Database data management method, system and computer device

Abstract

The application relates to the technical field of databases, and discloses a database data management method, a system and computer equipment, wherein, in addition to a real-time database for receiving data in real time, a query database and a backup database are separately arranged, data synchronization work is carried out through a backup script. Then, when an external visitor queries the content of the query database, the content obtained by the visitor through the query is encrypted through an internal encryption agent and a key of the visitor itself, so that the safety and privacy of the queried data are ensured. Finally, the encrypted traffic in the audit log of the database is monitored, so that potential attackers are prevented from threatening the database.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of database, in particular to a database data management method, system and computer equipment. BACKGROUND

[0002] Database encryption, backup and query technology has a unified demand background in ensuring data security, system reliability and efficiency. These technologies need to meet the data security requirements, prevent data leakage and tampering; ensure system reliability, prevent data loss and business interruption; optimize performance, reduce consumption of system resources; comply with compliance requirements, comply with laws and regulations; provide ease of use and maintainability, simplify operations and management; support cross-platform and compatibility, ensure applicability in different environments; and have real-time and dynamic, adapt to changing business needs. By considering these needs comprehensively, a more robust, secure and efficient database system can be built.

[0003] There are many database encryption backup methods at present, and some research results have been achieved. However, there are still the following problems in database concurrency, backup and query performance and encryption granularity.

[0004] 1. Encryption operations may have some impact on some operations of the database, such as query efficiency, data backup and recovery, etc. Especially in the case of handling a large amount of data or high concurrency access, encryption operations may become a performance bottleneck, with low security and privacy.

[0005] 2. When performing backup and recovery operations, it may occupy a lot of system resources such as CPU, memory, disk I / O, etc., affecting the normal operation of the computer system, especially when backing up a large amount of data or performing complex recovery operations, which may cause system performance to decline. SUMMARY

[0006] The present application provides a database data management method, which aims to solve the technical problems raised in the background art.

[0007] The present application provides a database data management method, which includes a real-time database, an analysis database and a backup database;

[0008] The real-time database dynamically acquires data information and writes the data information into the analysis database and the backup database through a backup script, wherein the backup database is independent of the analysis database and the real-time database;

[0009] The analysis database receives external query request information sent by an external access device and performs identity verification according to the external query request information;

[0010] After the identity authentication, the analysis database generates an encrypted query key pair and query content according to the external query request information, and encrypts the query content by a public key to obtain first encrypted content;

[0011] The analysis database obtains a public key of the external access device, and encrypts the first encrypted content and the encrypted query key according to the public key of the external access device to obtain second encrypted content, and outputs the second encrypted content to the external access device;

[0012] The external access device decrypts the second encrypted content according to a private key of the external access device, and decrypts the first encrypted content according to a decryption key in the encrypted query key to obtain the query content.

[0013] Preferably, the step of generating an encrypted query key according to the external query request information comprises:

[0014] The analysis database obtains ID information, an IP address, an identity authentication timestamp, and a public key of the external access device according to the external query request information;

[0015] The analysis database obtains a first variable value and a second variable value, and respectively packs and groups the ID information, the identity authentication timestamp, the first variable value, and the second variable value based on a hash algorithm to form a string group, wherein the string group comprises a first string and a second string, the first string comprises the ID information, the identity authentication timestamp, and the first variable value, and the second string comprises the user IP address, the identity authentication timestamp, and the second variable value;

[0016] The first string and the second string are respectively repeatedly linked until they are expanded to a length of more than 1024 bits to obtain a first long string and a second long string;

[0017] The analysis database respectively calculates the first long string and the second long string based on an SM3 hash function, converts the calculation results into decimals, and takes the first 1024 as basic characters to obtain a first basic character and a second basic character;

[0018] It is judged whether the first basic character and the second basic character are prime numbers based on Miller-Rabin primality testing;

[0019] If the first basic character and / or the second basic character is not a prime number, the first variable value and / or the second variable value is incremented by one, and the first variable value and / or the second variable value after the increment is taken as the first variable value and / or the second variable value and returned to the step of respectively packing and grouping the ID information, the identity authentication timestamp, the first variable value, and the second variable value based on the hash algorithm, until the first basic character and the second basic character are both prime numbers;

[0020] calculating a prime product and a Euler function value based on the first base character and the second base character;

[0021] finding a public key exponent based on the prime product and the Euler function value;

[0022] packing the public key exponent and the prime product to obtain an encryption key;

[0023] calculating a private key exponent according to the Euler function value and the public key exponent;

[0024] packing the private key exponent and the prime product to obtain a decryption key.

[0025] As preferred, it further comprises:

[0026] the analysis database obtains historical abnormal audit data and takes the historical abnormal audit data as pseudo abnormal data;

[0027] obtaining normal audit data and mixing the normal audit data and the pseudo abnormal data to obtain training samples;

[0028] sending the training samples as input to a discriminator model for training and outputting a training result;

[0029] judging whether a loss value of the training result exceeds a preset value;

[0030] if the loss value exceeds the preset value, returning to the step of obtaining historical abnormal audit data and taking the historical abnormal audit data as pseudo abnormal data until the loss value does not exceed the preset value.

