Database security protection system and method, program product, storage medium and equipment

Abstract

The invention provides a database security protection system and method, a program product, a storage medium and device.According to the database security protection system, the control function of a database security audit product is separated into a control center and a strategy control unit, and the control center is deployed in the form of hardware equipment or software; the strategy control unit is deployed at a database server side, the control center issues a control strategy to the strategy control unit, and when an SQL request for accessing database resources reaches a database, the strategy control unit detects the SQL request according to the control strategy and executes corresponding control actions, so that the security of the database is guaranteed. Due to the fact that software-hardware combination deployment or software-software combination deployment is adopted, for database resources with scattered logic or physical positions, management and control over a plurality of databases can be achieved only through one control center without deploying a plurality of safety hardware devices, and therefore deployment cost is effectively reduced, and occupation of physical space is reduced.

Description

Technical Field

[0001] This application relates to the field of database security technology, and more specifically, to a database security protection system, method, program product, storage medium, and device. Background Technology

[0002] With the continuous development of computer technology, database applications are becoming increasingly widespread. As the core of information systems, the security of databases is of paramount importance. Database security auditing products are crucial tools for ensuring database security, including database auditing systems and database auditing and protection systems. Related technologies typically deploy the hardware devices housing the database security auditing products in a serial or bypass configuration, placing them before the database system. This allows the database security auditing products to acquire network traffic accessing the database. The products can then perform protocol parsing on this traffic, reconstruct SQL operations, and match the reconstructed SQL operations against configured auditing rules to intercept and protect against high-risk operations such as SQL injection or unauthorized access. However, for database resources that are logically or physically dispersed, deploying a separate hardware system before each or multiple resources is costly and physically space-consuming. Summary of the Invention

[0003] The purpose of this application is to provide a database security protection system, method, program product, storage medium and device, which aims to solve the problem that database security protection methods in related technologies require the deployment of a hardware system for each or more database resources that are logically or physically dispersed, resulting in high costs and physical space occupation.

[0004] In a first aspect, this application provides a database security protection system, including a control center and a policy control unit; wherein: the control center is deployed in the form of hardware or software; the control center is used to issue control policies to the policy control unit; the policy control unit is deployed on the database server; the policy control unit is used to receive the control policies, detect SQL requests for accessing database resources according to the control policies, and execute corresponding control actions based on the detection results.

[0005] In the above implementation process, the database security protection system separates the control functions of the database security audit product into a control center and a policy control unit. The control center is deployed in hardware or software, while the policy control unit is deployed on the database server. The control center issues control policies to the policy control unit. When an SQL request to access database resources arrives at the database, the policy control unit detects it according to the control policy and executes the corresponding control action, thereby ensuring database security. Because it is a combination of hardware and software or software and software deployment, for database resources that are logically or physically dispersed, there is no need to deploy multiple security hardware devices. Only one control center is needed to manage multiple databases, thereby effectively reducing deployment costs and minimizing the physical space occupied.

[0006] Furthermore, in some examples, the system includes multiple policy control units; each policy control unit is deployed on a database server; the control center is used to identify the policy control units deployed in the database to be managed as target policy control units, and issue target management policies to the target policy control units; the target management policies include management rules for the database to be managed.

[0007] In the above implementation process, managers formulate multiple sets of control policies in the control center. Different sets of control policies correspond to different databases. The control center issues each control policy to the policy control unit in the corresponding database, thus achieving centralized control of multiple databases.

[0008] Furthermore, in some examples, the control strategy includes matching rules for dangerous operations; the strategy control unit is specifically used to: detect information in the SQL request according to the matching rules, and when the SQL request matches the matching rules, determine that the SQL request is a dangerous operation and discard the data packet corresponding to the SQL request.

[0009] In the above implementation process, when a client or web service accesses database resources via SQL, the policy control unit detects the information in the SQL request according to matching rules that can be used to identify dangerous operations. Once a match is found, it is considered a dangerous operation, and the corresponding data packet is discarded, preventing dangerous operations from actually operating on sensitive database resources and effectively ensuring the security of database resources.

