77 results about "Database security" patented technology

The invention relates to the technical field of database security, and discloses an MCP and agent-based heterogeneous database security access and report generation method, which comprises the following steps of: receiving a task request, acquiring a task context, synchronizing capability declarations from a plurality of database adapters according to the MCP, generating a capability graph and determining a capability version identifier; performing semantic mapping to obtain a strategy inline rewriting rule and a rewriting abstract fingerprint; the method comprises the following steps: signing and issuing a minimum permission access token, generating cross-source query, performing forced rewriting according to a strategy inline rewriting rule in a compilation stage, verifying consistency, processing an original result to obtain a purified result, only allowing to read a generated report from a buffer area of the purified result under the constraint of a structured mode template, and calculating a report fingerprint at the same time. And writing a chained audit log, fixing the audit log, and verifying report reproduction based on the audit log. According to the method and the system, minimum access, unauthorized prevention and control, compliance audibility and result reproducibility are realized.

Exemplary embodiments for data security include a data access proxy coupled with a database, further coupled with a server configured to operate the data access proxy to: identify a user and request to access a data item; validate the user and request, including inspecting the user's identity, evaluating the user's history, and evaluating permissions and restrictions associated with the user and the data item; access the database to retrieve the data item; inspect security attributes related to the data item; and transform the data item based on one or more privacy rules, including redacting the at least one data item, deleting information from the at least one data item, substituting information from the at least one private data item with other information, adding information to the at least one data item, providing synthetic data as a private data item, or providing proxy data for the data item.

The invention relates to the technical field of database security, in particular to an SQLite database transparent encryption method, system and device based on a national cryptographic algorithm and a storage medium, and the method comprises the following steps: S1, when an SQLite database is opened, loading and connecting a hardware cryptographic device to obtain an encryption master key and a corresponding key handle; s2, in response to the write-in operation, calling a national secret symmetric encryption algorithm through a key handle, encrypting a plaintext of a database page to generate a page, and writing the page into a database file; s3, reading the ciphertext page in response to the reading operation, decrypting the ciphertext page through a cryptographic symmetric decryption algorithm adjusted by a key handle after analysis, recovering a plaintext page and returning the plaintext page to the application; and S4, circularly executing encryption writing and decryption reading to process the continuous request, and releasing the key handle and disconnecting the hardware connection until the database connection is closed. According to the method, transparent full disk encryption, meeting the national secret standard, of the SQLite database is achieved, the secret key safety and the operation performance are guaranteed through hardware cryptographic equipment, and good application compatibility is kept.

The invention relates to the technical field of database security and anomaly detection, in particular to a database access anomaly detection method based on semantic vector and graph embedding, which is characterized by mainly comprising the following steps: preprocessing a data set, and extracting semantic units in the data set; a Word2Vec model is adopted to train the semantic unit, and a semantic vector of the SQL statement is generated; constructing a heterogeneous information graph taking a user, an operation type and a database table as nodes; establishing an undirected edge based on an entity association relationship, taking an association frequency as a weight, and taking a semantic vector as a node initial feature of the heterogeneous information graph; adopting a graph attention network GAT as a graph embedding algorithm to train the heterogeneous information graph, and generating a graph embedding feature corresponding to each database access statement; the graph embedding features are grouped according to a database table, and a sliding window is adopted to generate a corresponding time sequence; inputting the time sequence into the LSTM network, jointly optimizing graph embedding loss, time sequence modeling loss and regularization loss based on a designed total loss function to complete model training, and outputting time sequence features; and calculating the similarity between the output time sequence characteristics and the real image embedding characteristics, and judging whether the corresponding SQL operation is an abnormal operation or not according to a comparison result of the similarity and a threshold value. According to the method, SQL semantics, entity association and time sequence dependence multi-dimensional information can be fully fused, the accuracy and recall rate of anomaly detection are effectively improved, and reliable support is provided for database security protection.

The embodiment of the invention discloses a database integrity verification method and device based on an operation behavior and a medium, and relates to the technical field of databases, the method comprises the steps that database operation is monitored in real time to extract database operation information, the database operation information comprises an operation type, operation data and an operation context, and the operation type is determined according to the operation type, the operation data and the operation context; the operation context comprises a user identifier, a session identifier and a timestamp; according to the operation data and the operation context in the database operation information, generating a dynamic data fingerprint corresponding to the database operation, and writing the dynamic data fingerprint into the secure storage area; and performing database operation risk assessment based on the database operation information and the dynamic data fingerprints to determine current operation risk information, and performing hierarchical response on database operation through the current operation risk information to realize database integrity verification. Traditional static data verification is upgraded into a security protection mode of dynamic behavior perception, and database security protection is realized through multi-level technology fusion.

