environment.

[0139] The process for users to access the simulation module and perform different simulated database accesses is as follows:

[0140] Simulate actual user access behavior based on roles and their permissions, and compare it with the permission settings in the database to assess whether there are any permission issues. Specifically:

[0141] Simulate typical database access behaviors for each role, including performing query, insert, update, and delete operations;

[0142] In a simulated normal scenario, does the different roles engage in access behavior that exceeds their permissions or falls below their authorized scope?

[0143] For example, regular users cannot perform queries;

[0144] For example, a regular user might try to access a table with administrator privileges, or a developer might try to modify data in the production environment.

[0145] In simulated abnormal scenarios, we examine whether multiple different roles are performing operations beyond their authorized scope, and assess whether the permissions are abnormal.

[0146] Finally: Generate a detailed report, which includes simulated role behavior operation logs, access result records, discovered permission configuration issues, and evaluation result data;

[0147] Preferably, abnormal access behaviors include:

[0148] If a character performs an operation that exceeds its authorized scope in the behavioral simulation, it is evaluated as having abnormal permissions.

[0149] If a role accesses inappropriate data, performs inappropriate operations, or accesses specific data more than a set number of times within a given time period, it is considered to have abnormal permissions.

[0150] Conduct an audit of permission allocation to assess whether low-privilege roles have been over-allocated or whether high-privilege users can easily perform high-risk operations. If any of these situations occur, the permissions are assessed as abnormal.

[0151] Based on the anomaly, the report generation module provides permission configuration repair suggestions in the report, including over-authorization and permission puppetry, and suggests adjusting the least privilege and redefining role permissions.

[0152] During the execution of the user access simulation module, the module will automatically verify whether the user's access behavior complies with the role's permission settings. If there is any operation that exceeds the permission limit, it will be marked and recorded.

[0153] In a specific embodiment of this application, the report generation module is used to automatically generate a security assessment report and establish a security assessment report template. Depending on the location of the report output, the security assessment report is output based on the corresponding report template.

[0154] The report output includes visualizations such as charts, heatmaps, and risk matrices to present the evaluation results. The report prioritizes remediation recommendations based on risk level and urgency of remediation.

[0155] It should be further noted that the user access simulation module also automatically performs the following operations:

[0156] Generate user access behavior scripts: Write behavior scripts for each role to simulate typical operations and execute SQL queries and data updates through the scripts.

[0157] Database connection and query: Use database connection pools (such as JDBC, ODBC) to simulate connection behaviors of different roles and execute various SQL operations;

[0158] Permission simulation: In the test environment, simulate the permission allocation for different roles according to the database configuration, and verify the permission settings of the roles before each simulation operation;

[0159] Anomaly detection and analysis: Determine whether abnormal behavior has occurred by analyzing error messages (such as permission denied, erroneous query) or operation results returned by the database;

[0160] Logs and Audits: Automatically log simulated operations, record the behavior of each role in detail, and promptly detect anomalies and potential security issues.

[0161] It is easy to see from the above design that by simulating the access behavior of users with different roles, problems such as improper permission configuration or over-authorization (e.g., ordinary users having administrator privileges) can be effectively detected.

[0162] Verify by simulating behavior whether database roles follow the principle of least privilege, ensuring that each role can only access the data it actually needs;

[0163] By simulating the operation, it is possible to identify whether a user has exceeded their authority to access sensitive data or performed unauthorized operations.

[0164] By simulating user access behavior, we can help detect whether role permissions are set properly and avoid security risks caused by over-authorization.

[0165] By simulating the access behavior of different roles and comparing it with the actual permission configuration in the database, anomalies in permission allocation can be accurately identified, helping organizations strengthen least privilege control and avoid security risks such as over-authorization and permission abuse.

[0166] In a specific embodiment of this application, the evaluation integration module further includes a key evaluation protection module, used to protect the key during security evaluation, specifically including:

[0167] The key management module is used to deploy a key management system (KMS) locally. It defines the permissions of different roles through RBAC and ACL (access control list), so that only users with high privileges can access the keys.