[0010] Furthermore, in some examples, the policy control unit is also used to: generate alarm information based on the SQL request that matches the matching rule, and return the alarm information to the control center; the control center is also used to: receive the alarm information and store it.

[0011] In the above implementation process, for SQL requests that match the rules, the policy control unit generates an alarm message and returns it to the control center. The control center stores the alarm message, thus achieving the observability of control information and recording the blocked operations.

[0012] Furthermore, in some examples, the control center is also used to: encrypt the control policy and send the encrypted control policy to the policy control unit; the policy control unit is also used to: decrypt the encrypted control policy after receiving it.

[0013] In the above implementation process, the control center converts the plaintext control policy into unreadable ciphertext before sending it to the policy control unit. This prevents the control policy from being tampered with or forged during transmission and ensures that the policy control unit executes the control commands as expected.

[0014] Secondly, this application provides a database security protection method applied to a policy control unit; the policy control unit is deployed on a database server; the method includes: receiving a control policy issued by a control center; the control center is deployed in the form of hardware or software; detecting SQL requests for accessing database resources according to the control policy; and executing corresponding control actions based on the detection results.

[0015] Furthermore, in some examples, the control strategy includes matching rules for dangerous operations; the execution of corresponding control actions based on the detection results includes: when the SQL request matches the matching rule, determining that the SQL request is a dangerous operation and discarding the data packet corresponding to the SQL request; generating alarm information based on the SQL request and returning the alarm information to the control center.

[0016] Thirdly, this application provides a database security protection device, which is deployed on a database server; the device includes: a receiving module for receiving control policies issued by a control center; the control center is deployed in the form of hardware or software; a detection module for detecting SQL requests to access database resources according to the control policies; and an execution module for executing corresponding control actions based on the detection results.

[0017] Fourthly, this application provides an electronic device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the method as described in any of the second aspects.

[0018] Fifthly, this application provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method as described in any of the second aspects.

[0019] Sixthly, this application provides a computer program product that, when run on a computer, causes the computer to perform the method described in any of the second aspects.

[0020] Other features and advantages disclosed in this application will be set forth in the following description, or some features and advantages may be inferred from the description or determined without doubt, or may be learned by practicing the above-described technology disclosed in this application.

[0021] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a schematic diagram of a database security protection system provided in an embodiment of this application; Figure 2 A schematic diagram illustrating the architecture of a database security operation control system applied in a multi-point control scenario, provided in an embodiment of this application; Figure 3 A flowchart illustrating a database security protection method provided in this application embodiment; Figure 4 A block diagram of a database security protection device provided in an embodiment of this application; Figure 5 This is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0024] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0025] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0026] Database auditing systems and database auditing and protection systems are two types of database security auditing products. Database auditing systems focus on post-event auditing and monitoring, while database auditing and protection systems provide real-time protection capabilities. In related technologies, database auditing systems are typically deployed in a bypass configuration on the switch where the database service resides. Traffic is mirrored and audited, with the resulting audit logs serving as the basis for tracing the source. Database auditing and protection systems, on the other hand, are often deployed in series between the database and web services to enable timely control and response to dangerous operations. For database resources that are logically or physically dispersed, a separate hardware system needs to be deployed between each or multiple resources, which incurs high deployment costs and requires significant physical space.

[0027] To address the aforementioned issues, this application provides a database security protection system. A policy control unit is deployed at the database end. A control center issues management policies, and the policy control unit detects SQL requests accessing database resources according to these policies and executes corresponding control actions based on the detection results. By separating the control function into a control center and a policy control unit deployed at the database end, the flexibility of deployment is improved. It can be deployed using a combination of hardware and software, or a combination of both, effectively reducing deployment costs and minimizing physical space usage.

[0028] The embodiments of this application will be described below: like Figure 1 As shown, Figure 1 This is a schematic diagram of a database security protection system provided in an embodiment of this application. The database security protection system 11 includes a control center 12 and a policy control unit 13. The control center 12 is deployed in the form of hardware or software. The control center 12 is used to issue control policies to the policy control unit 13. The policy control unit 13 is deployed on the database server 14. The policy control unit 13 is used to receive the control policies, detect SQL requests for accessing database resources 15 according to the control policies, and execute corresponding control actions based on the detection results.