The embodiment of the invention discloses a database security situation assessment and prediction method based on a multi-dimensional index, and the method comprises the steps: constructing a multi-level index system, collecting the asset data and operation data of a target database, determining the first weight of the asset data and the second weight of the operation data based on a dynamic weight rule, calculating a database security value through a situation assessment model, obtaining predicted asset data and predicted operation data of a target database through a situation prediction model, and calculating a database predicted security value through the situation assessment model; and based on the database safety value and the database prediction safety value, according to an early warning rule, initiating early warning. The method covers multi-dimensional security data of the database, adopts a dynamic weight rule, adapts to different application scenes and threat environments, can effectively improve the accuracy and adaptivity of database security situation assessment, and improves the perspectiveness of database security protection through cooperation of a prediction mechanism and an early warning mechanism.

The invention relates to the technical field of database security, and discloses a zero-knowledge proof layer-based data query verification method, which comprises the following steps of: constructing a column type sparse commitment tree according to each column of data of a database table; acquiring a query request initiated by a client, and performing query processing on the query request according to the columnar sparse commitment tree to generate a query instruction; executing the query instruction in a fully encrypted environment, and generating a ciphertext query result packet and a proof fragment set; inputting the proof fragment set into a zero-knowledge proof layer of a GPU acceleration engine, and outputting zero-knowledge proof; and performing structured packaging on the ciphertext query result packet and the zero-knowledge proof, and feeding back the packaged ciphertext query result packet and the zero-knowledge proof to the client. According to the method, storage is optimized through the array type sparse commitment tree, verification is generated in parallel through the GPU, multi-class query verification is supported, and data privacy and query reality are guaranteed.

The invention discloses a dynamic desensitization method and device for an enterprise database, equipment and a storage medium, and relates to the technical field of database security, and the method comprises the following steps: deploying a pre-trained target SQL semantic analysis model, and intercepting a to-be-queried SQL statement sent by a client; parsing statement information corresponding to the to-be-queried SQL statement by using a target SQL grammar parser; if the analysis fails, identifying a target query intention corresponding to the to-be-queried SQL statement by using the target SQL semantic analysis model, and determining a target risk level corresponding to the to-be-queried SQL statement based on the target query intention; and if the target risk level corresponding to the to-be-queried SQL statement is a preset high risk level, intercepting query of the to-be-queried SQL statement on a target enterprise database, and returning corresponding interception information. According to the method and the device, the sensitive information can be accurately protected in the access process of the enterprise database.

This invention provides a database security system and its management method, relating to the field of electronic digital data processing technology. The invention aims to address the problems of existing database security technologies, which suffer from insufficient ability to identify complex and covert attacks and a high false alarm rate due to their single monitoring dimension and lack of cross-domain correlation analysis capabilities. By introducing an innovative cross-domain anomaly collaborative analysis mechanism, this invention can achieve synchronous cross-verification of attack "intent" and attack "methods," thereby significantly improving the predictive identification capability and accuracy of advanced threats while greatly reducing security false alarms caused by normal business fluctuations or system jitter, thus enhancing the intelligence level and reliability of the entire database security system.

The application discloses a database encryption control method and system based on micro services, and relates to the technical field of distributed database security; a password device distribution service, a certificate key management service and a dynamic load balancing service are created according to a micro service architecture; the password device distribution service distributes password devices when the password devices are applied to be used by the outside world, and provides a calling interface; the certificate key management service uniformly manages certificates and keys in the password devices, and can migrate the certificates and the keys between the password devices; and the dynamic load balancing service dynamically distributes the password devices to nodes according to usage information of the nodes on the password devices.

The invention relates to a database connection method and device, computer equipment, a medium and a program product. The method comprises the following steps: acquiring connection request information and global singleton object data from a client, and obtaining a mapping relationship between an elastic public network address and a virtual private cloud address; obtaining an original response result which corresponds to an original main node confirmation command of the client and comprises address information of the replica set node; under the condition that it is determined that the connection request needs to be subjected to elastic public network address replacement according to the connection request information and the global singleton object data, a virtual private cloud address in the original response result is replaced with a corresponding elastic public network address according to the global singleton object data, and a target response result is obtained; and sending the target response result to the client, and establishing connection between the client and each node of the replica set according to address information in the target response result. By adopting the method, the database connection flexibility can be improved on the basis of ensuring the security isolation of the cloud database.

