Database security control method, device and equipment and storage medium

Abstract

The invention discloses a security control method, device and equipment for a database and a storage medium, and the method comprises the steps: monitoring a database in a target application environment in real time, and generating a production library data table; based on the data access permission information, generating database authorization information in at least one service scene as a white list data table; and based on the white list data table and the production library data table, performing security verification on candidate database statements in the target application environment. Through the technical scheme, the security of the data in the target application environment is improved.

Description

Technical Field

[0001] This application relates to the field of database technology, specifically to a database security management method, apparatus, device, and storage medium. Background Technology

[0002] With the development of information technology, databases play a vital role in enterprise and internet applications. However, during database operation and maintenance, data loss and corruption incidents caused by accidental manipulation of high-risk database statements are commonplace.

[0003] Currently, database management systems primarily control user operations through access control. However, current access control systems have the following problems: coarse-grained access control: database access control is usually based on user and role authorization, which cannot provide precise control over specific databases and tables; lack of additional protection for high-risk operations: even if a user has permission to perform database update operations, the risks caused by accidental operations cannot be avoided.

[0004] Therefore, there is an urgent need for a fine-grained method for database security management. Summary of the Invention

[0005] This application provides a database security management method, apparatus, device, and storage medium to improve database data security in a production environment.

[0006] According to one aspect of this application, a database security management method is provided, the method comprising:

[0007] Real-time monitoring of the database in the target application environment generates a production database table; wherein, the production database table is used to record the production database that is already running in the target application environment, and the target application environment is used to characterize the application environment that has been put into production;

[0008] Based on data access permission information, database authorization information for at least one business scenario is generated as a whitelist data table; wherein, the whitelist data table is used to represent the database authorization information corresponding to the user dimension, database dimension and data table dimension.

[0009] Based on the whitelist data table and the production database data table, security verification is performed on candidate database statements in the target application environment; wherein, the candidate database statements are database operation statements to be executed.

[0010] According to another aspect of this application, a database security management device is provided, the device comprising:

[0011] The database monitoring module is used to monitor the database in the target application environment in real time and generate a production database data table; wherein, the production database data table is used to record the production database that is already running in the target application environment, and the target application environment is used to characterize the application environment that has been put into production;

[0012] The whitelist generation module is used to generate database authorization information for at least one business scenario based on data access permission information, as a whitelist data table; wherein, the whitelist data table is used to represent the database authorization information corresponding to the user dimension, database dimension and data table dimension;

[0013] The security verification module is used to perform security verification on candidate database statements in the target application environment based on the whitelist data table and the production database data table; wherein, the candidate database statements are database operation statements to be executed.

[0014] According to another aspect of this application, an electronic device is provided, the electronic device comprising:

[0015] One or more processors;

[0016] Memory, used to store one or more programs;

[0017] When the one or more programs are executed by the one or more processors, the one or more processors implement any of the database security management methods provided in the embodiments of this application.

[0018] According to another aspect of this application, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements any of the database security management methods provided in the embodiments of this application.

[0019] According to another aspect of this application, a computer program product is provided, including a computer program that, when executed by a processor, implements any of the database security management methods provided in the embodiments of this application.

[0020] This application performs a security verification on candidate database statements by authenticating them based on database authorization information defined in at least one business scenario within the target application environment before execution. This ensures that only candidate database statements that conform to the whitelist data table can be executed, thereby reducing the risk of misprocessing of data stored in the database within the target application environment and improving the security of data in the target application environment. Attached Figure Description

[0021] Figure 1 This is a flowchart of a database security management method provided according to Embodiment 1 of this application;

[0022] Figure 2 This is a flowchart of a database security management method provided according to Embodiment 2 of this application;

[0023] Figure 3 This is a schematic diagram of a database security management device according to Embodiment 3 of this application;

[0024] Figure 4 This is a schematic diagram of the structure of an electronic device that implements the database security management method of Embodiment 4 of this application. Detailed Implementation

[0025] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0027] Example 1

[0028] Figure 1 This is a flowchart of a database security management method according to Embodiment 1 of this application. This embodiment is applicable to situations where data in a database in a production environment is subject to security management. The method can be executed by a database security management device, which can be implemented in hardware and / or software and can be configured in a computer device, such as a server. Figure 1 As shown, the method includes:

[0029] S110: Monitor the database in the target application environment in real time and generate production database data tables.

[0030] Among them, the production database table can be used to record the production database that is already running in the target application environment, and the target application environment can be used to characterize the application environment that has been put into production.

[0031] It should be noted that the application environment that has been put into production can refer to the environment in which users actually use it. It is the formal operating environment of the program or system, where all data operations, data interactions and final results take place.