[0029] The aforementioned database security protection system (hereinafter referred to as the "system" for ease of discussion) divides the control functions of the database security audit product into a control center and a policy control unit. This allows the control center to be deployed in either hardware or pure software, achieving a diverse range of control center configurations. In implementation, the control policies issued by the control center can include those used by the database audit system when auditing traffic, as well as those used by the database audit and protection system. The policy control unit can be considered a security probe deployed on the database server. The control center and the policy control unit can be connected via a network. The control center issues control policies to the policy control unit. When an SQL request to access database resources arrives at the database, the policy control unit deployed on the database server detects it according to the control policy and executes corresponding control actions, such as allowing or blocking, thereby effectively ensuring database security. For database resources that are logically or physically dispersed, it is only necessary to deploy security probes in each database, centrally formulate policy rules in the control center, and remotely issue the security probes to each database. This achieves centralized management, effectively reducing deployment costs and physical space requirements.

[0030] In some embodiments, the system may include multiple policy control units; each policy control unit is deployed on a database server; the control center is used to identify the policy control units deployed in the database to be managed as target policy control units, and issue target management policies to the target policy control units; the target management policy includes management rules for the database to be managed. That is, the system can be applied to multi-point management scenarios, where administrators formulate multiple sets of management policies at the control center, with different sets of management policies corresponding to different databases. The control center issues each management policy to the policy control units in the corresponding database. For example, if an administrator formulates a management rule to manage the user table in database M, the control center identifies the policy control unit in database M as the target policy control unit and issues the management rule to that target policy control unit. This achieves centralized management of multiple databases.

[0031] In some embodiments, the control policy may include matching rules for dangerous operations. The policy control unit is specifically configured to: detect information in the SQL request according to the matching rules; when the SQL request matches the matching rules, determine that the SQL request is a dangerous operation and discard the data packet corresponding to the SQL request. In other words, the control policy includes matching rules that can be used to identify dangerous operations. When a client or web service accesses database resources via SQL, the policy control unit detects information such as the source IP address, instance name, table name, and fields in the SQL request according to the matching rules. Once a match is found, it is considered a dangerous operation, and the corresponding data packet can be discarded at the underlying level using eBPF (Extended Berkeley Packet Filter) technology. This prevents dangerous operations from actually operating on sensitive database resources, effectively ensuring the security of database resources.

[0032] Furthermore, in some embodiments, the policy control unit is also configured to: generate alarm information based on the SQL request that matches the matching rule, and return the alarm information to the control center; the control center is further configured to: receive the alarm information and store it. That is, for an SQL request that matches the matching rule, the policy control unit generates an alarm information and returns it to the control center. This alarm information can record the source IP address, access time, instance name, table name, executed operation, and the specific matching rule matched by the SQL request. The control center stores this alarm information, thus achieving observability of control information and recording blocked operations.

[0033] Considering that attackers might tamper with the control policies issued by the control center to bypass controls and attack the database, in some embodiments, the control center is further configured to: encrypt the control policies and send the encrypted control policies to the policy control unit; the policy control unit is further configured to: receive the encrypted control policies and decrypt them. In other words, after administrators set up the control policies in the control center, the control center first encrypts the control policies, converting the plaintext control policies into unreadable ciphertext, before sending them to the policy control unit. This prevents the control policies from being tampered with or forged during transmission, ensuring that the policy control unit executes control commands as expected.

[0034] The database security protection system in this application separates the control functions of the database security audit product into a control center and a policy control unit. The control center is deployed in hardware or software, while the policy control unit is deployed on the database server. The control center issues control policies to the policy control unit. When an SQL request to access database resources arrives at the database, the policy control unit detects it according to the control policy and executes corresponding control actions, thereby ensuring database security. Because it is a combination of hardware and software or software and software deployment, for database resources that are logically or physically dispersed, there is no need to deploy multiple security hardware devices. Only one control center is needed to manage multiple databases, effectively reducing deployment costs and physical space requirements.

