Database security detection method and system for password protection

Abstract

The invention provides a database security detection method and system for password protection, and relates to the technical field of password detection and the technical field of data security. Technical data adopted by a database are collected, and data stream security testing, log record detection and password update detection are executed respectively; when the test or the detection is not passed, outputting an alarm and corresponding unsafe information; wherein the data stream security test comprises security authentication security detection, communication security detection, data storage and reading security detection, data label security detection and password detection; the method is specially used for security detection of database protection based on the password technology, and each security link of the database is deeply integrated, so that the blank of password protection mechanism detection in the existing database security protection technology is filled through the detection; the reliable security detection method and detection system are provided for a data system with high security requirements, and compared with the existing password test, the reliable security detection method and detection system have higher security proving capability and can be expanded to other systems which use password protection to carry out unified management and use on data.

Description

Technical Field

[0001] The present invention relates to the technical field of password detection and data security, and in particular to a method and system for detecting the security of a password-protected database. Background Art

[0002] With the development of information technology, there are more and more ways to uniformly manage and use data, such as databases, and new forms are constantly being developed, and data security issues are becoming increasingly prominent.

[0003] Traditional security measures mainly focus on access control, data encryption, and audit monitoring, and the corresponding security detection mainly includes weak password detection and password reuse detection. Currently, there is no detection method for the security of password protection, and it cannot effectively prove that the database security protection measures can cope with existing security threats.

[0004] Common weak password detection and password reuse detection actually refer to weak password detection and password reuse detection. The strength of the password cannot truly reflect the security level of data management and use.

[0005] Therefore, it is necessary to provide a database security detection method and system for password protection to solve the technical problem that the strength of passwords cannot truly reflect the security of data management and use. Summary of the invention

[0006] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a security detection method and system for a password-protected database. The present invention is specifically aimed at data management and usage security detection based on cryptographic technology protection. Through this detection, a data management and usage security detection technology is formed, which has better security proof capabilities than existing password tests.

[0007] To achieve the above purpose, the present application proposes a security detection method for a password-protected database, which is applied to the database and includes the following steps: Collect technical information used by the database, including functional information, cryptographic algorithm information and database product information; Determine the data flow of the business and the data flow of security-related information based on the functional information and product information, run the database based on the data flow to determine the business function and security function, perform data flow security testing, log record detection and password update detection respectively, and output warnings and corresponding unsafe information when the test or detection fails; Among them, the data flow security test includes security authentication security detection, communication security detection, data storage and reading security detection, data tag security detection and password detection.

[0008] As a further solution, before performing the security authentication security test: Collect functional data of the subjects and verify roles; Prepare functional test task lists, test task data and run database functions according to role and function information; Among them, the functions include at least reading, copying, modifying, sending, deleting, backing up, restoring and updating.

[0009] As a further solution, the security authentication and security testing is performed through the following steps: Check whether there is a security authentication mechanism for each role login; if there is no security authentication mechanism, output a warning; Check whether the security authentication mechanism uses password technology; if not, output a warning; Among them, passwords do not belong to the security authentication mechanism; According to the role's functional data, perform at least one operation that exceeds the authority; if the operation is successful, output a warning; Check whether the permission division is protected by password technology to prevent tampering; if password technology is not used, output a warning.

[0010] As a further solution, the communication security detection is performed through the following steps: Capture data from the security authentication and communication stages, and identify whether the transmitted data is encrypted data; if it is not encrypted data, output a warning; Capture data from security authentication and communication links, and read data integrity protection mechanisms; If there is no integrity protection mechanism, a warning is output; If the integrity protection mechanism is not based on a symmetric cryptographic algorithm, a message authentication code mechanism based on a cryptographic hash algorithm, or a digital signature mechanism based on a public key cryptographic algorithm, a warning is output; Check whether the communication protocol has anti-replay and anti-man-in-the-middle attack functions; if anti-replay and anti-man-in-the-middle attack cannot be achieved, a warning is output.

[0011] As a further solution, the data storage and reading security detection is performed through the following steps: Determine whether the object under inspection has a mechanism for identifying important data; if not, output a warning; In the case where there is no mechanism for identifying important data, the data storage method is read; if it is plain text, a warning is output; In the case where there is a mechanism for identifying important data, at least a group of non-important data is randomly read; if the data read is important data, a warning is output; Read the data storage method; if the important data is in plain text, a warning is output; Read data integrity protection mechanism; among them, If there is no integrity protection mechanism, a warning is output; If the integrity protection mechanism is not based on a symmetric cryptographic algorithm, a message authentication code mechanism based on a cryptographic hash algorithm, or a digital signature mechanism based on a public key cryptographic algorithm, a warning is output; Check whether the system is capable of performing targeted encryption operations based on the encryption protection requirements for important data. If the specified cryptographic algorithm cannot be selected to encrypt a specific row or column of the database, a warning is output.