[0032] Specifically, it can perform real-time monitoring of the database running in the target application environment and store the database structure information of the monitored database to generate production database tables. Optionally, the database structure information may include the database name, table structure information, and data field information.

[0033] S120. Based on data access permission information, generate database authorization information for at least one business scenario, as a whitelist data table.

[0034] The whitelist data table can be used to represent database authorization information at the user, database, and data table levels.

[0035] For example, in this embodiment of the invention, at the user level, fine-grained permissions can be assigned according to user roles (such as administrator, developer, and auditor). For instance, developers can only read and write to the development database and are prohibited from accessing the production database; auditors can view all table logs but have no modification permissions. At the database level, cross-database access can be restricted. At the data table level, different access permissions can be set for data tables. For example, the sales department can only update the customer table for its own region, and management can view the company-wide summary table but cannot modify specific orders.

[0036] S130. Based on the whitelist data table and the production database data table, perform security verification on candidate database statements in the target application environment.

[0037] Among them, the candidate database statements can be database operation statements to be executed.

[0038] Specifically, based on the whitelist data table, authentication operations can be performed on candidate database statements in the target application environment to determine whether the candidate database statements have execution permissions. If the candidate database statement meets the execution permissions in the whitelist data table, it is executed. It should be noted that the security verification operation for candidate database statements is limited to the production database in the target application environment. If the target operation object of the candidate database statement is not a production database, no security verification is required, and the candidate database statement can be executed immediately.

[0039] Optionally, based on the whitelist data table and the production database data table, security verification is performed on candidate database statements in the target application environment, including: determining the initiating object and target operation object of the candidate database statement; wherein, the target operation object includes the target database and the target data table; if the target operation object is in the production database data table, then information matching is performed in the whitelist data table based on the initiating object and the target operation object to determine whether the initiating object and the target operation object conform to the database authorization information defined in the whitelist data table; if they conform, the candidate database statement is executed.

[0040] The initiating object can be the user who initiates the candidate database statement, and the target operation object can be the database and table to which the data to be operated on in the candidate database statement belongs.

[0041] Optionally, in this embodiment of the invention, after generating the whitelist data table, the method further includes: extracting the target access dimension information corresponding to each database authorization information in the whitelist data table, and writing the target access dimension information and the access permissions corresponding to the target access dimension information into the database cache as a memory object in the form of key-value pairs.

[0042] Among them, the matching priority of memory objects in the database cache is different, and the priority of memory objects with wildcards is lower than that of memory objects without wildcards.

[0043] It should be noted that during the security verification of candidate database statements, the security verification of candidate database statements can be performed first based on the memory objects in the database cache, thereby improving the access speed of the whitelist database and further improving the efficiency of security verification.

[0044] This application embodiment performs a security verification on the candidate database statements before execution, based on database authorization information defined in at least one business scenario in the target application environment. This ensures that only candidate database statements that conform to the whitelist data table can be executed, reducing the risk of data misprocessing in the database of the target application environment and improving the security of data in the target application environment.

[0045] Example 2

[0046] Figure 2 This is a flowchart of a database security management method according to Embodiment 2 of this application. Based on the technical solutions of the above embodiments, this embodiment further refines the step of "generating database authorization information in at least one business scenario, as a whitelist data table, based on data access permission information." It should be noted that for parts not detailed in this embodiment, please refer to the relevant descriptions in other embodiments. Figure 2As shown, the method includes:

[0047] S210: Monitor the database in the target application environment in real time and generate production database data tables.

[0048] S220. Based on at least one business scenario in the target application environment, determine the access permission information of the production database in that business scenario.

[0049] Among them, business scenarios can be used to represent the spatiotemporal environment and logical chain in which business activities occur. They are complete ecological units that connect business goals, user needs, operation processes, resources and tools, and rule constraints. A business scenario is a dynamic "business logic container" that includes "who (user role) - what to do (goal) - how to do it (process) - what to use (tool) - what constraints (rules) - what data (information) is needed - what pain points (problems) exist". Different business scenarios correspond to different data access permission rules.

[0050] For example, in an e-commerce industry scenario, the business scenarios corresponding to the customer role include browsing products, placing orders, and querying orders. The data access permissions for the customer role should include querying the product table and the order table. The business scenarios corresponding to the sales operations role include adjusting product prices and managing promotional activities. The data access permissions for the sales operations role should include updating the product table and the promotion table. The business scenarios corresponding to the inventory administrator role include inventory counting, allocation, and replenishment. The data access permissions for the inventory administrator role should include adding, deleting, modifying, and querying the inventory table. The business scenarios corresponding to the finance role include payment reconciliation and refund processing. The data access permissions for the finance role should include querying and updating the payment table and the refund table. It should be noted that different business scenarios correspond to different combinations of candidate access dimensions forming access permission information.