[0035] To provide a more detailed explanation of the solution in this application, a specific embodiment is described below: This embodiment provides a database security operation control system applied to multi-point control scenarios. The architecture of the system is as follows: Figure 2 As shown, the system includes a control center 12 and four security probes. The control center 12 is deployed as a hardware device. The four security probes are security probe H (numbered 21 in the figure), security probe I (numbered 22 in the figure), security probe J (numbered 23 in the figure), and security probe K (numbered 24 in the figure), deployed in databases A (numbered 25 in the figure), B (numbered 26 in the figure), C (numbered 27 in the figure), and D (numbered 28 in the figure), respectively. This system can centrally manage multiple databases. Taking the control center 12 managing database A as an example, the process can include: S201. Configure control rules in Control Center 12; for example, when it is necessary to control the user table of database A and prohibit the IP address 192.168.2.5 from accessing this table, the content of the control rule can be configured as {src_ip=”192.168.2.5” dst_database=”database A” table_name=”user” operate_type=”all”}, where “all” means prohibiting all operations on this table; S202, Control Center 12 issues control rules to Security Probe H; S203. The client requests an operation on a table in database A via SQL and sends a data message. S204. If security probe H captures an SQL request, it first determines whether the request is from the IP address 192.168.2.5 accessing database A. If not, access is allowed. If it is, it determines whether the accessed table is the user table. If the accessed table is not the user table, access is allowed, and the data packet is passed to the database service. If the accessed table is the user table, it further determines whether the operation type is all. If so, it is considered a rule hit, and the data packet is discarded to prevent the request data from being passed to the database. S205. For a request to hit a rule, an alarm message body is encapsulated in the security probe H. The alarm message body records the source IP address of the request to hit the rule, the database address accessed, the timestamp, the table name, the operation type, and the final control action executed. S206, Safety probe H sends the alarm message back to control center 12; S207 and Control Center 12 will store the received alarm message body for traceability purposes. Administrators can query the alarm message body on the system interface.

[0036] This embodiment also provides a database security protection system applied in a cloud environment, and... Figure 2 Compared to the system shown, resources in the cloud environment are all virtualized. This system also deploys a software-based control center, and the target database is also virtualized. The management and control processes executed by this system are similar to... Figure 2 The control process of the systems shown is the same, and will not be repeated here.

[0037] The solution in this embodiment has at least the following advantages: First, it is flexible in deployment, and can be deployed using a combination of hardware and software or a combination of both; Second, it reduces security protection costs, simplifying the process from requiring multiple security hardware devices to using a single hardware device or a software-based control center; Third, it solves the problem of database access anomalies caused by the failure of traditional inline firewall devices, reducing unnecessary economic losses.

[0038] Corresponding to the embodiments of the aforementioned system, this application also provides embodiments of database security protection methods, devices, and terminals for their applications: like Figure 3 As shown, Figure 3 This is a flowchart of a database security protection method provided in an embodiment of this application. The method is applied to a policy control unit; the policy control unit is deployed on a database server; the method includes: Step 301: Receive the control strategy issued by the control center; the control center is deployed in the form of hardware devices or software. Step 302: Detect SQL requests for accessing database resources according to the control policy; Step 303: Execute the corresponding control actions based on the detection results.

[0039] In some embodiments, the control strategy includes matching rules for dangerous operations; the execution of corresponding control actions based on the detection results includes: when the SQL request matches the matching rule, determining that the SQL request is a dangerous operation and discarding the data packet corresponding to the SQL request; generating alarm information based on the SQL request and returning the alarm information to the control center.

[0040] For details on the implementation process of each step in the above method, please refer to the implementation process of the above system, which will not be repeated here.

[0041] like Figure 4 As shown, Figure 4 This is a block diagram of a database security protection device provided in an embodiment of this application. The device is deployed on a database server. The device includes: Receiving module 41 is used to receive management and control policies issued by the control center; the control center is deployed in the form of hardware devices or software. Detection module 42 is used to detect SQL requests for accessing database resources according to the control policy; The execution module 43 is used to perform corresponding control actions based on the detection results.

[0042] The specific implementation process of the functions and roles of each module in the above device is detailed in the implementation process of the above system, and will not be repeated here.

