Database security proxy method, system and device and storage medium

Abstract

The invention relates to the field of data security and processing, in particular to a database security proxy method, system and device and a storage medium. The method comprises the following steps: acquiring a request data stream from an original database operation of a client; calling a near field communication security element of the target mobile phone, and obtaining a preset encryption key; compressing the request data stream, generating a random serial number and a current timestamp, and combining the compressed data, the random serial number and the timestamp to obtain combined data; performing digital signature operation on the combined data by using the encryption key to generate an encrypted data packet; and transmitting the encrypted data packet into a security verification area for security verification, and executing the request data stream after the verification is passed. The security and stability of the database can be improved.

Description

Technical Field

[0001] This application relates to the field of data security and processing, and in particular to a database security proxy method, system, device and storage medium. Background Technology

[0002] With the rapid development of information technology, the security of databases, as a core component for storing critical information in enterprises and organizations, has become paramount. In today's digital age, as enterprises undergo profound digital transformation, a large amount of business data and user information rely on databases for management and maintenance.

[0003] In terms of database security, existing technologies employ various methods to ensure database security. Traditional solutions such as VPNs or SSH tunnels provide network-layer encryption, restricting external network access to the database by setting rules to allow only specific IP addresses or specific types of traffic into the database system, thus preventing malicious external attacks to some extent. There are also existing proxy technologies based on the MD5 authentication mechanism (such as CN116996299A), which avoid storing plaintext passwords and enhance security to a certain extent. Other solutions (such as CN116431741B) use HTTP proxies and JWT authentication, leveraging software-layer key management to ensure database access security.

[0004] However, existing database security measures have significant shortcomings. While traditional VPNs or SSH tunnels provide network-layer encryption, they cannot provide fine-grained security control over the database operation commands themselves. Existing proxy technologies (such as CN116996299A) use insufficient MD5 authentication algorithms, making them unable to defend against replay attacks and difficult to accurately determine the legitimacy and timeliness of requests. Schemes using HTTP proxies and JWT authentication (such as CN116431741B) rely on software-layer key management, making them vulnerable to reverse engineering. Furthermore, conventional proxy tools lack the ability to filter SQL command content, making it difficult to prevent SQL injection or unauthorized operations. These shortcomings result in a lack of comprehensive and effective security verification mechanisms in existing technologies, making it difficult to perform detailed security checks on the raw database operation request data stream from the client. This leaves the database still vulnerable to security risks, potentially allowing unauthorized data operations to be executed, severely impacting the database's security and stability. Summary of the Invention

[0005] The purpose of this application is to overcome the above-mentioned technical problems and provide a database security proxy method, system, device and storage medium that can improve the security and stability of the database.

[0006] Firstly, one embodiment of this application discloses a database security proxy method, which adopts the following scheme: A database security proxy method includes: acquiring a request data stream from a client's original database operation; invoking a target mobile phone's near-field communication security element to obtain a preset encryption key; compressing the request data stream and generating a random sequence number and a current timestamp; combining the compressed data, the random sequence number, and the timestamp to obtain combined data; performing a digital signature operation on the combined data using the encryption key to generate an encrypted data packet; transmitting the encrypted data packet to a security verification area for security verification; and executing the request data stream after the verification passes. The security verification includes: verifying whether the source IP address of the request data stream is in a preset whitelist; after successful verification, determining whether the timestamp is within a valid time window and whether the random sequence number is an unused sequence; verifying the validity of the digital signature when the timestamp is valid and the random sequence number is not reused; and determining that the security verification passes after the signature verification passes.

[0007] By employing the above technical solutions, the request data stream from the client's original database operation can be obtained, collecting relevant data on the client's database operations and providing a foundation for subsequent security processing. The target mobile phone's near-field communication (NFC) secure element is invoked to obtain a pre-set encryption key. Utilizing the security of the NFC secure element, a reliable key is provided for data encryption, enhancing data encryption security. The request data stream is compressed, reducing data transmission volume and improving transmission efficiency. A random sequence number and current timestamp are generated and combined with the compressed data. The random sequence number can be used to prevent replay attacks, and the timestamp can be used to determine the timeliness of the request. The combined data is digitally signed using the encryption key to generate an encrypted data packet, ensuring data integrity and non-repudiation and preventing data tampering during transmission. The encrypted data packet is then passed to a security verification area for security verification. Through multi-step security verification, including verifying whether the source IP address is on the whitelist, whether the timestamp is valid, whether the random sequence number is reused, and whether the digital signature is valid, unauthorized access and attacks can be effectively prevented, ensuring the security of database operations. Once the verification is successful, the request data stream is executed, ensuring that only requests that have passed security verification can operate on the database, further guaranteeing database security.