This invention discloses a secure distributed backup method for databases based on secret sharing, relating to the field of database security technology. The method includes: selecting n backup nodes, setting a recovery threshold t, extracting sensitive information from the database, and using a secret sharing algorithm to divide the sensitive information into n shares within the backup nodes; allocating each share to a corresponding backup node for storage; adding a password share to each share stored in each backup node to construct an encrypted share; creating a mapping table based on the correspondence between backup nodes and encrypted shares; receiving a recovery request, retrieving the encrypted share from several backup nodes based on the response request and the mapping table, and decoding the retrieved encrypted share to obtain the sensitive information. This invention ensures data security during the backup process by dividing and encrypting sensitive information in the database and then distributing the divided information across multiple backup nodes.

The application discloses an identity authentication method and device, equipment and medium, and relates to the field of communication, and comprises the following steps: an identity authentication credential in an identity authentication request data packet sent by a database security reinforcement product client is used for identity authentication by a database security reinforcement product server; after successful authentication, a client authentication IP and database management system information are cached to a target list, and an authentication result is returned, so that a target management client sends an access authentication request data packet based on the authentication result; the access authentication request data packet is parsed, database management system information is queried according to the parsed information, and the database management system information is matched with to-be-accessed database management system information; if the matching is successful, the access authentication request data packet is forwarded to the database management system for identity authentication, an identity authentication result is returned to the target management client, and identity authentication is completed. The application realizes double-system authentication of a database security reinforcement product and a database management system.

The invention provides a global digital transformation-oriented database security management system, which relates to the field of electric digital data processing and comprises an intelligent threat detection and protection module, a unified identity and dynamic authority control module, a full life cycle data security protection module and an intelligent operation and maintenance and compliance management module, the intelligent threat detection and protection module is used for realizing intelligent recognition, analysis and automatic protection of database threats, and the unified identity and dynamic permission control module is used for realizing cross-platform identity unified management and controlling dynamic permissions based on context. The full-life-cycle data security protection module is used for covering security protection of the whole process of data creation, storage, transportation, use and destruction, and the intelligent operation and compliance management module is used for providing intelligent operation support and automatic compliance management capability; the system solves the technical problems that a traditional database security system cannot cope with complex and changeable threat environments, lacks personalized modeling ability, is extensive in authority management and the like, and the intelligent level and the adaptive ability of database security protection are remarkably improved.

This application relates to the technical field of database security and discloses an account dynamic monitoring and management system based on a data transmission protocol. The system includes: a protocol parsing module, which parses a specified communication protocol of a specified database and extracts key information related to privileged accounts; a privileged account dynamic discovery module, which dynamically discovers all privileged accounts in a specified database; a behavior anomaly detection module, which analyzes the behavior of privileged accounts, constructs a behavioral baseline for privileged accounts, and identifies risky operations by privileged accounts; and a dynamic response module, which provides targeted security protection strategies after detecting risky operations. By parsing the specified communication protocol of a specified database, the system extracts and parses the login authentication process of privileged accounts within the communication protocol, identifies account behavior in real time, dynamically discovers changing privileged accounts, uses AI technology to analyze privileged account behavior, and automatically adopts appropriate security protection strategies based on the security configuration items of the specified database after detecting risky operations, thereby reducing the impact of threats.

The invention discloses a TLS connection establishment method and device for a transparent encryption database proxy, and belongs to the technical field of database security and communication encryption, and the method is characterized in that a database protocol rule base is built in the proxy, so that the proxy has a protocol perception capability; simulating the server to return a positive response, and then establishing a first TLS connection as a TLS server; meanwhile, the proxy initiates TCP connection to the real database server, actively sends a negotiation request of a corresponding protocol, and serves as a TLS client to establish second TLS connection; and finally, binding the two TLS connection sessions to realize transparent forwarding of the data. The technical problem that an existing transparent encryption agent cannot work in the scene that the database forcibly opens the TLS is solved, coordination of transport layer security and field-level transparent encryption is achieved, and the security of database communication is comprehensively improved.

The embodiment of the invention provides a database authentication method and device, and relates to the technical field of database security, in the method, a user state system table is set in a first relational database; the first relational database receives a login request sent by a first user; if the locking state of the first user in the user state system table is a locked state, sending a first login response to the first user; if the locking state of the first user in the user state system table is an unlocked state, authenticating the first user; if the authentication fails, the login failure frequency of the first user in the user state system table is smaller than the preset prompt frequency, and the common login identifier list of the first user comprises the current login identifier of the first user, outputting a login prompt character string of the first user in the user state system table; and when a second login request sent by the first user is received, authenticating the first user. According to the scheme, the security of the relational database can be improved.