[0031] As preferred, the step of the analysis database obtaining historical abnormal audit data and taking the historical abnormal audit data as pseudo abnormal data comprises:

[0032] the analysis database obtains target abnormal audit log data in the historical abnormal audit data;

[0033] adding Gaussian noise to the target abnormal audit log data multiple times;

[0034] randomly deleting Gaussian noise of a preset number of times to restore the abnormal audit log data;

[0035] taking the abnormal audit log data as pseudo abnormal data.

[0036] As preferred, when performing feature analysis on the training samples, an information gain algorithm, an information gain ratio algorithm, a chi-square test algorithm or a ReliefF algorithm is adopted.

[0037] As preferred, after the step of if the loss value exceeds the preset value, returning to the step of obtaining historical abnormal audit data and taking the historical abnormal audit data as pseudo abnormal data until the loss value does not exceed the preset value, it comprises:

[0038] The analysis database obtains the discriminator model and arranges the discriminator model in an internal network;

[0039] Real-time monitoring of an audit log based on the discriminator model, wherein the audit log is generated based on the second encrypted content;

[0040] Judging whether there is abnormal data based on the audit log;

[0041] If there is abnormal data, obtaining an encrypted agent log, wherein the encrypted agent log is generated based on the first encrypted content and the second encrypted content;

[0042] Obtaining the ID information, IP address, identity verification timestamp and public key of the external access device retained in the encrypted agent log to reproduce the key and restore the second encrypted content.

[0043] The application also provides a database data management system, comprising a real-time database, an analysis database and a backup database;

[0044] The real-time database is used to dynamically obtain data information and write the data information into the analysis database and the backup database through a backup script, wherein the backup database is independent of the analysis database and the real-time database;

[0045] The analysis database is used to receive external query request information sent by an external access device and perform identity verification according to the external query request information;

[0046] After the identity verification, the analysis database is further used to generate an encrypted query key pair and query content according to the external query request information, and perform public key encryption on the query content to obtain first encrypted content;

[0047] The analysis database is further used to obtain the public key of the external access device and perform secondary encryption on the first encrypted content and the encrypted query key according to the public key of the external access device to obtain second encrypted content, and output the second encrypted content to the external access device;

[0048] The external access device is used to decrypt the second encrypted content according to a private key of the external access device and a decryption key in the encrypted query key.

[0049] Preferably, the analysis database is further used to obtain the ID information, IP address, identity verification timestamp and public key of the external access device according to the external query request information;

[0050] The analysis database is also used to obtain a first variable value and a second variable value, and pack and compose a string group based on a hash algorithm, the string group comprising a first string and a second string, the first string comprising the ID information, the identity authentication timestamp, the first variable value, and the second string comprising the user IP address, the identity authentication timestamp, and the second variable value;

[0051] The analysis database is also used to repeatedly link the first string and the second string respectively until the length is expanded to more than 1024 bits to obtain a first long string and a second long string.

[0052] The analysis database is also used to calculate the first long string and the second long string based on an SM3 hash function, convert the calculation results into decimals, and take the first 1024 as basic characters to obtain a first basic character and a second basic character.

[0053] The analysis database is also used to judge whether the first basic character and the second basic character are prime numbers based on Miller-Rabin primality testing.

[0054] If the first basic character and / or the second basic character is not a prime number, the first variable value and / or the second variable value is incremented by one, and the first variable value and / or the second variable value after the increment is taken as the first variable value and / or the second variable value and returned to the step of packing and composing strings based on the hash algorithm.

[0055] The analysis database is also used to calculate a prime product and an Euler function value based on the first basic character and the second basic character.

[0056] The analysis database is also used to find a public key exponent based on the prime product and the Euler function value.

[0057] The analysis database is also used to pack the public key exponent and the prime product to obtain an encryption key.

[0058] The analysis database is also used to calculate a private key exponent based on the Euler function value and the public key exponent.

[0059] The analysis database is also used to pack the private key exponent and the prime product to obtain a decryption key.

[0060] The application also provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0061] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described method.

[0062] The beneficial effects of this invention are as follows: In addition to a real-time database that receives data in real time, a query database and a backup database are separately established, and data synchronization is performed through a backup script. Then, when an external visitor queries the database content, the content obtained is encrypted using an internal encryption proxy and the visitor's own key, ensuring the security and privacy of the queried data. Finally, encrypted traffic in the database's audit logs is monitored to prevent potential attackers from posing a threat to the database. Attached Figure Description

[0063] Figure 1 This is a schematic diagram of a method flow according to an embodiment of the present invention.

[0064] Figure 2 This is a schematic diagram of a key generation process according to an embodiment of the present invention.