[0008] Optionally, the security verification further includes: after the signature verification is passed, decrypting the encrypted data packet to obtain the decrypted combined data; verifying whether the decrypted combined data contains preset high-risk database operation instructions; if not, the security verification is deemed to have passed.

[0009] By adopting the above technical solution, after the signature verification is passed, the encrypted data packet is decrypted to obtain the combined data, which can restore the encrypted data to a verifiable form. Verifying whether the decrypted combined data contains preset high-risk database operation instructions can accurately identify operations that may threaten database security. If it does not contain high-risk database operation instructions, the security verification is deemed to have passed, which can ensure that the executed request data stream will not pose a security risk to the database, and further improve the security of database operations.

[0010] Optionally, the step of determining whether the random sequence number is an unused sequence is as follows: query whether the random sequence number has been recorded in the local or distributed cache; if it has been recorded, it is determined to be a replay attack and the request is rejected; if it has not been recorded, the random sequence number is written into the cache after the current verification passes, and an expiration period is set.

[0011] By adopting the above technical solution, querying whether a random sequence number has been recorded in the local or distributed cache can quickly determine whether the sequence number has been used. If it has been recorded, it is identified as a replay attack and the request is rejected, which can effectively prevent malicious attackers from launching replay attacks using duplicate sequence numbers and ensure the security of database operation requests. If it has not been recorded, the random sequence number is written to the cache and an expiration period is set after the current verification is passed. This can effectively manage the usage of sequence numbers, prevent the same sequence number from being reused outside the specified time, further enhance the system's ability to identify and defend against requests, and improve the reliability of the database security proxy.

[0012] Optionally, before invoking the near-field communication secure element of the target mobile phone, the process further includes: sending a device status query request, the query request containing the device identifier of the target mobile phone; receiving the query result, determining whether the target mobile phone is on the device revocation list, and if so, refusing to obtain the encryption key and terminating the current process.

[0013] By adopting the above technical solution, a device status query request containing the target mobile device identifier can be sent to obtain the status information of the target mobile phone; by receiving the query result and determining whether the target mobile phone is on the device revocation list, devices with security risks can be identified in advance; if the target mobile phone is on the revocation list, the encryption key is refused to be obtained and the current process is terminated, which can avoid using the encryption key of devices with security risks, thereby ensuring the security of database operations and preventing potential security threats from damaging the database.

[0014] Optionally, the security verification area is a logically isolated execution environment used to independently run the security verification logic.

[0015] By adopting the above technical solution, the security verification area adopts a logically isolated execution environment, which can independently run the security verification logic. This avoids interference from the external environment on the security verification process, improves the stability and reliability of the security verification logic, and prevents other programs from illegally accessing and tampering with the security verification logic, thereby enhancing the security of the database security proxy method.

[0016] Optionally, it also includes: recording the verification process and judgment result of the security verification, and generating a structured security audit log in a preset format for storage.

[0017] By adopting the above technical solutions, the process and results of security verification are recorded, which can retain detailed information on database security agent operations, facilitating subsequent traceability and review. The generation and storage of structured security audit logs according to preset formats can make the audit logs have a unified and standardized format, which can facilitate the management, analysis and query of logs and improve audit efficiency and effectiveness.

