114 results about "Database security" patented technology

The invention relates to the technical field of database security, and discloses an MCP and agent-based heterogeneous database security access and report generation method, which comprises the following steps of: receiving a task request, acquiring a task context, synchronizing capability declarations from a plurality of database adapters according to the MCP, generating a capability graph and determining a capability version identifier; performing semantic mapping to obtain a strategy inline rewriting rule and a rewriting abstract fingerprint; the method comprises the following steps: signing and issuing a minimum permission access token, generating cross-source query, performing forced rewriting according to a strategy inline rewriting rule in a compilation stage, verifying consistency, processing an original result to obtain a purified result, only allowing to read a generated report from a buffer area of the purified result under the constraint of a structured mode template, and calculating a report fingerprint at the same time. And writing a chained audit log, fixing the audit log, and verifying report reproduction based on the audit log. According to the method and the system, minimum access, unauthorized prevention and control, compliance audibility and result reproducibility are realized.

The invention relates to a whole mine safety situation analysis and evaluation system and method, and belongs to the technical field of coal mine safety production and management. The system comprises a basic data informatization module, a security big data center module, a professional dimension scoring module, a spatial dimension scoring module and a risk visualization analysis module. The basic information informatization module is used for establishing a basic information informatization database according to professions based on a coal mine safety production standardization management system; the security big data center module is used for integrating multi-source heterogeneous data, namely managing, monitoring and analyzing data, and establishing a data unified interaction standard; the professional dimension scoring module is used for carrying out risk assessment by adopting a security check table method for each professional field; and the spatial dimension scoring module is used for realizing automatic, real-time and quantitative evaluation based on quasi-static and dynamic monitoring data by adopting a virtual object situation-based scoring method for typical scenes. According to the invention, the whole mine overall risk and local key area safety risk evaluation can be realized.

Exemplary embodiments for data security include a data access proxy coupled with a database, further coupled with a server configured to operate the data access proxy to: identify a user and request to access a data item; validate the user and request, including inspecting the user's identity, evaluating the user's history, and evaluating permissions and restrictions associated with the user and the data item; access the database to retrieve the data item; inspect security attributes related to the data item; and transform the data item based on one or more privacy rules, including redacting the at least one data item, deleting information from the at least one data item, substituting information from the at least one private data item with other information, adding information to the at least one data item, providing synthetic data as a private data item, or providing proxy data for the data item.

The invention discloses a method and device for realizing integrity protection of sensitive data of a database, and belongs to the technical field of database security, and the method comprises the following steps: identifying sensitive data of a key column of a data table in a target database through an encryption system, and recording the sensitive data as key data; integrity protection is configured for the key data, and a digital signature is applied; the method comprises the following steps: calculating an abstract value of key data by using an SM3 hash algorithm, and calculating related sensitive information of the current key data and an MAC value of a system key at the same time; the database service system accesses the key data through the proxy connection of the encryption system, data modification or new data insertion is carried out, that is, a service user carries out data entry and storage; the encryption system compares whether the MAC value of the related sensitive information of the current key data is consistent with the MAC value of the related sensitive information of the last key data, and returns a comparison result to the system; and displaying a data state corresponding to a comparison result returned by the system on a system web page.

The invention relates to the technical field of database security, in particular to an SQLite database transparent encryption method, system and device based on a national cryptographic algorithm and a storage medium, and the method comprises the following steps: S1, when an SQLite database is opened, loading and connecting a hardware cryptographic device to obtain an encryption master key and a corresponding key handle; s2, in response to the write-in operation, calling a national secret symmetric encryption algorithm through a key handle, encrypting a plaintext of a database page to generate a page, and writing the page into a database file; s3, reading the ciphertext page in response to the reading operation, decrypting the ciphertext page through a cryptographic symmetric decryption algorithm adjusted by a key handle after analysis, recovering a plaintext page and returning the plaintext page to the application; and S4, circularly executing encryption writing and decryption reading to process the continuous request, and releasing the key handle and disconnecting the hardware connection until the database connection is closed. According to the method, transparent full disk encryption, meeting the national secret standard, of the SQLite database is achieved, the secret key safety and the operation performance are guaranteed through hardware cryptographic equipment, and good application compatibility is kept.

The invention relates to the technical field of communication, in particular to a database security protection method, which comprises the following steps of: mirroring and copying database traffic by adopting a switch port; performing deep protocol analysis on the database traffic to obtain analyzed data; performing real-time threat detection on the analyzed data to obtain a detection result; and performing security protection on the database based on the detection result. According to the method, through technical fusion of deep protocol analysis and real-time threat detection, accurate protection and dynamic defense of the database can be realized, systematic defects in the aspects of performance loss and the like are reduced, and double breakthrough of safety and availability is realized.