[0065] Figure 3 This is a schematic diagram of the internal structure of a computer device according to an embodiment of the present invention.

[0066] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0067] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0068] like Figures 1-3 As shown, this application provides a database data management method, wherein the database includes a real-time database, an analysis database, and a backup database;

[0069] S1. The real-time database dynamically acquires data information and writes the data information into the analysis database and the backup database through a backup script, wherein the backup database is independent of the analysis database and the real-time database.

[0070] S2. The analysis database receives external query request information sent by external access devices and performs authentication based on the external query request information;

[0071] S3. After identity verification, the analysis database generates an encrypted query key pair and query content based on the external query request information, and encrypts the query content with a public key to obtain the first encrypted content.

[0072] S4, the analysis database acquires the public key of the external access device, and performs secondary encryption on the first encrypted content and the encrypted query key according to the public key of the external access device to obtain second encrypted content, and outputs the second encrypted content to the external access device;

[0073] S5, the external access device decrypts the second encrypted content according to the private key of the external access device, and decrypts the first encrypted content according to the decryption key in the encrypted query key to obtain the query content.

[0074] As described above in steps S1-S5, in the design of the data architecture, there are three databases, namely, a real-time database, an analysis database and a backup database. Among them, the real-time database dynamically acquires data information, and writes the data information into the analysis database and the backup database through a backup script; the analysis database is used for the query of the information in the database by the external visitors through a query keyword, and is mainly responsible for solving the query demand of the external visitors; the backup database is placed in an internal isolation area, and is used for the storage and disaster recovery defense of the database content. In addition, the internal administrator accesses the real-time database through a bastion host to monitor the database; the external visitor accesses the analysis database to query the data information through an external access device after authentication; the query content is encrypted to prevent leaving traces on the audit log; the public key of the external visitor is further encrypted before the audit log is transmitted outward, and then transmitted outward; finally, the external visitor only needs to use the private key of the external visitor and the decryption key in the query ciphertext package to obtain the query content. Through this method, the security protection of the whole life cycle from the data export can be realized, and even the internal administrator cannot know the query content of the visitor. Through the implementation of the security backup and proxy query measures, the security and privacy protection level of the database can be improved, and the data integrity in the database and the reliability of the system are ensured.

[0075] In one embodiment, the analysis database generates the encrypted query key according to the external query request information in step S3, which includes:

[0076] S31, the analysis database acquires the ID information, IP address, identity authentication timestamp and public key of the external access device according to the external query request information;

[0077] S32, the analysis database acquires the first variable value and the second variable value, and packs and composes the ID information, the identity authentication timestamp, the first variable value and the second variable value based on a hash algorithm to form a string group, wherein the string group includes a first string and a second string, the first string includes the ID information, the identity authentication timestamp and the first variable value, and the second string includes the user IP address, the identity authentication timestamp and the second variable value;

[0078] S33. Repeatedly concatenate the first string and the second string until they are extended to a length of more than 1024 characters to obtain the first long string and the second long string.

[0079] S34. The analysis database calculates the first long string and the second long string based on the SM3 hash function, converts the calculation results into decimal, and takes the first 1024 bits as the basic characters to obtain the first basic character and the second basic character.

[0080] S35. Determine whether the first basic character and the second basic character are prime numbers based on Miller-Rabin primality detection;

[0081] S36. If the first basic character and / or the second basic character are not prime numbers, then the first variable value and / or the second variable value are incremented by one, and the incremented first variable value and / or the second variable value are used as the first variable value and / or the second variable value and returned to the step of packaging the ID information, authentication timestamp, first variable value and second variable value into a string based on the hash algorithm, until the first basic character and the second basic character are both prime numbers.

[0082] S37. Calculate the prime product and Euler's totient function based on the first and second basic characters;

[0083] S38. Find the public key exponent based on the prime product and Euler's totient function value;

[0084] S39. Pack the public key exponent and the prime product to obtain the encryption key;

[0085] S40. Calculate the private key exponent based on the Euler's totient function value and the public key exponent;

[0086] S41. Pack the private key exponent and the prime number product together to obtain the decryption key.

[0087] After the external access device initiates the query request, identity verification is performed first as described in steps S31-S41. After the verification passes, the encryption agent automatically collects the ID information, IP address, timestamp of request initiation, and public key of the external access device, and assigns two variable values, a first variable value CountP and a second variable value CountQ, to generate a pair of keys for encrypting the query content. At the same time, the query SQL statement of the external access device is limited and cannot query data content outside the limit, such as data information other than the one related to itself, and the like. The plaintext query data to be returned by the analysis database is encrypted using the public key in the pair of keys generated by the encryption agent to obtain first encrypted content, and after the encryption is completed, the first encrypted content and the remaining decryption key are packaged together into a ciphertext package, which is then encrypted using the public key of the external access device obtained by the encryption agent to obtain second encrypted content. Then, automatic audit record is performed on the second encrypted content. Finally, the registered second encrypted content is returned to the external access device, and the external access device can obtain the query information using its own private key. By modifying the initial prime number selection based on RSA, the entire key becomes controllable.