[0018] Secondly, another embodiment of this application discloses a database security proxy system, which adopts the following scheme: A database security proxy system includes: an acquisition module for acquiring a request data stream from a client's original database operation; an invocation module for invoking a target mobile phone's near-field communication security element to acquire a preset encryption key; a combination module for compressing the request data stream, generating a random sequence number and a current timestamp, and combining the compressed data, the random sequence number, and the timestamp to obtain combined data; a signature module for performing a digital signature operation on the combined data using the encryption key to generate an encrypted data packet; and a verification and execution module for passing the encrypted data packet into a security verification area for security verification, and executing the request data stream after successful verification. The security verification includes: verifying whether the source IP address of the request data stream is in a preset whitelist; after successful verification, determining whether the timestamp is within a valid time window and whether the random sequence number is an unused sequence; and verifying the validity of the digital signature when the timestamp is valid and the random sequence number is not reused, and determining that the security verification is successful after successful signature verification.

[0019] By adopting the above technical solutions, the acquisition module obtains the request data stream from the client's original database operation, providing basic data for subsequent security processing; the invocation module invokes the target mobile phone's near-field communication security element to obtain a preset encryption key, leveraging the phone's security element to enhance key security; the combination module compresses the request data stream, reducing data transmission volume, generating a random sequence number and current timestamp, and combining them with the compressed data, increasing data uniqueness and timeliness; the signature module uses the encryption key to perform digital signature operations on the combined data to generate encrypted data packets, ensuring data integrity and non-repudiation; the verification and execution module transmits the encrypted data packets to the security verification area for security verification. By verifying whether the source IP address of the request data stream is within a preset whitelist, requests initiated by illegal IPs can be prevented; determining whether the timestamp is within a valid time window can avoid processing expired requests; determining whether the random sequence number is an unused sequence can prevent replay attacks; verifying the validity of the digital signature ensures that the data has not been tampered with during transmission; and executing the request data stream after successful verification ensures the security of database operations.

[0020] Optionally, the security verification further includes: after the signature verification is passed, decrypting the encrypted data packet to obtain the decrypted combined data; verifying whether the decrypted combined data contains preset high-risk database operation instructions; if not, the security verification is deemed to have passed.

[0021] By adopting the above technical solution, encrypted data packets are decrypted to obtain combined data, which can be further verified. The combined data is checked to see if it contains preset high-risk database operation instructions, which can accurately identify potential dangerous operations. If it does not contain high-risk instructions, the security check is deemed to have passed, which can ensure the security of database operations and avoid database security problems caused by high-risk instructions.

[0022] Thirdly, another embodiment of this application discloses an electronic device that adopts the following solution: An electronic device, comprising: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, the processor being configured to load and execute the computer program stored in the memory to cause the electronic device to perform the database security proxy method as described in any of the preceding claims.

[0023] Fourthly, another embodiment of this application discloses an electronic device that adopts the following solution: A computer-readable storage medium storing a computer program that, when loaded and executed by a processor, implements the database security proxy method as described in any of the preceding claims.

[0024] In summary, this application includes at least one of the following beneficial technical effects: 1. The system compresses the request data stream, generates and combines random sequence numbers and timestamps, performs digital signature operations using encryption keys to generate encrypted data packets, and combines multiple security verification mechanisms to provide fine-grained security control over the database operation instructions themselves, effectively enhancing database security. 2. By determining whether the random sequence number is an unused sequence, replay attacks can be effectively defended, and the legitimacy and timeliness of requests can be accurately determined; 3. The encryption key is obtained by calling the target mobile phone's near-field communication security element, avoiding reliance on software-layer key management and reducing the risk of being reverse engineered. At the same time, the decrypted combined data is verified by high-risk database operation instructions to prevent SQL injection or unauthorized operations. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating a database security proxy method disclosed in an embodiment of this application; Figure 2 This is a flowchart illustrating the verification process in a database security proxy method disclosed in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of a database security agent system disclosed in another embodiment of this application. Detailed Implementation

[0026] The present application will be further described in detail below with reference to the accompanying drawings.

[0027] Embodiments of this application will now be described in more detail with reference to the accompanying drawings. While embodiments of this application are shown in the drawings, it should be understood that this application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to make this application more thorough and complete, and to fully convey the scope of this application to those skilled in the art.

[0028] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a” and “the” as used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0029] It should be understood that although the terms "first," "second," etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0030] The technical solutions of the embodiments of this application are described in detail below with reference to the accompanying drawings.