[0168] Key separation module: Use different keys for different applications, user roles and data request services, and ensure that they are isolated from each other and not shared.

[0169] The key protection module is used to set the key rotation cycle, determine the compatibility of the old and new keys during the transition period, and set up a revocation mechanism to ensure timely revocation when the key is leaked or no longer needed.

[0170] The penetration testing module is used to conduct key security testing. It assigns one or more roles to simulate attackers' attack methods to evaluate the security of key management and database.

[0171] Another embodiment of the present invention provides a computer database security assessment method.

[0172] A computer database security assessment method includes the following steps:

[0173] S1: Collect database data to be evaluated according to the set time period, classify it into the first set of data, and update it according to the time period;

[0174] Collect user access behavior data (through database logs, application logs, and auditing systems, including login / logout time, query behavior, permission changes, data access, etc.) Define access behaviors for different roles and categorize them into the second set of data;

[0175] Obtain configuration data related to key management, including the key storage location, the encryption algorithm used, and whether KMS (Key Management System) is enabled. This data is categorized as the third set of data (ensuring that the key is stored in a dedicated key management system, rather than in a database or local file, to avoid plaintext storage).

[0176] The acquired data will be organized and converted into a standardized format;

[0177] The necessary configuration information is obtained through the database API. The first set of data includes the database configuration, log records, access control information, vulnerability scan results, and performance monitoring data, which serve as the input data source.

[0178] S2: By integrating and configuring the corresponding evaluation modules through a plug-in architecture, the first set of data is input into the system, and the system outputs the analysis results data of different evaluation modules;

[0179] User access behavior simulation is performed based on the second set of data, and user access behavior evaluation results are output. The "principle of least privilege" is used as the evaluation standard, and access behavior anomaly detection is performed to ensure that each role can only perform operations within its scope of responsibility.

[0180] The system uses third-party data to conduct key security assessments, evaluating whether key management, storage, and use will be compromised. It simulates key leakage scenarios to check whether the system can detect and respond to key leakage in a timely manner, ensuring that the key management system can promptly revoke old keys and enable new keys when keys are leaked, thus preventing further risks.

[0181] Anomaly detection specifically involves using behavioral analysis techniques to monitor for abnormal access patterns in the database, such as frequent access to sensitive tables or large-scale data export.

[0182] Compare user access behavior data with security policies to check for abnormal behavior, such as frequent queries, batch modifications, and bypassing encryption.

[0183] In one example, the abnormal behavior detection method is as follows:

[0184] Collect user access behavior tracking data (collect user behavior data on websites or applications, such as clicks, browsing, searches, etc.), and obtain user u behavior tracking data BT(u); quantify user access behavior tracking data:

[0185] User A's click count on the website: 100 times

[0186] User A's browsing time: 30 minutes

[0187] User A's page views: 5 pages

[0188] Analyze the server logs to extract data such as user access time, frequency, and path, and obtain user u log analysis data LA(u);

[0189] User A's access count: 5 times

[0190] User A's visit duration: 1 hour

[0191] User A's page redirect count: 10 times

[0192] Based on normal user access behavior patterns, identify behavior patterns that are significantly different from normal behavior patterns and obtain anomaly detection data NBM(u) for user u.

[0193] The aberration score abnorma(u) for user u is obtained as follows:

[0194] abnorma(u)=f(BT(u),LA(u),NBM(u))

[0195] Where u represents a user, and abnorma(u) represents the abnormal score of user u.

[0196] A threshold θ is set. When the abnormal score abnorma(u) > θ, it is judged as abnormal user access behavior. θ is the set threshold, which can be manually adjusted according to historical data and business needs.