[0088] As shown in Figure 2 , the specific encryption process is as follows: first, the ID information, timestamp, and CountP, and the IP address, timestamp, and CountQ are each packaged and connected into a string, and then expanded to a length of more than 1024 bits through repeated linkage, and then calculated through the SM3 hash function, and the hexadecimal result is expanded to decimal and the first 1024 bits are taken as the base, and then the Miller-Rabin primality test is used to determine whether it is a prime number, and if it is not a prime number, the CountP value is increased by one, and the linkage expansion, SM3 function generation, and primality test are performed again, until a pair of 1024-bit prime numbers P and Q are generated. Subsequently, the prime product N and the Euler function value M are calculated according to the following formula.

[0089] N = P x Q; wherein N represents the prime product, P represents the first variable value CountP, and Q represents the second variable value CountQ;

[0090] M = (P-1) x (Q-1); wherein M represents the Euler function value;

[0091] After N and M are obtained, the public key exponent E is found, which requires that E is coprime with M and is a positive integer less than M. After E is obtained, E and N are packaged to obtain the encryption key (E, N). Subsequently, the private key exponent D is calculated.

[0092] The calculation formula is D=(k*M+1) / E; wherein, D represents a private key index, k is a positive integer, and represents an integer part of a quotient obtained by dividing D*E by M. The decryption key (D, N) can be obtained by packing D and N.

[0093] In one embodiment, further comprising:

[0094] The analysis database obtains historical abnormal audit data and takes the historical abnormal audit data as pseudo abnormal data.

[0095] Normal audit data is obtained, and the normal audit data and the pseudo abnormal data are mixed to obtain training samples.

[0096] The training samples are sent to a discriminator model as input ends for training, and a training result is output.

[0097] It is judged whether a loss value of the training result exceeds a preset value.

[0098] If the preset value is exceeded, the step of obtaining historical abnormal audit data and taking the historical abnormal audit data as pseudo abnormal data is returned to until the loss value does not exceed the preset value.

[0099] The step of sending the training samples to the discriminator model as the input ends for training and outputting the training result comprises:

[0100] The training samples are input into the discriminator model, and important features are obtained by performing feature analysis on the training samples.

[0101] The training result is output based on the important features.

[0102] The step of obtaining historical abnormal audit data and taking the historical abnormal audit data as pseudo abnormal data by the analysis database comprises:

[0103] The analysis database obtains target abnormal audit log data in the historical abnormal audit data.

[0104] Gaussian noise is added to the target abnormal audit log data multiple times.

[0105] The Gaussian noise is randomly deleted for a preset number of times to restore the abnormal audit log data.

[0106] The abnormal audit log data is taken as the pseudo abnormal data.

[0107] As mentioned above, while outputting the second encrypted content to the external access device, the audit log of the second encrypted content is monitored to identify potential abnormal, malicious query operations. The present application mainly adopts an accurate abnormal traffic detection method of pseudo abnormality, mainly through a diffusion model - a generative adversarial network (DF-GAN) model to carry out detection work. The DF-GAN model mainly consists of a diffusion (DF) model responsible for generating pseudo abnormal traffic and a generative adversarial network (GAN) model responsible for monitoring abnormal traffic. The diffusion model generates high-quality pseudo abnormal traffic through a data enhancement mode of noise addition and noise removal, and the generative adversarial network is mainly responsible for identifying abnormal traffic mixed in normal traffic to carry out detection work. After the model training is completed, only the ciphertext audit data captured from the ciphertext audit log needs to be identified. Specifically, when carrying out audit log monitoring, the existing abnormal audit data records are called to generate a batch of abnormal audit data to alleviate the decline in model recognition performance caused by insufficient abnormal audit quantity, and are marked as pseudo abnormal audit data. Secondly, the pseudo abnormal audit data and normal audit data are mixed and given to the discriminator for identification. The model will extract the spatio-temporal features contained in the traffic information, and use feature selection algorithms such as information gain (IG), information gain ratio (IGR), chi-square (χ2) and ReliefF to select important features for analysis. When the loss value of the identification result is large, the generator stage is returned to generate pseudo abnormal data for further identification until the output result has a small loss value. Finally, the trained model is deployed in the database intranet to carry out security monitoring work according to the audit requirements. Specifically, using existing abnormal audit data records, a batch of pseudo abnormal audit data is generated through data diffusion generation algorithm (such as diffusion model or GAN, etc.), and is marked as "pseudo abnormality". Then, the generated pseudo abnormal data and normal audit data are mixed and input into the discriminator model for training. The main task of the discriminator is to distinguish normal and abnormal data according to the spatio-temporal features (such as timestamp, source IP, request frequency, etc.) in the data. In terms of feature selection, information gain (IG), information gain ratio (IGR), chi-square (χ2) and ReliefF are used to improve the accuracy of the model. After preliminary training, the discriminator classifies the data, and if the loss value of the identification result is large, the generator stage is returned to generate pseudo abnormal data for further training. This process is similar to the feedback mechanism in encryption and decryption, and the generator and discriminator are iteratively optimized until the loss value reaches a minimum and the recognition ability of the model reaches an optimal state.