[0012] As a further solution, the data tag security detection is performed through the following steps: Check whether the data tag of the object under inspection is protected by cryptographic technology; If there is no integrity protection, a warning is output; If the integrity protection mechanism is not based on a symmetric cryptographic algorithm, a message authentication code mechanism based on a cryptographic hash algorithm, or a digital signature mechanism based on a public key cryptographic algorithm, a warning is output.

[0013] As a further solution, the cryptographic detection performs multiple tests based on the cryptographic algorithm information and database product information; including cryptographic algorithm detection, key management detection, cryptographic protocol detection, random number detection and cryptographic compliance detection.

[0014] As a further solution, the logging detection is performed by the following steps: Detect whether the object under inspection has a log recording function; if not, output a warning; Check whether the log records can correctly and completely record normal and abnormal logs; if not, output a warning; Check whether the log record is integrity protected by cryptographic technology; if not, output a warning; The log record is tampered with and then integrity checked; if this can be done, a warning is output.

[0015] As a further solution, the password update detection is performed through the following steps: Based on the cryptographic algorithm data, determine whether the inspected object can switch to new cryptographic products, technologies and services without interruption; if not, output a warning; Determine the interruption time according to business needs; Determine whether the object under inspection can complete the update within the allowed interruption time; if not, output a warning.

[0016] In another aspect, the present invention provides a security detection system for a password-protected database, using a security detection method for a password-protected database as described in any one of the above items, comprising: The data collection module is used to collect technical data used in the database; A data flow security test module, used to execute data flow security test steps; A log record detection module, used to perform a log record detection step; A password update detection module, used to perform a password update detection step; The output warning module is used to output warnings and corresponding unsafe information.

[0017] Compared with the related art, the security detection method and system for password-protected database provided by the present invention have the following advantages: The present invention is specifically aimed at database security detection based on cryptographic protection, and is deeply integrated into various security links of the system. Through this detection, the gap in password protection mechanism detection in existing database security protection technology is filled, and a reliable security detection method and detection system are provided for data systems with high security requirements. Compared with existing password tests, it has better security proof capabilities and can be extended to other systems that use password protection to uniformly manage and use data. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0020] Figure 1 A schematic diagram of the steps of a security detection method for a password-protected database provided by the present invention; Figure 2 A schematic diagram of the structure of a security detection system for a password-protected database provided by the present invention.

[0021] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0023] See also Figure 1 The embodiment of the present application provides a security detection method for a password-protected database, which is applied to the database and includes the following steps: Collect technical information used by the database, including functional information, cryptographic algorithm information and database product information; Determine the data flow of the business and the data flow of security-related information based on the functional information and product information, run the database based on the data flow to determine the business function and security function, perform data flow security testing, log record detection and password update detection respectively, and output warnings and corresponding unsafe information when the test or detection fails; Among them, the data flow security test includes security authentication security detection, communication security detection, data storage and reading security detection, data tag security detection and password detection.

[0024] It should be noted that the database mentioned in this embodiment specifically refers to databases, data warehouses, data lakes and other systems that can uniformly manage, read, and use data; collect technical information used by the database, especially functional information related to data flows, as well as the ability to prevent network attacks and the ability to prevent data security issues.

[0025] Specifically, before performing the security authentication and security testing: Collect functional data of the subjects and verify roles; Prepare functional test task lists, test task data and run database functions according to role and function information; Among them, the functions include at least reading, copying, modifying, sending, deleting, backing up, restoring and updating.

[0026] Security authentication security testing mainly focuses on security testing at different levels of the security authentication mechanism, including: Check whether there is a security authentication mechanism for each role login; if there is no security authentication mechanism, output a warning; Check whether the security authentication mechanism uses password technology; if not, output a warning; Among them, passwords do not belong to the security authentication mechanism; According to the role's functional data, perform at least one operation that exceeds the authority; if the operation is successful, output a warning; Check whether the permission division is protected by password technology to prevent tampering; if password technology is not used, output a warning.