[0031] [First Embodiment] See Figure 1 The first embodiment of this application discloses a database security proxy method, which includes steps such as obtaining a request data stream, calling a security element to obtain an encryption key, data combination, signature operation, security verification, and executing the request data stream.

[0032] By encrypting the request data stream and performing multi-dimensional security checks, comprehensive security checks on database operation requests are achieved, ensuring the security and stability of the database.

[0033] Specifically, the steps are as follows: S10. Obtain the request data stream from the client's original database operation; Specifically, when a user starts SSMS (SQL Server Management Studio) and executes SQL operations, the client agent module intercepts the command stream.

[0034] In step S10, the request data stream from the client's original database operation is obtained, which can be achieved through a network interface or a proxy server. The network interface can be an Ethernet interface, a wireless interface, etc., with different interfaces suitable for different network environments. For example, Ethernet interfaces are commonly used in enterprise intranets, while wireless interfaces are more suitable for mobile office scenarios.

[0035] S20. Call the target mobile phone's near-field communication security element to obtain the preset encryption key; The near-field communication (NFC) secure element can be an NFC chip or a security chip in the mobile phone. These chips offer high security and effectively protect the encryption key. During invocation, a NFC connection needs to be established with the target mobile phone, for example, through NFC. Once the encryption key is obtained, it provides security for subsequent digital signature operations.

[0036] This explains that storing the encryption key in the Near Field Communication Secure Element (NFC Secure Element for mobile phones) completely eliminates the risk of software storage leakage, as the private key does not leave the hardware.

[0037] S30. Compress the request data stream and generate a random sequence number and the current timestamp. Combine the compressed data, the random sequence number and the timestamp to obtain combined data. The request data stream is compressed using common compression algorithms such as ZIP and GZIP. Compression reduces data volume and improves transmission efficiency. Simultaneously, a random sequence number and a current timestamp are generated. The random sequence number is generated using a random number generator, ensuring that each generated sequence number is unique. The current timestamp can be obtained from the system time. The compressed data, random sequence number, and timestamp are combined to obtain composite data. This composite data contains key information about the request data stream and time and sequence identifiers.

[0038] S40. Use the encryption key to perform a digital signature operation on the combined data to generate an encrypted data packet; Digital signature operations can employ common encryption algorithms such as RSA and DSA. Encrypted data packets offer high security, preventing data tampering during transmission.

[0039] S50. Pass the encrypted data packet into the security verification area for security verification. Execute the request data stream after the verification is successful. The encrypted data is transmitted via a target port (e.g., 8888) to the security gateway (corresponding to the security verification area) for security verification. The security verification area is a logically isolated execution environment used to independently run the security verification logic. This logical isolation prevents external interference and ensures the accuracy of the security verification.

[0040] See Figure 3 In this embodiment, the security verification includes multiple steps: First, verify whether the source IP address of the requested data stream is in the preset whitelist.

[0041] The whitelist can be pre-configured to allow only specific IP addresses to initiate database operation requests, which can effectively prevent access from unauthorized external IPs.

[0042] After the verification is successful, it is determined whether the timestamp is within the valid time window and whether the random sequence number is an unused sequence.

[0043] The process of determining whether a random sequence number is unused involves checking whether it is already recorded in the local or distributed cache. If it is recorded, it is considered a replay attack, and the request is rejected. If it is not recorded, the random sequence number is written to the cache after the current verification passes, and an expiration period is set. This prevents replay attacks and ensures the timeliness and uniqueness of requests.

[0044] The validity of the digital signature is verified when the timestamp is valid and the random sequence number is not reused. Once the signature verification is successful, the security check is considered successful.

[0045] Verifying the validity of a digital signature ensures that the data has not been tampered with during transmission.

[0046] In addition, in this embodiment, the security verification also includes filtering dangerous instructions. Specifically, after the signature verification is passed, the encrypted data packet is decrypted to obtain the decrypted combined data.

[0047] Dangerous commands, such as DROP and xp_cmdshell, can be decrypted using the same algorithm and key as encryption. The decrypted data is then checked to see if it contains any preset high-risk database operation commands. If not, the security check passes. This prevents high-risk behaviors such as SQL injection or unauthorized access.