[0108] Specific training process:

[0109] 1. Data preparation: prepare a number of abnormal and normal audit data

[0110] 2. Model initialization: initialize the parameters of the diffusion model generator and the generative adversarial network discriminator

[0111] 3. Model training:

[0112] 3.1 Generator training

[0113] First, extract the target abnormal audit log data, then add Gaussian noise step by step until it becomes completely noisy, and then remove the noise step by step to recover the abnormal audit log data. Since there is a probability of selection at each step, this method can generate a batch of similar but not identical pseudo abnormal log data, which can solve the problem of insufficient training data in the current abnormal recognition model

[0114] 3.2 Discriminator training

[0115] The discriminator will accept a training data set mixed from pseudo abnormal data and a large number of normal data. Its main task is to judge whether the current data is abnormal data by calculating the information gain, information gain ratio, and chi-square value of each data, and to simulate the recognition of the divided data, and to correct the training parameters through the loss value calculated by the loss function.

[0116] 4. Evaluation:

[0117] Judge the performance of the model in all aspects, evaluate the quality of the pseudo abnormal samples generated by the model and the abnormal detection ability of the model.

[0118] The generator of the diffusion model generates high-quality pseudo abnormal sample data, making up for the lack of abnormal data samples in the model training process. The pseudo abnormal samples generated by the generator are highly consistent with the real abnormal samples in semantics, increasing the diversity and richness of the training data and improving the generalization ability and detection accuracy of the model. And DF-GAN is different from the usual multi-layer stacked generative adversarial network, which only uses one generator and one discriminator, simplifying the model structure and improving the training efficiency of the model. This makes the generated pseudo abnormal data of high quality: the text generated by DF has better consistency compared with the original text; and the training speed is fast: only one generator and one discriminator are used, simplifying the model structure and speeding up the model training; the model has strong stability: DF-GAN is more stable during training, reducing the instability factors in the training process.

[0119] In one embodiment, when performing feature analysis on training samples, information gain algorithm, information gain ratio algorithm, chi-square test algorithm or ReliefF algorithm are used. These methods help us to select the most helpful features for anomaly detection by quantifying the relationship between features and target variables.

[0120] Information gain (IG) is a measure of how much a feature reduces the uncertainty of a dataset, calculated as:

[0121] IG(D, X) = H(D) - H(D|X);

[0122] where H(D) is the original entropy of dataset D, and H(D|X) is the weighted average entropy after partitioning by feature X. Higher IG indicates that feature X is more effective in reducing the uncertainty of dataset D, and thus more valuable in feature selection.

[0123] Further, information gain ratio (IGR) normalizes IG by the intrinsic value (IV) of a feature to avoid bias towards features with more values. It is calculated as:

[0124]

[0125] where the intrinsic value IV(X) is calculated as:

[0126]

[0127] Here, D i is the subset of data corresponding to the i-th value of feature X.

[0128] Besides IG and IGR, chi-square test (χ2) is another commonly used feature selection method, especially for categorical data. It measures the difference between the actual and expected frequencies to assess the correlation between a feature and the target variable, calculated as:

[0129]

[0130] where f o is the actual frequency, and f c is the expected frequency. Larger χ 2 indicates stronger correlation between the feature and the target variable.

[0131] Besides the above methods, ReliefF algorithm evaluates feature importance by calculating feature weights, especially suitable for handling noisy data and multi-class problems. The weight update formula is:

[0132]

[0133] where W[A] is the weight of feature A, diff(A, n i ) is the difference of feature A in sample n i , and m is the total number of samples.

[0134] After completing feature analysis and selecting important features, the next step is to obtain the recognition result by the model output probability. For example, the output probability of the logistic regression model can be calculated by the following formula:

[0135]

[0136] If P(abnormal | X) > 0.5, the data point is determined as abnormal. The performance of the model can be evaluated by indicators such as recall, F1 score and ROC-AUC value. Recall measures the proportion of actual abnormal data correctly identified, and its formula is:

[0137]

[0138] Where TP is true positive (actual abnormal and identified as abnormal), FN is false negative (actual abnormal but not identified as abnormal). F1 score is the harmonic mean of precision and recall, and its formula is:

[0139]

[0140] The higher the F1 score, the better the comprehensive performance of the model. In addition, ROC-AUC value is calculated by ROC curve (relationship between true positive rate and false positive rate), and the closer the AUC is to 1, the better the classification performance of the model.