[0043] This application also provides an electronic device, please refer to [link to application]. Figure 5 , Figure 5 This is a structural block diagram of an electronic device provided in an embodiment of this application. The electronic device may be a database server. The electronic device may include a processor 510, a communication interface 520, a memory 530, and at least one communication bus 540. The communication bus 540 is used to enable direct communication between these components. In this embodiment, the communication interface 520 of the electronic device is used for signaling or data communication with other node devices. The processor 510 may be an integrated circuit chip with signal processing capabilities.

[0044] The processor 510 described above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor, or the processor 510 can be any conventional processor.

[0045] The memory 530 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc. The memory 530 stores computer-readable instructions. When these computer-readable instructions are executed by the processor 510, the electronic device can perform the aforementioned operations. Figure 3 The various steps involved in the method implementation examples.

[0046] Alternatively, the electronic device may also include a storage controller and an input / output unit.

[0047] The memory 530, storage controller, processor 510, peripheral interface, and input / output unit are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses 540. The processor 510 is used to execute executable modules stored in the memory 530, such as software function modules or computer programs included in electronic devices.

[0048] The input / output unit is used to provide users with the ability to create tasks and to set optional start periods or preset execution times for those tasks, thereby enabling user-server interaction. The input / output unit may be, but is not limited to, a mouse and keyboard.

[0049] Understandable. Figure 5 The structure shown is for illustrative purposes only; the electronic device may also include components that are more advanced than those shown. Figure 5 The more or fewer components shown, or having the same Figure 5 The different configurations shown. Figure 5 The components shown can be implemented using hardware, software, or a combination thereof.

[0050] This application also provides a storage medium storing instructions. When the instructions are run on a computer, the computer program is executed by a processor to implement the method described in the method embodiment. To avoid repetition, the method will not be described again here.

[0051] This application also provides a computer program product that, when run on a computer, causes the computer to perform the method described in the method embodiment.

[0052] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0053] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0054] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0055] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0056] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0057] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A database security protection system, characterized in that, Includes a control center and a policy control unit; wherein: The control center is deployed in the form of hardware devices or software; the control center is used to issue control policies to the policy control unit. The policy control unit is deployed on the database server; the policy control unit is used to receive the management policy, detect SQL requests for accessing database resources according to the management policy, and execute corresponding control actions based on the detection results.

2. The system according to claim 1, characterized in that, The system includes multiple policy control units; each policy control unit is deployed on a database server. The control center is used to identify the policy control units deployed in the database to be managed as target policy control units, and to issue target management policies to the target policy control units; the target management policies include management rules for the database to be managed.

3. The system according to claim 1, characterized in that, The control strategy includes matching rules for hazardous operations; The policy control unit is specifically used to: detect information in the SQL request according to the matching rule; when the SQL request matches the matching rule, determine that the SQL request is a dangerous operation and discard the data packet corresponding to the SQL request.

4. The system according to claim 3, characterized in that, The policy control unit is also configured to: generate alarm information based on the SQL request that matches the matching rule, and return the alarm information to the control center; The control center is also used to: receive and store the alarm information.

5. The system according to claim 1, characterized in that, The control center is also used to: encrypt the control policy and send the encrypted control policy to the policy control unit; The policy control unit is further configured to: receive the encrypted control policy and then decrypt the encrypted control policy.

6. A database security protection method, characterized in that, Applied to the strategy control unit; The policy control unit is deployed on the database server; the method includes: Receive control policies issued by the control center; the control center is deployed in the form of hardware devices or software; SQL requests for accessing database resources are detected according to the control policy. Execute corresponding control actions based on the detection results.

7. The method according to claim 6, characterized in that, The control strategy includes matching rules for hazardous operations; The execution of corresponding control actions based on the detection results includes: When the SQL request matches the matching rule, the SQL request is determined to be a dangerous operation, and the data packet corresponding to the SQL request is discarded. An alarm message is generated based on the SQL request, and the alarm message is returned to the control center.

8. A computer program product, characterized in that, When the computer program product is run on a computer, it causes the computer to perform the method as described in claim 6 or 7.

9. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the method as described in claim 6 or 7.

10. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method as described in claim 6 or 7.

Images