[0027] Communication security testing is aimed at the security authentication and communication links, and determines whether there are communication vulnerabilities through the following steps: Capture data from the security authentication and communication stages, and identify whether the transmitted data is encrypted data; if it is not encrypted data, output a warning; Among them, the communication links include administrator and database, user and database, application and database, database and database, database server and database, operating system and database.

[0028] Capture data from security authentication and communication links, and read data integrity protection mechanisms; If there is no integrity protection mechanism, a warning is output; If the integrity protection mechanism is not based on a symmetric cryptographic algorithm, a message authentication code mechanism based on a cryptographic hash algorithm, or a digital signature mechanism based on a public key cryptographic algorithm, a warning is output; Check whether the communication protocol has anti-replay and anti-man-in-the-middle attack functions; if anti-replay and anti-man-in-the-middle attack cannot be achieved, a warning is output.

[0029] Data storage and reading security detection is carried out through the following steps: Determine whether the object under inspection has a mechanism for identifying important data; if not, output a warning; In the case where there is no mechanism for identifying important data, the data storage method is read; if it is plain text, a warning is output; In the case where there is a mechanism for identifying important data, at least a group of non-important data is randomly read; if the data read is important data, a warning is output; Read the data storage method; if the important data is in plain text, a warning is output; Read data integrity protection mechanism; among them, If there is no integrity protection mechanism, a warning is output; If the integrity protection mechanism is not based on a symmetric cryptographic algorithm, a message authentication code mechanism based on a cryptographic hash algorithm, or a digital signature mechanism based on a public key cryptographic algorithm, a warning is output; Check whether the system is capable of performing targeted encryption operations based on the encryption protection requirements for important data. If the specified cryptographic algorithm cannot be selected to encrypt a specific row or column of the database, a warning is output.

[0030] Data label security testing is carried out through the following steps: Check whether the data tag of the object under inspection is protected by cryptographic technology; If there is no integrity protection, a warning is output; If the integrity protection mechanism is not based on a symmetric cryptographic algorithm, a message authentication code mechanism based on a cryptographic hash algorithm, or a digital signature mechanism based on a public key cryptographic algorithm, a warning is output.

[0031] Cryptographic testing conducts multiple tests based on cryptographic algorithm information and database product information; including cryptographic algorithm testing, key management testing, cryptographic protocol testing, random number testing and cryptographic compliance testing.

[0032] In a specific embodiment, the cryptographic algorithm detection is performed by the following steps: According to the cryptographic algorithm data and the cryptographic information obtained in the above steps, symmetric cryptographic algorithms, asymmetric cryptographic algorithms and cryptographic hash algorithms are identified; if any of the above algorithms is missing, a warning is output.

[0033] Identify supported symmetric cryptographic algorithms and supported symmetric cryptographic algorithm modes; among them, If not, a warning is output; If a symmetric cryptographic algorithm is available, substitute the supported cryptographic algorithm and encrypted sample data of various modes for encryption and decryption calculations; If this cannot be done correctly, an error is output.

[0034] Identify the supported asymmetric cryptographic algorithms and the methods used; where, If not available, a warning is output.

[0035] If an asymmetric cryptographic algorithm is available, substitute the sample data for encryption, decryption, and signature verification for calculation; If this cannot be done correctly, an error is output.

[0036] Identify the supported hash cryptographic algorithms. If a hash cryptographic algorithm is available, substitute the sample data for calculating the hash value for operation; if it cannot be implemented correctly, output an error.

[0037] According to the database product information, identify whether the database supports insecure cryptographic algorithms; if supported, output an error.

[0038] Unsafe cryptographic algorithms include MD5, DES, and self-developed algorithms that have not been safety-verified, and they are updated based on public information.

[0039] Identify whether the salt value used is randomly generated; if it is not a random salt value, an error is output.

[0040] Identify whether the salt value used by the database is unique; if the salt value is reused, an error warning will be issued.

[0041] Identify whether the salt length used by the database at least matches the corresponding algorithm; if the salt length does not meet the standard, an error is output; Check whether the cryptographic algorithm seamless switching function is supported. If the cryptographic algorithm must be changed after shutdown and restart, an alarm will be output.

[0042] In a specific embodiment, the cryptographic protocol detection is performed by the following steps: According to the cryptographic algorithm information and the data packets obtained in the communication link, the type of cryptographic protocol used is parsed and analyzed; if it does not belong to the standardized SSL, TLCP, IPSec, or SSH protocol, a warning is output.