The invention discloses a data asset management system based on multi-source heterogeneous data fusion, which belongs to the technical field of data management, and comprises the following modules: a database security judgment module used for obtaining a database security state; the data asset protection regulation and control module is used for obtaining a data asset protection level; the data recovery module is used for recovering abnormal data and updating downstream data; the global data traceability tracking module is used for generating a recovery judgment instruction; the computing resource management module is used for adjusting the execution state of global derivative data recovery processing; the data asset assessment secondary adjustment module is used for carrying out secondary adjustment on the execution interval of data asset security assessment, and the problems that in the prior art, due to the fact that a scientific research database is maliciously attacked, source data is maliciously tampered, and the source data is continuously transmitted in the data sharing and multiplexing process; and the problem that the source derived data is continuously polluted is solved.

The invention relates to a triple-correlation whole-process monitoring method based on a data flow scene, and aims to solve the technical problem that the whole-process monitoring of data flow scenes of flow sharing, cross access and collaborative analysis is less realized through multiple correlation in the data security technology of the existing similar digital power grid. The method is characterized in that through database auditing and API monitoring of original log data, end-to-end application data link description, tracking and displaying of sensitive data links, full-path monitoring of the data links and deep integration between database security operation and maintenance, database security evaluation and a database security bastion host are achieved; forming a data security defense system; the data link and the sensitive data link respectively form a complete transmission path from a terminal to an application to an API to a database, and a plurality of paths form a complete data flow topology and are digitally presented; a data association model is introduced to monitor the system and process execution condition of internal data security, and the data association model is accessed.

The application relates to the technical field of database security, and discloses a row-level data encryption and desensitization protection method and system for a cloud native database, wherein the method comprises the following steps: receiving a query request, obtaining an access context, and reading a target row primary key, a sensitive field label and a policy version; constructing a row-level protection state based on a tenant identifier, the row primary key, an access purpose and the policy version; determining a row-level protection level according to preset sensitive level, permission level, copy risk level and query operation level division rules; generating field ciphertext and a blind index based on the row-level protection state; and generating stable desensitization values as constraints of the row-level protection level and a field format template. The technical scheme is based on the dynamic construction of a row-level protection state based on an access context and the generation of a homologous driving desensitization mode, achieves the technical effect of outputting consistent and stable desensitization values, and realizes the effective reservation of database bottom-layer association keys.

This specification discloses a method, device, and medium for secure authentication of a PostgreSQL database, relating to the field of security authentication technology, and is used to solve the problem of unauthorized login and unauthorized covert login caused by user password leakage, which is difficult to address with existing authentication methods. The method includes: a client receiving a username and password input by a user, and generating a first communication key using a key derivation function by combining the username, the password, a first preset password, and a first count value; a server receiving a username sent by the client, querying the PostgreSQL database to obtain the corresponding stored password, a second preset password, and a second count value, and generating a second communication key using the key derivation function; and the server receiving the first communication key and performing password authentication based on the first and second communication keys to obtain the authentication result of the PostgreSQL database.

The invention provides a database security protection system and method, a program product, a storage medium and device.According to the database security protection system, the control function of a database security audit product is separated into a control center and a strategy control unit, and the control center is deployed in the form of hardware equipment or software; the strategy control unit is deployed at a database server side, the control center issues a control strategy to the strategy control unit, and when an SQL request for accessing database resources reaches a database, the strategy control unit detects the SQL request according to the control strategy and executes corresponding control actions, so that the security of the database is guaranteed. Due to the fact that software-hardware combination deployment or software-software combination deployment is adopted, for database resources with scattered logic or physical positions, management and control over a plurality of databases can be achieved only through one control center without deploying a plurality of safety hardware devices, and therefore deployment cost is effectively reduced, and occupation of physical space is reduced.

The application discloses a kind of method and device for realizing database sensitive data integrity protection, belong to database security technical field, comprising: by encryption system, the sensitive data of data table key column in target database is identified, and is recorded as key data;Integrity protection is configured to key data, and digital signature is applied for;By using SM3 hash algorithm, the digest value of key data is calculated, and the MAC value of the related sensitive information of current key data and system key is calculated;Database business system accesses key data by the proxy connection of encryption system, and the modification or new data insertion of data is carried out, i.e. business user carries out data entry, and saves;Encryption system compares whether the MAC value of the related sensitive information of current key data and the related sensitive information of last key data is consistent, and returns comparison result to system;The data state corresponding to the comparison result returned by system is displayed on system web page.