[0051] S230. Based on the access permission information, match at least one target access dimension from the candidate access dimensions, and generate database authorization information based on the target access dimension.

[0052] Candidate access dimensions can include user dimension, database dimension, and data table dimension.

[0053] Optionally, database authorization information can be generated based on the target access dimension, including: integrating at least one target access dimension using wildcards to generate database authorization information.

[0054] By integrating different target access dimensions through wildcards, different access policies can be specified for different users, databases, and data tables, improving the flexibility of whitelist configuration and enabling adaptation to different business scenarios.

[0055] S240. Based on the whitelist data table and the production database data table, perform security verification on candidate database statements in the target application environment.

[0056] This application embodiment improves the flexibility and applicability of whitelist configuration by configuring multi-dimensional database authorization information, including user, database, and data table dimensions, according to at least one business scenario, and sequentially specifying different protection policies for users, databases, and data tables, so as to adapt to more complex database environments.

[0057] Example 3

[0058] Figure 3 This is a schematic diagram of a database security management device according to Embodiment 3 of this application. It is applicable to situations where data in a database in a production environment is subject to security management. This database security management device can be implemented in hardware and / or software and can be configured in computer equipment, such as a server. Figure 3 As shown, the device includes:

[0059] The database monitoring module 310 is used to monitor the database in the target application environment in real time and generate a production database data table; wherein, the production database data table is used to record the production database that is already running in the target application environment, and the target application environment is used to characterize the application environment that has been put into production;

[0060] The whitelist generation module 320 is used to generate database authorization information in at least one business scenario based on data access permission information, as a whitelist data table; wherein, the whitelist data table is used to represent the database authorization information corresponding to the user dimension, database dimension and data table dimension.

[0061] The security verification module 330 is used to perform security verification on candidate database statements in the target application environment based on the whitelist data table and the production database data table; wherein, the candidate database statements are database operation statements to be executed.

[0062] This application embodiment performs a security verification on the candidate database statements before execution, based on database authorization information defined in at least one business scenario in the target application environment. This ensures that only candidate database statements that conform to the whitelist data table can be executed, reducing the risk of data misprocessing in the database of the target application environment and improving the security of data in the target application environment.

[0063] Optionally, the whitelist generation module 320 includes:

[0064] The permission confirmation unit is used to determine the access permission information of the production database under the business scenario based on at least one business scenario in the target application environment.

[0065] The authorization information confirmation unit is used to determine the access permission information of the production database under the business scenario based on at least one business scenario in the target application environment.

[0066] Optionally, the authorization information confirmation unit may be specifically used to: integrate at least one target access dimension using wildcards to generate database authorization information.

[0067] Optionally, the security verification module 330 may be specifically used to: determine the initiating object and the target operation object of the candidate database statement based on the candidate database statement; wherein, the target operation object includes the target database and the target data table; if the target operation object is in the production database data table, then based on the initiating object and the target operation object, perform information matching in the whitelist data table to determine whether the initiating object and the target operation object conform to the database authorization information defined in the whitelist data table; if they conform, then execute the candidate database statement.

[0068] Optionally, the device may also include:

[0069] The caching module is used to extract the target access dimension information corresponding to each database authorization information in the whitelist data table after the whitelist data table is generated, and write the target access dimension information and the access permissions corresponding to the target access dimension information into the database cache as a memory object in the form of key-value pairs.

[0070] Optionally, the matching priorities of memory objects in the database cache are different, with memory objects containing wildcards having a lower priority than memory objects without wildcards.

[0071] The database security management device provided in this application embodiment can execute the database security management method provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects for executing the security management method of each database.

[0072] According to embodiments of this application, this application also provides an electronic device, a readable storage medium, and a computer program product.

[0073] Example 4

[0074] Figure 4This is a schematic diagram of the structure of an electronic device 410 implementing the database security management method of the embodiments of this application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or claimed herein.

[0075] like Figure 4 As shown, the electronic device 410 includes at least one processor 411 and a memory, such as a read-only memory 412 or a random access memory 413, communicatively connected to the at least one processor 411. The memory stores computer programs executable by the at least one processor. The processor 411 can perform various appropriate actions and processes based on the computer program stored in the read-only memory 412 or loaded from storage unit 418 into the random access memory 413. The random access memory 413 can also store various programs and data required for the operation of the electronic device 410. The processor 411, read-only memory 412, and random access memory 413 are interconnected via a bus 414. An input / output interface 415 is also connected to the bus 414.