[0197] S3: Each assessment module generates scoring data based on its analysis results, outputs safety scoring data, and sets weights for the scoring data generated by different assessment modules;

[0198] S4: Determine the final database evaluation score based on the scoring data of each evaluation module, obtain the user access behavior evaluation results and key security evaluation results, and generate an evaluation report.

[0199] Based on the above security assessment steps, it is possible not only to evaluate the security of database vulnerabilities, encryption, access control, etc., but also to combine user access behavior simulation and key leakage prevention measures to ensure that keys are not leaked during the assessment process and to effectively assess the anomalies in permission configuration.

[0200] In a specific embodiment of this application, the simulated user access behavior also includes a tester role, which is used to prevent test data or keys from being leaked due to the lack of appropriate protective measures during the database security evaluation process.

[0201] The specific preventative steps are as follows:

[0202] Sensitive data in the database is anonymized before the evaluation is performed. For example, sensitive data such as users' real names, ID card numbers, and bank account information are replaced with virtual data.

[0203] Set up a dynamic data anonymization module: This module is used to anonymize sensitive fields in the database (such as passwords, social security numbers, bank accounts, etc.) in real time during the evaluation process, ensuring that real data is not exposed during the evaluation process.

[0204] Use test data instead of production data: During the evaluation process, generate the same type of fake data and obfuscated datasets to replace the real data in the production environment. Ensure that the test environment does not use actual data containing sensitive personal information.

[0205] Depending on the evaluation requirements, configure access permissions for tester roles. Tester roles can only access data related to their evaluation tasks to avoid leaking unnecessary sensitive information. Management is carried out through roles and access control mechanisms (such as RBAC, role-based access control) to ensure that only authorized personnel can access sensitive data.

[0206] Use isolated test environments: Separate production and test environments: Ensure the test environment is completely isolated from the production environment to avoid accidental leakage of production data during testing. Any data used during testing should be limited to the test environment and strictly isolated to prevent cross-environment data leakage.

[0207] Auditing and Monitoring: During the evaluation process, enable audit logs and real-time monitoring to record all data access and modification operations. This can help detect and respond to any potential data breaches.

[0208] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A computer database security assessment system, characterized in that: include: The data acquisition module is used to connect to the database, collect the database data to be evaluated based on the set time period, classify and pre-process the data, and send it to the corresponding module; An evaluation integration module, used to integrate at least one evaluation module and corresponding evaluation rules according to the data and evaluation tasks transmitted by the data acquisition module, and to check and evaluate the database; The evaluation and scoring module is used to connect to the evaluation integration module, output the analysis result data and score of each evaluation module, and generate and output the final evaluation result data; User access simulation module, used to generate user access behavior execution templates for different roles and simulate user access behavior; The report generation module is used to integrate the evaluation data, standardize the data, automatically generate the security assessment report data, and output the security assessment report based on the report template.

2. The computer database security evaluation system according to claim 1, characterized in that: In the data collection module, the data collection module uses SQL query or directly connects to the database to be evaluated with the database management system to collect database data and user access behavior data; The database data includes: database configuration information, access control information and encryption configuration; User role-related data includes user name, role permissions, and whether there are special permissions. User name and role permission information is extracted through SQL query or through database management tools and passed to the user access simulation module in a standardized format.

3. The computer database security evaluation system according to claim 2, characterized in that: In the evaluation integration module, the evaluation modules are: vulnerability scanning module, anomaly detection module and encryption strength evaluation module; The evaluation module and evaluation rules are integrated using a plug-in architecture. The type and quantity of integration are designed by the user. The evaluation module is used to obtain different evaluation result data. Among them, the vulnerability scanning module is used to automatically detect known vulnerabilities in the database system through SQL injection or cross-site scripting attacks; The anomaly detection module is used to analyze the access pattern of the database and identify abnormal behaviors through different abnormal access behaviors; The encryption strength assessment module is used to assess the security of the encryption keys used by the database.