[0141] When the training is completed and the model performance meets the expectation, the trained discriminator model is deployed in the database intranet to start real-time monitoring of audit logs.

[0142] In one embodiment, if the preset value is exceeded, the step of returning to the step of obtaining historical abnormal audit data and taking it as pseudo abnormal data is included until the step of loss value not exceeding the preset value.

[0143] The analysis database obtains the discriminator model and arranges the discriminator model in the internal network;

[0144] Real-time monitoring of audit logs based on the discriminator model, wherein the audit logs are generated based on the second encrypted content;

[0145] Determine whether there is abnormal data based on the audit logs;

[0146] If there is abnormal data, obtain the encrypted agent log, wherein the encrypted agent log is generated based on the first encrypted content and the second encrypted content;

[0147] Obtain the ID information, IP address, identity verification timestamp and public key of the external access device retained in the encrypted agent log to reproduce the key and restore the second encrypted content.

[0148] As described above, the model alleviates the problem of insufficient abnormal audit data by generating pseudo abnormal data, continuously analyzes and identifies abnormal behaviors in audit data, ensures system security and responds to potential threats in a timely manner. In the face of identified abnormal data, the internal administrator receives the abnormal data package, and can further reproduce the key to open the encrypted data package by retaining the user ID information, IP address, timestamp and other records in the encrypted agent log. Reproduction refers to extracting the ID information, IP address, timestamp, CountP and CountQ from the agent encryption audit record, and obtaining the decryption key according to the calculation method of the key generation and opening the ciphertext package. For example, the nature of abnormal behavior is confirmed by using the behavior pattern (such as request frequency, access path, etc.) in the agent log. Specifically: 1. Request frequency analysis: By counting the number of accesses of each IP address within a certain time, a reasonable threshold is set, such as 100 times per minute. If the access frequency of a certain IP address exceeds this threshold, it will be marked as abnormal behavior. 2. Request content analysis: Through keyword filtering and pattern matching, identify requests containing illegal URLs, a large number of POST requests or specific keywords (such as " / admin", " / login", etc.). 3. Access path analysis: Count the frequency of user access paths to identify behaviors that frequently access sensitive pages or background management pages. Automatically identify abnormal patterns or behaviors in log data through the DF-GAN model. First, parse the unstructured log into structured data and extract features such as timestamp, log length, keywords, etc. Then use the trained DF-GAN model for anomaly detection. Finally, output possible abnormal data to the administrator to form an alarm. Through these steps, abnormal behavior can be effectively identified, and related ciphertext data records can be retrieved from the audit record to restore the query content, implement security monitoring, ensure system security and respond to potential threats in a timely manner.

[0149] The application also provides a database data management system, comprising a real-time database, an analysis database and a backup database;

[0150] The real-time database is used to dynamically obtain data information, and write the data information into the analysis database and the backup database through a backup script, wherein the backup database is independent of the analysis database and the real-time database;

[0151] The analysis database is used to receive external query request information sent by an external access device, and perform identity verification according to the external query request information;

[0152] After identity verification, the analysis database is also used to generate an encryption query key pair and query content according to the external query request information, and encrypt the query content with a public key to obtain first encrypted content;

[0153] The analysis database is further configured to obtain the public key of the external access device, and perform secondary encryption on the first encrypted content and the encrypted query key according to the public key of the external access device to obtain second encrypted content, and output the second encrypted content to the external access device.

[0154] The external access device is configured to decrypt the second encrypted content according to the private key of the external access device and the decryption key in the encrypted query key.

[0155] In an embodiment, the analysis database is further configured to obtain ID information, an IP address, an identity authentication timestamp, and a public key of the external access device according to the external query request information;

[0156] The analysis database is further configured to obtain the first variable value and the second variable value, and pack and compose the ID information, the identity authentication timestamp, the first variable value, and the second variable value based on a hash algorithm to obtain a string group, wherein the string group includes a first string and a second string, the first string includes the ID information, the identity authentication timestamp, and the first variable value, and the second string includes the user IP address, the identity authentication timestamp, and the second variable value.

[0157] The analysis database is further configured to repeatedly link the first string and the second string respectively until the length is expanded to more than 1024 bits to obtain a first long string and a second long string.

[0158] The analysis database is further configured to calculate the first long string and the second long string based on an SM3 hash function respectively, convert the calculation results to decimal, and take the first 1024 as basic characters to obtain a first basic character and a second basic character.

[0159] The analysis database is further configured to judge whether the first basic character and the second basic character are prime numbers based on Miller-Rabin primality testing respectively.

[0160] If the first basic character and / or the second basic character are not prime numbers, the first variable value and / or the second variable value are incremented by one, and the first variable value and / or the second variable value after the increment are taken as the first variable value and / or the second variable value and returned to the step of packing and composing the ID information, the identity authentication timestamp, the first variable value, and the second variable value based on the hash algorithm, until the first basic character and the second basic character are both prime numbers.