The invention relates to the technical field of database security, and discloses a horizontal authentication control method and device, and the method comprises the steps: obtaining a request message which is submitted to a service interface after a user completes the login operation of a service system, and the request message carries an identifier of user request access data and a user identity identifier; analyzing the request message to obtain an identifier of the user request access data and a user identity identifier; a historical response message stored in association with the user identity identifier is inquired in a database, the historical response message is returned by the server according to a request message historically submitted to a service interface by the user after the user completes the service system login operation, and the historical response message carries an identifier for feeding back historical data to the user; and analyzing the historical response message, and performing authentication on the request message by comparing the identifier of the user request access data with the identifier of the historical data fed back to the user. According to the method, horizontal unauthorized attacks are effectively prevented, and the safety and reliability are improved.

The invention relates to the technical field of database security, and particularly provides a plug-in database encryption control method and device, and the method comprises the following steps: S1, deploying an encryption plug-in on a database server; s2, configuring an encryption control strategy on the database server; s3, executing the SQL statement by the user; and S4, in the database system service operation process, the administrator user modifies the encryption control strategy. Compared with the prior art, safer and more reliable database access and operation can be realized, and the integrity and confidentiality of data are guaranteed.

The invention relates to the field of data security and processing, in particular to a database security proxy method, system and device and a storage medium. The method comprises the following steps: acquiring a request data stream from an original database operation of a client; calling a near field communication security element of the target mobile phone, and obtaining a preset encryption key; compressing the request data stream, generating a random serial number and a current timestamp, and combining the compressed data, the random serial number and the timestamp to obtain combined data; performing digital signature operation on the combined data by using the encryption key to generate an encrypted data packet; and transmitting the encrypted data packet into a security verification area for security verification, and executing the request data stream after the verification is passed. The security and stability of the database can be improved.

The invention discloses a security control method, device and equipment for a database and a storage medium, and the method comprises the steps: monitoring a database in a target application environment in real time, and generating a production library data table; based on the data access permission information, generating database authorization information in at least one service scene as a white list data table; and based on the white list data table and the production library data table, performing security verification on candidate database statements in the target application environment. Through the technical scheme, the security of the data in the target application environment is improved.

A system, apparatuses, and methods for database security are disclosed. The system, apparatuses, and methods are configured to transform or polymorph database requests from an application server to a database in order to help prevent malicious applications from accessing the database. The database requests are transformed or polymorphed such that legitimate requests may be performed at the database as intended, but requests from malicious applications become indecipherable, and thus cannot be performed. Accordingly, the presently disclosed system, apparatuses, and methods help prevent database attacks or incursions, and balance front-end web application usability with the need to protect back-end databases from attacks (e.g., injection attacks).

The invention discloses a medical database data tracing method and device based on a block chain, equipment and a storage medium, and relates to the technical field of database security, and the method comprises the steps: determining behavior information of a user and operation information of a structured query language executed on a target medical database, obtaining a behavior mode and a threshold range, a user behavior model is established, the user identity is verified by using the user behavior model, and behavior information is evaluated after verification is passed to obtain an evaluation result; using a preset authorization framework and based on the evaluation result to generate an access authorization token, recording record information of an operation performed by a user on the target medical database based on the access authorization token, encrypting the record information, and storing the encrypted information in a block chain network to generate a traceability identifier; and when the block chain network receives the traceability request, searching the encrypted information in the block chain network based on the traceability identifier so as to perform data traceability. Therefore, the efficiency of medical database data tracing can be improved.

The embodiment of the invention discloses a database security situation awareness method and system based on multi-source data fusion. The method comprises the steps of obtaining multi-source heterogeneous security data, generating security data in a unified format, and identifying risk data, risk events and risk dominance levels based on a security rule base and a security event space-time correlation analysis algorithm; constructing a risk assessment model, and obtaining a security situation and a risk recessiveness level based on the risk data and the risk event; establishing a safety risk prediction model based on the time sequence, and obtaining prediction risk data, prediction risk events and prediction risk levels; and based on the predicted risk data, the predicted risk event, the actual risk data and the actual risk event, optimizing a security event space-time correlation analysis algorithm, a security rule base, a risk assessment model and a security risk prediction model. According to the method, multi-source heterogeneous security data are fused, security event association analysis, database security risk prediction and situation awareness are realized, and the database security protection level is improved.