[0048] Therefore, in this embodiment of the application, a funnel-shaped security verification chain is used: a multi-layered verification process is designed, consisting of IP whitelist → timestamp → random sequence number → digital signature → SQL filtering. Each layer intercepts illegal requests in turn, which can balance security and performance.

[0049] In addition, it is worth noting in this embodiment that native TDS database protocol pass-through is supported, without the need to modify the client or database server. Furthermore, in step S20: before invoking the near-field communication secure element of the target mobile phone, the following is also included: S11. Send a device status query request, which includes the device identifier of the target mobile phone. S12. Receive the query result, determine whether the target mobile phone is on the device revocation list, and if so, refuse to obtain the encryption key and terminate the current process.

[0050] This prevents the use of revoked equipment for database operations, thus improving security.

[0051] Furthermore, the method also includes: S60. Record the security verification process and judgment results, and generate a structured security audit log in a preset format for storage.

[0052] The security gateway records all authentication operations (including failed attempts), generates structured logs, and sends them to the SIEM (Security Information and Event Management) system. Log fields include: client ID, source IP address, SQL command fingerprint (SHA-256 hash), timestamp, and authentication result.

[0053] The implementation principle of this embodiment is as follows: This method comprehensively and effectively ensures the security of the database by encrypting the request data stream, performing multi-dimensional security checks, and checking the device status. It effectively prevents security risks such as replay attacks, SQL injection, and unauthorized operations. Simultaneously, by recording security audit logs, it facilitates subsequent security management and problem investigation. Compared with existing technologies, it has a more comprehensive and detailed security verification mechanism, improving the security and stability of the database.

[0054] [Second Embodiment] See Figure 2 The second embodiment of this application discloses a database security proxy system, including: an acquisition module 210, a calling module 220, a combination module 230, a signature module 240, and a verification and execution module 250.

[0055] The module 210 is used to acquire the request data stream from the client's original database operation; the module 220 is used to invoke the target mobile phone's near-field communication security element to acquire a preset encryption key; the module 230 is used to compress the request data stream, generate a random sequence number and a current timestamp, and combine the compressed data, the random sequence number and the timestamp to obtain combined data; the module 240 is used to perform a digital signature operation on the combined data using the encryption key to generate an encrypted data packet; and the module 250 is used to pass the encrypted data packet to a security verification area for security verification, and execute the request data stream after the verification is successful. The security verification includes: verifying whether the source IP address of the request data stream is in a preset whitelist; after the verification is passed, determining whether the timestamp is within a valid time window and whether the random sequence number is an unused sequence; when the timestamp is valid and the random sequence number is not reused, verifying the validity of the digital signature; when the signature verification is passed, the security verification is deemed to be passed.

[0056] It should be noted that the database security proxy system disclosed in this embodiment implements the database security proxy method as described in the above embodiment, and therefore will not be described in detail here. Optionally, each module and the other operations or functions described above are for implementing the methods in the aforementioned embodiments.

[0057] [Third Embodiment] The third embodiment of this application discloses an electronic device, which includes a memory and a processor. The memory is used to store a computer program; the processor is used to execute the computer program to implement the steps of the database security proxy method described in the first embodiment above. For details, please refer to the above description and will not be elaborated here.

[0058] The technical effect of the electronic device provided in this embodiment in practical application is the same as that of the database security proxy method in the first embodiment.

[0059] [Fourth Embodiment] A computer-readable storage medium is disclosed in the fourth embodiment of this application. The computer-readable storage medium is, for example, a non-volatile memory, such as magnetic media (e.g., hard disks, floppy disks, and magnetic tapes), optical media (e.g., CD-ROMs and DVDs), magneto-optical media (e.g., optical discs), and hardware devices specifically configured for storing and executing computer-executable instructions (e.g., read-only memory (ROM), random access memory (RAM), flash memory, etc.). A computer program is stored on the computer-readable storage medium. The computer-readable storage medium can be executed by one or more processors or processing devices to implement a database security proxy method as described in the foregoing embodiments.

[0060] Furthermore, it is understood that the foregoing embodiments are merely illustrative examples of the present invention. Provided that the technical features do not conflict, the structure is not contradictory, and the inventive purpose of the present invention is not violated, the technical solutions of the various embodiments can be arbitrarily combined and used.