[0161] The analysis database is further configured to calculate a prime number product and an Euler function value based on the first basic character and the second basic character.

[0162] The analysis database is further configured to find a public key exponent based on the prime number product and the Euler function value.

[0163] and the prime number product to obtain an encryption key;

[0164] and the prime number product to obtain an encryption key;

[0165] and the prime number product to obtain an encryption key.

[0166] The above modules, units and sub-units are used to execute the steps of the database data management method, and the specific implementation manners are described in the above method embodiments, which will not be described here.

[0167] As shown in Figure 3 The present application also provides a computer device, which can be a server, and the internal structure thereof can be as shown in Figure 3 The computer device includes a processor, a memory, a network interface and a database connected through a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store all data required by the process of the database data management method. The network interface of the computer device is used to communicate with the external terminal through the network connection. The computer program is executed by the processor to implement the database data management method.

[0168] Those skilled in the art can understand Figure 3 that the structure shown in

[0169] The computer program is executed by the processor to implement the database data management method.

[0170] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiment methods can be included. Any reference to memory, storage, databases, or other media in this application and in examples provided herein, unless specifically stated otherwise, can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in many forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0171] It should be noted that in this document, the terms "comprising", "including", or any other variant thereof are intended to cover a non-exclusive inclusion, such that a process, device, article, or method that comprises a list of elements does not only include those elements, but can also include other elements not expressly listed or inherent to such process, device, article, or method. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, device, article, or method that includes the element.

[0172] The above description is only the preferred embodiment of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation, or direct or indirect application in other related technical fields, based on the content of the present application specification and drawings, is also included in the patent protection scope of the present application.

Claims

1. A database data management method, characterized in that, The database includes real-time databases, analytics databases, and backup databases; The real-time database dynamically acquires data information and writes the data information into the analysis database and the backup database through a backup script. The backup database is independent of the analysis database and the real-time database. The analysis database receives external query request information sent by external access devices and performs authentication based on the external query request information; After successful authentication, the analysis database generates an encrypted query key pair and query content based on the external query request information, and encrypts the query content with a public key to obtain the first encrypted content; The analysis database obtains the public key of the external access device, and encrypts the first encrypted content and the encryption query key a second time according to the public key of the external access device to obtain the second encrypted content, and outputs the second encrypted content to the external access device. The external access device decrypts the second encrypted content using its own private key, and decrypts the first encrypted content using the decryption key in the encryption query key to obtain the query content; The step of generating an encrypted query key based on external query request information in the analysis database includes: The analysis database obtains the ID information, IP address, authentication timestamp, and public key of the external access device based on the external query request information. The analysis database obtains the first variable value and the second variable value, and packages the ID information, authentication timestamp, first variable value and second variable value into string groups based on a hash algorithm. The string group includes a first string and a second string. The first string includes ID information, authentication timestamp and first variable value, and the second string includes user IP address, authentication timestamp and second variable value. Repeatedly concatenate the first string and the second string until they are extended to a length of more than 1024 characters, resulting in the first long string and the second long string. The analysis database calculates the first long string and the second long string based on the SM3 hash function, converts the calculation results into decimal, and takes the first 1024 bits as the basic characters to obtain the first basic character and the second basic character. Based on Miller-Rabin primality detection, determine whether the first basic character and the second basic character are prime numbers respectively; If the first basic character and / or the second basic character are not prime numbers, then the first variable value and / or the second variable value are incremented by one, and the incremented first variable value and / or the second variable value are used as the first variable value and / or the second variable value and returned to the step of packaging the ID information, authentication timestamp, first variable value and second variable value into a string based on the hash algorithm, until the first basic character and the second basic character are both prime numbers; Calculate the prime product and Euler's totient function based on the first and second basic characters; Find the public key exponent based on the prime product and Euler's totient function value; The encryption key is obtained by packaging the public key exponent and the product of prime numbers; Calculate the private key exponent based on the Euler's totient function value and the public key exponent; The decryption key is obtained by packaging the private key exponent and the prime number product together. Also includes: The analysis database acquires historical anomaly audit data and uses it as pseudo-anomaly data. Obtain normal audit data and mix it with pseudo-anomaly data to obtain training samples; The training samples are fed into the discriminator model as input for training, and the training results are output. Determine whether the loss value of the training result exceeds the preset value; If the value exceeds the preset value, return to the step of obtaining historical abnormal audit data and using it as pseudo-abnormal data until the loss value does not exceed the preset value. The step of obtaining historical anomaly audit data from the analysis database and using it as pseudo-anomaly data includes: The analysis database retrieves target anomaly audit log data from historical anomaly audit data; Gaussian noise was added multiple times to the target anomaly audit log data; Randomly delete Gaussian noise a preset number of times to restore abnormal audit log data; Treat abnormal audit log data as pseudo-abnormal data; If the value exceeds the preset value, the process returns to the step of obtaining historical anomaly audit data and treating it as pseudo-anomaly data, until the loss value does not exceed the preset value. This includes: The analysis database acquires the discriminator model and deploys the discriminator model in the internal network; Real-time monitoring of audit logs is based on a discriminator model, wherein the audit logs are generated based on a second encrypted content; Determine if there is any abnormal data based on the audit logs; If abnormal data is found, retrieve the encrypted proxy log, which is generated based on the first encrypted content and the second encrypted content; Obtain the ID information, IP address, authentication timestamp, and public key of the external access device stored in the encrypted proxy log, in order to reproduce the key and recover the second encrypted content.