The invention relates to the technical field of database security and anomaly detection, in particular to a database access anomaly detection method based on semantic vector and graph embedding, which is characterized by mainly comprising the following steps: preprocessing a data set, and extracting semantic units in the data set; a Word2Vec model is adopted to train the semantic unit, and a semantic vector of the SQL statement is generated; constructing a heterogeneous information graph taking a user, an operation type and a database table as nodes; establishing an undirected edge based on an entity association relationship, taking an association frequency as a weight, and taking a semantic vector as a node initial feature of the heterogeneous information graph; adopting a graph attention network GAT as a graph embedding algorithm to train the heterogeneous information graph, and generating a graph embedding feature corresponding to each database access statement; the graph embedding features are grouped according to a database table, and a sliding window is adopted to generate a corresponding time sequence; inputting the time sequence into the LSTM network, jointly optimizing graph embedding loss, time sequence modeling loss and regularization loss based on a designed total loss function to complete model training, and outputting time sequence features; and calculating the similarity between the output time sequence characteristics and the real image embedding characteristics, and judging whether the corresponding SQL operation is an abnormal operation or not according to a comparison result of the similarity and a threshold value. According to the method, SQL semantics, entity association and time sequence dependence multi-dimensional information can be fully fused, the accuracy and recall rate of anomaly detection are effectively improved, and reliable support is provided for database security protection.

The embodiment of the invention discloses a database integrity verification method and device based on an operation behavior and a medium, and relates to the technical field of databases, the method comprises the steps that database operation is monitored in real time to extract database operation information, the database operation information comprises an operation type, operation data and an operation context, and the operation type is determined according to the operation type, the operation data and the operation context; the operation context comprises a user identifier, a session identifier and a timestamp; according to the operation data and the operation context in the database operation information, generating a dynamic data fingerprint corresponding to the database operation, and writing the dynamic data fingerprint into the secure storage area; and performing database operation risk assessment based on the database operation information and the dynamic data fingerprints to determine current operation risk information, and performing hierarchical response on database operation through the current operation risk information to realize database integrity verification. Traditional static data verification is upgraded into a security protection mode of dynamic behavior perception, and database security protection is realized through multi-level technology fusion.

The invention provides a method for performing data processing on a plurality of list sets by using SQL statements. The method comprises the following steps of S1, receiving request parameters and verifying the request parameters; s2, storing the data in the list set into a user-defined memory database; s3, checking the SQL statement; s4, the SQL statement is analyzed, and SELECT information is obtained; s5, a SELECT statement in the SELECT information is analyzed, and SQL grammar information is obtained; s6, processing the data according to the SQL grammar information; s7, returning final result data; the problem that data processing of multiple List list sets is difficult is solved, connection with a database server is not needed based on a flexible data processing mode of the SQL language and a mode of creating the user-defined memory database, the database security problem does not exist, high concurrency is supported, efficiency is improved, complex data processing is achieved, and the method is suitable for large-scale popularization and application. SQL statements are modified and updated at any time according to requirements, and time and labor are

The embodiment of the invention discloses a database security situation assessment and prediction method based on a multi-dimensional index, and the method comprises the steps: constructing a multi-level index system, collecting the asset data and operation data of a target database, determining the first weight of the asset data and the second weight of the operation data based on a dynamic weight rule, calculating a database security value through a situation assessment model, obtaining predicted asset data and predicted operation data of a target database through a situation prediction model, and calculating a database predicted security value through the situation assessment model; and based on the database safety value and the database prediction safety value, according to an early warning rule, initiating early warning. The method covers multi-dimensional security data of the database, adopts a dynamic weight rule, adapts to different application scenes and threat environments, can effectively improve the accuracy and adaptivity of database security situation assessment, and improves the perspectiveness of database security protection through cooperation of a prediction mechanism and an early warning mechanism.

The invention relates to the technical field of database security, and discloses a zero-knowledge proof layer-based data query verification method, which comprises the following steps of: constructing a column type sparse commitment tree according to each column of data of a database table; acquiring a query request initiated by a client, and performing query processing on the query request according to the columnar sparse commitment tree to generate a query instruction; executing the query instruction in a fully encrypted environment, and generating a ciphertext query result packet and a proof fragment set; inputting the proof fragment set into a zero-knowledge proof layer of a GPU acceleration engine, and outputting zero-knowledge proof; and performing structured packaging on the ciphertext query result packet and the zero-knowledge proof, and feeding back the packaged ciphertext query result packet and the zero-knowledge proof to the client. According to the method, storage is optimized through the array type sparse commitment tree, verification is generated in parallel through the GPU, multi-class query verification is supported, and data privacy and query reality are guaranteed.