[0061] In the embodiments provided by this invention, it should be understood that the disclosed methods, systems, and measuring devices can be implemented in other ways. For example, the modules included in the systems described above are merely illustrative, and the division of modules is only a logical functional division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0062] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0063] Furthermore, in the various embodiments of the present invention, the functional units / modules can be integrated into one processing unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated into one unit / module. The integrated unit / module described above can be implemented in hardware or in the form of hardware plus software functional units / modules.

[0064] The integrated units / modules implemented as software functional units / modules described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause one or more processors of a computer measurement device (which may be a personal computer, server, or network measurement device, etc.) to execute some steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0065] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A database security proxy method, characterized in that, include: Obtain the request data stream from the client's original database operation; Call the target phone's near-field communication security element to obtain the preset encryption key; The request data stream is compressed, and a random sequence number and a current timestamp are generated. The compressed data, the random sequence number, and the timestamp are combined to obtain combined data. The encryption key is used to perform a digital signature operation on the combined data to generate an encrypted data packet; The encrypted data packet is passed to the security verification area for security verification. Once the verification is successful, the request data stream is executed. The security verification includes: Verify whether the source IP address of the requested data stream is in a preset whitelist; After the verification is passed, it is determined whether the timestamp is within a valid time window and whether the random sequence number is an unused sequence. When the timestamp is valid and the random sequence number is not reused, the validity of the digital signature is verified. Once the signature verification is successful, the security check is deemed to have passed.

2. The method according to claim 1, characterized in that, The security verification also includes: After the signature verification is successful, the encrypted data packet is decrypted to obtain the decrypted combined data; Verify whether the decrypted combined data contains preset high-risk database operation instructions; If it is not included, the security check is considered passed.

3. The method according to claim 1, characterized in that, The step of determining whether the random sequence number is an unused sequence: Check whether the random sequence number has been recorded in the local or distributed cache; If it has been recorded, it is determined to be a replay attack, and the request is rejected; If not recorded, the random serial number will be written to the cache after the verification passes, and an expiration period will be set.

4. The method according to claim 1, characterized in that, Before invoking the target mobile phone's near-field communication secure element, the following is also included: Send a device status query request, the query request containing the device identifier of the target mobile phone; Upon receiving the query result, determine whether the target mobile phone is on the device revocation list. If so, refuse to obtain the encryption key and terminate the current process.

5. The method according to claim 1, characterized in that, The security verification area is a logically isolated execution environment used to independently run the security verification logic.

6. The method according to claim 1, characterized in that, Also includes: The verification process and judgment results of the security verification are recorded, and a structured security audit log is generated and stored according to a preset format.

7. A database security proxy system, characterized in that, include: The acquisition module is used to acquire the request data stream from the client's original database operation; The calling module is used to invoke the target mobile phone's near-field communication security element to obtain the preset encryption key; The combination module is used to compress the request data stream, generate a random sequence number and a current timestamp, and combine the compressed data, the random sequence number and the timestamp to obtain combined data. The signature module is used to perform a digital signature operation on the combined data using the encryption key to generate an encrypted data packet; The verification and execution module is used to pass the encrypted data packet into the security verification area for security verification, and execute the request data stream after the verification is successful. The security verification includes: Verify whether the source IP address of the requested data stream is in a preset whitelist; After the verification is passed, it is determined whether the timestamp is within a valid time window and whether the random sequence number is an unused sequence. When the timestamp is valid and the random sequence number is not reused, the validity of the digital signature is verified. Once the signature verification is successful, the security check is deemed to have passed.

8. The system according to claim 7, characterized in that, The security verification also includes: After the signature verification is successful, the encrypted data packet is decrypted to obtain the decrypted combined data; Verify whether the decrypted combined data contains preset high-risk database operation instructions; If it is not included, the security check is considered passed.

9. An electronic device, characterized in that, include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, the processor being configured to load and execute the computer program stored in the memory to cause the electronic device to perform the database security proxy method as described in claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is loaded and executed by the processor, it implements the database security proxy method as described in claims 1 to 7.

Images