4. The computer database security evaluation system according to claim 3, characterized in that: The user access simulation module stores and records user access behavior data and related access logs, and sets access permissions. The user access simulation module automatically executes user access behaviors by selecting stored users and roles, simulates database access behaviors, and obtains access control exception data; The roles include administrator, developer, tester and common user. The tester role is assigned permissions by the administrator according to the evaluation tasks and can only access data related to its evaluation tasks.

5. The computer database security evaluation system according to claim 4, characterized in that: The user access simulation module performs different simulated accesses to the database to simulate actual user access behaviors based on roles and their permissions, and compares them with the permission settings in the database to evaluate whether there are abnormal access behaviors, specifically: Simulate typical database access behaviors of each role, including executing query, insert, update, and delete operations; Simulate normal scenarios to see whether different roles have access behaviors that exceed their permissions or access behaviors that are below their permissions. In a simulated abnormal scenario, check whether one or more different roles have performed operations beyond their authority and assess whether there are abnormal access behaviors. Generate detailed reports, including simulated role behavior operation logs, access result records, discovered permission configuration issues, and assessment result data; During the execution of the user access simulation module, the user access simulation module will automatically verify whether the user's access behavior complies with the role's permission settings. If there is any unauthorized operation, it will be marked and recorded.

6. The computer database security evaluation system according to claim 5, characterized in that: The report generation module provides permission configuration repair suggestions in the generated report based on the abnormal access behavior evaluation results fed back by the user access simulation module.

7. The computer database security evaluation system according to claim 6, characterized in that: The evaluation integration module also includes a key evaluation and protection module, which is used to protect the key during security evaluation, including: The key management module is used to deploy the key management system KMS locally. It defines the permissions of different roles through RBAC and ACL. Only users with high permissions can access the keys. The key separation module is used to use different keys according to different applications, user roles and data request services, and ensure that they are isolated from each other and not shared; The key protection module is used to set the key rotation period, determine the compatibility of the old and new keys during the rotation period, and set up a revocation mechanism to revoke the key in a timely manner when it is leaked or no longer needed; The penetration assessment module is used to perform key security testing. It specifies one or more roles to simulate the attacker's attack methods to evaluate the security of key management and database.

8. A computer database security assessment method, according to the computer database security assessment system described in any one of requirements 1-7, characterized in that: The following steps are involved: S1: Collect the database data to be evaluated according to a set time period, classify it into a first set of data, and update it according to the time period; Collect user access behavior data and define access behaviors of different roles, which are classified into the second set of data; Acquire configuration data related to key management, classified as the third set of data; Organize the acquired data and convert it into a standardized format; S2: Integrate and configure corresponding evaluation modules through the plug-in architecture, input the first set of data into the system, and the system outputs analysis result data of different evaluation modules; Perform user access behavior simulation based on the second set of data, perform access behavior anomaly detection, and output user access behavior evaluation results; The system uses the third set of data to conduct key security assessments to assess whether key leakage will occur during key management, storage, and use, and simulate key leakage scenarios to check whether the system can detect and respond to key leakage in a timely manner; S3: Each evaluation module generates scoring data based on its analysis result data, outputs security scoring data, and sets weights for the scoring data generated by different evaluation modules; S4: Determine the final database evaluation score based on the scoring data of each evaluation module, obtain the user access behavior evaluation results and key security evaluation results, and generate an evaluation report.

9. The computer database security evaluation method according to claim 1, characterized in that: In step S2, before obtaining data for analysis and evaluation, data testing prevention is performed. The specific steps are: Set up a dynamic data desensitization module to perform real-time desensitization on sensitive data in the database before executing the evaluation, and generate new production environment data for testing; Establish an isolated test environment to separate the production environment from the test environment; Generate the same type of fake data and obfuscated datasets in the test environment instead of production environment data; Configure access rights for tester roles based on different evaluation requirements. Testers can only access part of the production environment data related to their evaluation tasks in the test environment. Record all data access and modification operations, perform audit logs and real-time monitoring.

Images