[0043] For non-standardized SSL, TLCP, IPSec, and SSH protocols, the packet data is analyzed; if the parameters involved in key calculation, the negotiated keys for data encryption and integrity protection for this communication, and plain text for test task data appear, a warning is output.

[0044] In a specific embodiment, random number detection is performed by the following steps: According to the cryptographic algorithm data, sort out the random numbers used for cryptographic functions and identify the random source generator. If the random source generator is missing, output a warning.

[0045] Collect no less than 1000 groups of 10^6-bit random numbers, and test the randomness and significance level of the collected random numbers. If the randomness or significance level does not meet the preset results, an error is output.

[0046] In a specific embodiment, the key management detection is performed by the following steps: According to the cryptographic algorithm information, the key type used by the database is identified; if there is no key, an alarm is output.

[0047] Detect whether the random numbers used in the generation of private keys and symmetric keys are generated by a random source generator that can pass the random number detection; if not, output an error; Check whether the private key of the symmetric key and asymmetric key pair can be directly read in plain text; if the key ciphertext can be directly read, an error is output.

[0048] Checks for zeroing of a specified key; if only the specified key cannot be zeroed, an error is output.

[0049] Check whether the key can be accessed, used, and tampered by unauthorized access roles; if the key can be accessed, used, and tampered by unauthorized access roles, an error is output.

[0050] Based on the cryptographic algorithm data, determine whether different types of keys have only one key purpose; if there is no purpose or there are two or more purposes, output an error.

[0051] According to the cryptographic algorithm data, the long-term stored keys are identified and whether the long-term stored keys have backup and recovery functions is detected; if there is no backup and recovery, an alarm is output.

[0052] Perform a key backup operation to detect whether the backup file is stored outside the product in ciphertext. If it is stored in plaintext or still stored inside the product, an error is output.

[0053] A key recovery operation is performed to detect whether the backup file can be correctly restored to the database product; if not, an error is output.

[0054] Checks whether the database product key can be destroyed in time after use in the memory. If the key in the memory cannot be destroyed immediately, an alarm is output.

[0055] Check whether the key can be updated. If the key cannot be updated, output an error. Check whether the key can be updated regularly. If it cannot be updated regularly, output an alarm.

[0056] Check whether the system has the ability to resist time side channel attacks; if not, output an error.

[0057] Check whether the system has the capability to resist power consumption side channel attacks; if not, output an error.

[0058] Check whether the system is able to resist false information side channel attacks; if not, output an error.

[0059] In a specific embodiment, password compliance detection is performed by the following steps: Read the compliance materials of cryptographic products or cryptographic services that provide the above cryptographic functions. Cryptographic functions include encryption and decryption, message authentication code calculation, signature verification, key management, etc. If the compliance materials are not available, a warning is output.

[0060] Identify the above cryptographic algorithms and cryptographic protocols; if they are not commercial cryptographic algorithms and protocols, output a warning. Commercial cryptographic algorithms include SM2, SM3, SM4, SM9, IPSec, SSL, etc.

[0061] Logging detection is performed through the following steps: Detect whether the object under inspection has a log recording function; if not, output a warning; Check whether the log records can correctly and completely record normal and abnormal logs; if not, output a warning; Check whether the log record is integrity protected by cryptographic technology; if not, output a warning; The log record is tampered with and then integrity checked; if this can be done, a warning is output.

[0062] As a further solution, the password update detection is performed through the following steps: Based on the cryptographic algorithm data, determine whether the inspected object can switch to new cryptographic products, technologies and services without interruption; if not, output a warning; Determine the interruption time according to business needs; Determine whether the object under inspection can complete the update within the allowed interruption time; if not, output a warning.

[0063] See also Figure 2 The present invention also provides a security detection system for a password-protected database, using a security detection method for a password-protected database as described in any one of the above items, comprising: The data collection module is used to collect technical data used in the database; A data flow security test module, used to execute data flow security test steps; A log record detection module, used to perform a log record detection step; A password update detection module, used to perform a password update detection step; The output warning module is used to output warnings and corresponding unsafe information.

[0064] The above are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect application in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A database security detection method for password protection, applied to a database, characterized in that: The steps include: Collect technical information used by the database, including functional information, cryptographic algorithm information and database product information; Determine the data flow of the business and the data flow of security-related information based on the functional information and product information, run the database based on the data flow to determine the business function and security function, perform data flow security testing, log record detection and password update detection, and output warnings and corresponding unsafe information when the test or detection fails; Among them, the data flow security test includes security authentication security detection, communication security detection, data storage and reading security detection, data tag security detection and password detection.