[0076] Multiple components in electronic device 410 are connected to input / output interface 415, including: input unit 416, such as keyboard, mouse, etc.; output unit 417, such as various types of monitors, speakers, etc.; storage unit 418, such as disk, optical disk, etc.; and communication unit 419, such as network card, modem, wireless transceiver, etc. Communication unit 419 allows electronic device 410 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0077] Processor 411 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 411 include, but are not limited to, central processing units, graphics processing units, various special-purpose artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any suitable processor, controller, microcontroller, etc. Processor 411 performs the various methods and processes described above, such as database security management methods.

[0078] In some embodiments, the database security management method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 418. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 410 via read-only memory 412 and / or communication unit 419. When the computer program is loaded into random access memory 413 and executed by processor 411, one or more steps of the database security management method described above may be performed. Alternatively, in other embodiments, processor 411 may be configured as the database security management method by any other suitable means (e.g., by means of firmware).

[0079] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays, application-specific integrated circuits (ASICs), application-specific standard products (ASICs), systems-on-a-chip (SoCs), payload programmable logic devices, computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0080] Computer programs used to implement the methods of this application may be written in any combination of one or more programming languages. These computer programs may be provided to the processor of a general-purpose computer, a special-purpose computer, or other security control device for a programmable database, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0081] In the context of this application, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, optical fibers, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0082] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a cathode ray tube or liquid crystal display monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0083] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0084] A computing system can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product within the cloud computing service system to address the shortcomings of traditional physical hosts and virtual private servers, such as high management difficulty and weak business scalability.

[0085] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this application can be achieved, and this is not limited herein.

[0086] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A database security management method, characterized in that, include: Real-time monitoring of the database in the target application environment generates a production database table; wherein, the production database table is used to record the production database that is already running in the target application environment, and the target application environment is used to characterize the application environment that has been put into production; Based on data access permission information, database authorization information for at least one business scenario is generated as a whitelist data table; wherein, the whitelist data table is used to represent the database authorization information corresponding to the user dimension, database dimension and data table dimension. Based on the whitelist data table and the production database data table, security verification is performed on candidate database statements in the target application environment; wherein, the candidate database statements are database operation statements to be executed.

2. The method according to claim 1, characterized in that, The process of generating database authorization information for at least one business scenario based on data access permission information, as a whitelist data table, includes: Based on at least one business scenario in the target application environment, determine the access permission information of the production database under the business scenario; Based on the access permission information, at least one target access dimension is matched from the candidate access dimensions, and database authorization information is generated based on the target access dimension; wherein, the candidate access dimensions include user dimension, database dimension, and data table dimension.

3. The method according to claim 2, characterized in that, The step of generating database authorization information based on the target access dimension includes: Wildcards are used to integrate at least one target access dimension to generate database authorization information.

4. The method according to claim 1, characterized in that, The security verification of candidate database statements in the target application environment based on the whitelist data table and the production database data table includes: The initiating object and target operation object of the candidate database statement are determined based on the candidate database statement; wherein, the target operation object includes the target database and the target data table; If the target operation object is in the production database data table, then based on the initiating object and the target operation object, information matching is performed in the whitelist data table to determine whether the initiating object and the target operation object conform to the database authorization information defined in the whitelist data table; If the conditions are met, the candidate database statement is executed.

5. The method according to claim 1, characterized in that, After generating the whitelist data table, the following is also included: Extract the target access dimension information corresponding to each database authorization information in the whitelist data table, and write the target access dimension information and the access permissions corresponding to the target access dimension information into the database cache as a memory object in the form of key-value pairs.

6. The method according to claim 5, characterized in that, The matching priorities of memory objects in the database cache are different; memory objects with wildcards have lower priority than memory objects without wildcards.

7. A database security management device, characterized in that, include: The database monitoring module is used to monitor the database in the target application environment in real time and generate a production database data table; wherein, the production database data table is used to record the production database that is already running in the target application environment, and the target application environment is used to characterize the application environment that has been put into production; The whitelist generation module is used to generate database authorization information for at least one business scenario based on data access permission information, as a whitelist data table; wherein, the whitelist data table is used to represent the database authorization information corresponding to the user dimension, database dimension and data table dimension; The security verification module is used to perform security verification on candidate database statements in the target application environment based on the whitelist data table and the production database data table; wherein, the candidate database statements are database operation statements to be executed.

8. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the database security management method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements the database security management method as described in any one of claims 1-6.

10. A computer program product comprising a computer program that, when executed by a processor, implements a database security management method according to any one of claims 1-6.

Images