2. The database data management method according to claim 1, characterized in that, When performing feature analysis on training samples, the information gain algorithm, information gain ratio algorithm, chi-square test algorithm, or ReliefF algorithm can be used.

3. A database data management system, characterized in that, This includes real-time databases, analytics databases, and backup databases; The real-time database is used to dynamically acquire data information and write the data information into the analysis database and the backup database through a backup script. The backup database is independent of the analysis database and the real-time database. The analysis database is used to receive external query request information sent by external access devices and to perform authentication based on the external query request information; After identity verification, the analysis database is also used to generate an encrypted query key pair and query content based on the external query request information, and to encrypt the query content with a public key to obtain the first encrypted content; The analysis database is also used to obtain the public key of the external access device, and to encrypt the first encrypted content and the encryption query key again according to the public key of the external access device to obtain the second encrypted content, and output the second encrypted content to the external access device. The external access device is used to decrypt the second encrypted content based on its own private key and the decryption key in the encryption query key; The analysis database is also used to obtain the ID information, IP address, authentication timestamp, and public key of the external access device based on the external query request information. The analysis database is also used to obtain the first variable value and the second variable value, and to package the ID information, authentication timestamp, first variable value and second variable value into string groups based on a hash algorithm. The string group includes a first string and a second string. The first string includes ID information, authentication timestamp and first variable value, and the second string includes user IP address, authentication timestamp and second variable value. It is also used to repeatedly link the first string and the second string until they are extended to a length of more than 1024 characters, resulting in the first long string and the second long string. The analysis database is also used to perform calculations on the first long string and the second long string based on the SM3 hash function, convert the calculation results to decimal, and take the first 1024 as the basic characters to obtain the first basic character and the second basic character. It is also used to determine whether the first basic character and the second basic character are prime numbers based on Miller-Rabin primality detection; If the first basic character and / or the second basic character are not prime numbers, then the first variable value and / or the second variable value are incremented by one, and the incremented first variable value and / or the second variable value are used as the first variable value and / or the second variable value and returned to the step of packaging the ID information, authentication timestamp, first variable value and second variable value into a string based on the hash algorithm, until the first basic character and the second basic character are both prime numbers; It is also used to calculate the prime product and Euler's totient function value based on the first and second basic characters; It is also used to find the public key exponent based on the product of prime numbers and the Euler totient function value; It is also used to package the public key exponent and the product of prime numbers to obtain the encryption key; It is also used to calculate the private key exponent based on the Euler totient function value and the public key exponent; It is also used to package the private key exponent and the product of prime numbers to obtain the decryption key; The analysis database is also used to obtain historical anomaly audit data and use it as pseudo-anomaly data. It is also used to obtain normal audit data and mix normal audit data with pseudo-abnormal data to obtain training samples; It is also used to feed training samples as input to the discriminator model for training and output the training results; It is also used to determine whether the loss value of the training result exceeds the preset value; It is also used to return to the step of obtaining historical abnormal audit data and using it as pseudo-abnormal data if the value exceeds the preset value, until the loss value does not exceed the preset value. The analysis database is also used to obtain historical anomaly audit data and use it as pseudo-anomaly data, including the following steps: The analysis database is also used to obtain target anomaly audit log data from historical anomaly audit data; It is also used to add Gaussian noise multiple times to the target anomaly audit log data; It is also used to randomly delete Gaussian noise a preset number of times in order to recover abnormal audit log data; It is also used to treat abnormal audit log data as pseudo-abnormal data; The method further includes, if the value exceeds a preset value, returning to the step of obtaining historical anomaly audit data and treating it as pseudo-anomaly data, until the loss value does not exceed the preset value, including: The analysis database is also used to acquire the discriminator model and deploy the discriminator model in the internal network; It is also used for real-time monitoring of audit logs based on a discriminator model, wherein the audit logs are generated based on a second encrypted content; It is also used to determine whether there is abnormal data based on audit logs; It is also used to obtain encrypted proxy logs if abnormal data exists, wherein the encrypted proxy logs are generated based on the first encrypted content and the second encrypted content; It is also used to obtain the ID information, IP address, authentication timestamp, and public key of the external access device stored in the encrypted agent log, in order to reproduce the key and recover the second encrypted content.

4. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 and 2.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 and 2.

Images