2. A method for detecting password-protected database security according to claim 1, characterized in that: Before performing the security authentication safety test: Collect functional data of the subjects and verify roles; Prepare functional test task lists, test task data and run database functions according to role and function information; Among them, the functions include at least reading, copying, modifying, sending, deleting, backing up, restoring and updating.

3. A method for detecting password-protected database security according to claim 2, characterized in that: The security authentication and safety testing is performed through the following steps: Check whether there is a security authentication mechanism for each role login; if there is no security authentication mechanism, output a warning; Check whether the security authentication mechanism uses cryptographic technology; If no cryptographic technology is used, a warning is output; Among them, passwords do not belong to the security authentication mechanism; According to the role's functional data, perform at least one operation that exceeds the authority; if the operation is successful, output a warning; Check whether the permission division is protected by password technology to prevent tampering; if password technology is not used, output a warning.

4. A method for detecting password-protected database security according to claim 1, characterized in that: The communication security detection is performed through the following steps: Capture data from the security authentication and communication stages, and identify whether the transmitted data is encrypted data; if it is not encrypted data, output a warning; Capture data from security authentication and communication links, and read data integrity protection mechanisms; If there is no integrity protection mechanism, a warning is output; If the integrity protection mechanism is not based on a symmetric cryptographic algorithm, a message authentication code mechanism based on a cryptographic hash algorithm, or a digital signature mechanism based on a public key cryptographic algorithm, a warning is output; Check whether the communication protocol has anti-replay and anti-man-in-the-middle attack functions; if anti-replay and anti-man-in-the-middle attack cannot be achieved, a warning is output.

5. A method for detecting password-protected database security according to claim 1, characterized in that: The data storage and reading safety detection is performed through the following steps: Determine whether the object under inspection has a mechanism for identifying important data; if not, output a warning; In the case where there is no mechanism for identifying important data, the data storage method is read; if it is plain text, a warning is output; In the case where there is a mechanism for identifying important data, at least a group of non-important data is randomly read; if the data read is important data, a warning is output; Read the data storage method; if the important data is in plain text, a warning is output; Read data integrity protection mechanism; among them, If there is no integrity protection mechanism, a warning is output; If the integrity protection mechanism is not based on a symmetric cryptographic algorithm, a message authentication code mechanism based on a cryptographic hash algorithm, or a digital signature mechanism based on a public key cryptographic algorithm, a warning is output; Check whether the system is capable of performing targeted encryption operations based on the encryption protection requirements for important data. If the specified cryptographic algorithm cannot be selected to encrypt a specific row or column of the database, a warning is output.

6. A method for detecting password-protected database security according to claim 1, characterized in that: The data tag security detection is performed through the following steps: Check whether the data tag of the object under inspection is protected by cryptographic technology; If there is no integrity protection, a warning is output; If the integrity protection mechanism is not based on a symmetric cryptographic algorithm, a message authentication code mechanism based on a cryptographic hash algorithm, or a digital signature mechanism based on a public key cryptographic algorithm, a warning is output.

7. A method for detecting password-protected database security according to claim 1, characterized in that: The cryptographic detection performs multiple tests based on cryptographic algorithm information and database product information; including cryptographic algorithm detection, key management detection, cryptographic protocol detection, random number detection and cryptographic compliance detection.

8. A method for detecting password-protected database security according to claim 1, characterized in that: The logging detection is performed through the following steps: Detect whether the object under inspection has a log recording function; if not, output a warning; Check whether the log records can correctly and completely record normal and abnormal logs; if not, output a warning; Check whether the log record is integrity protected by cryptographic technology; if not, output a warning; The log record is tampered with and then integrity checked; if this can be done, a warning is output.

9. A method for detecting password-protected database security according to claim 1, characterized in that: The password update detection is performed through the following steps: Based on the cryptographic algorithm data, determine whether the inspected object can switch to new cryptographic products, technologies and services without interruption; if not, output a warning; Determine the interruption time according to business needs; Determine whether the object under inspection can complete the update within the allowed interruption time; if not, output a warning.

10. A database security detection system for password protection, using a database security detection method for password protection as claimed in any one of claims 1 to 9, characterized in that: include: The data collection module is used to collect technical data used in the database; A data flow security test module, used to execute data flow security test steps; A log record detection module, used to perform a log record detection step; A password update detection module, used to perform a password update detection step; The output warning module is used to output warnings and corresponding unsafe information.

Images