The invention discloses a dynamic desensitization method and device for an enterprise database, equipment and a storage medium, and relates to the technical field of database security, and the method comprises the following steps: deploying a pre-trained target SQL semantic analysis model, and intercepting a to-be-queried SQL statement sent by a client; parsing statement information corresponding to the to-be-queried SQL statement by using a target SQL grammar parser; if the analysis fails, identifying a target query intention corresponding to the to-be-queried SQL statement by using the target SQL semantic analysis model, and determining a target risk level corresponding to the to-be-queried SQL statement based on the target query intention; and if the target risk level corresponding to the to-be-queried SQL statement is a preset high risk level, intercepting query of the to-be-queried SQL statement on a target enterprise database, and returning corresponding interception information. According to the method and the device, the sensitive information can be accurately protected in the access process of the enterprise database.

The invention relates to the technical field of database security, and discloses a secure access method for a database, comprising: receiving an access request sent by a client for a target database, and generating device verification data and user verification data; presetting a database comparison table and a user password comparison table; performing preliminary verification on the equipment verification data based on the database comparison table, performing final verification on the user verification data based on the database comparison table and the user password comparison table, and if the final verification is passed, allowing the client to access the target database; and if the preliminary verification or the final verification is not passed, obtaining a temporary access application form of the database management end, performing secondary verification on the equipment verification data and the user verification data based on the temporary access application form, and if the secondary verification is passed, allowing the client to access the target database. Through a multi-verification mechanism, the risk that illegal users access the database is greatly reduced, and the security of database access is effectively improved.

This invention provides a database security system and its management method, relating to the field of electronic digital data processing technology. The invention aims to address the problems of existing database security technologies, which suffer from insufficient ability to identify complex and covert attacks and a high false alarm rate due to their single monitoring dimension and lack of cross-domain correlation analysis capabilities. By introducing an innovative cross-domain anomaly collaborative analysis mechanism, this invention can achieve synchronous cross-verification of attack "intent" and attack "methods," thereby significantly improving the predictive identification capability and accuracy of advanced threats while greatly reducing security false alarms caused by normal business fluctuations or system jitter, thus enhancing the intelligence level and reliability of the entire database security system.

The application discloses a database encryption control method and system based on micro services, and relates to the technical field of distributed database security; a password device distribution service, a certificate key management service and a dynamic load balancing service are created according to a micro service architecture; the password device distribution service distributes password devices when the password devices are applied to be used by the outside world, and provides a calling interface; the certificate key management service uniformly manages certificates and keys in the password devices, and can migrate the certificates and the keys between the password devices; and the dynamic load balancing service dynamically distributes the password devices to nodes according to usage information of the nodes on the password devices.

The present invention provides a database security control method, apparatus, electronic device, and storage medium, including: sending database operation and maintenance instructions through a database operation and maintenance tool, and after the database soft switch performs security control on the database operation and maintenance instructions, forwarding them to the database; the database soft switch uses a similarity cycle analysis algorithm to simulate the database, enabling the database to perform session keep-alive communication with the database operation and maintenance tool; calling the operating system kernel, and using a multi-threaded mechanism and a fast read-write data cache queue to perform network traffic collection and analysis. In view of the problem that various database tools need to be customized and developed for database operation and maintenance control, the present invention realizes the centralized control of database operation and maintenance through the database soft switch, without the need to transform the database tools. At the same time, it solves the problem of maintaining the keep-alive of the database tools during the waiting period for the approval of the vault triggered by the instructions, and calls the operating system kernel, uses multi-threading and a fast read-write data cache queue to improve the traffic processing ability, ensuring the operation and maintenance efficiency.

The invention relates to a database connection method and device, computer equipment, a medium and a program product. The method comprises the following steps: acquiring connection request information and global singleton object data from a client, and obtaining a mapping relationship between an elastic public network address and a virtual private cloud address; obtaining an original response result which corresponds to an original main node confirmation command of the client and comprises address information of the replica set node; under the condition that it is determined that the connection request needs to be subjected to elastic public network address replacement according to the connection request information and the global singleton object data, a virtual private cloud address in the original response result is replaced with a corresponding elastic public network address according to the global singleton object data, and a target response result is obtained; and sending the target response result to the client, and establishing connection between the client and each node of the replica set according to address information in the target response result. By adopting the method, the database connection flexibility can be improved on the basis of ensuring the security isolation of the cloud database.

This invention discloses a secure distributed backup method for databases based on secret sharing, relating to the field of database security technology. The method includes: selecting n backup nodes, setting a recovery threshold t, extracting sensitive information from the database, and using a secret sharing algorithm to divide the sensitive information into n shares within the backup nodes; allocating each share to a corresponding backup node for storage; adding a password share to each share stored in each backup node to construct an encrypted share; creating a mapping table based on the correspondence between backup nodes and encrypted shares; receiving a recovery request, retrieving the encrypted share from several backup nodes based on the response request and the mapping table, and decoding the retrieved encrypted share to obtain the sensitive information. This invention ensures data security during the backup process by dividing and encrypting sensitive information in the database and then distributing the divided information across multiple backup nodes.

The application discloses an identity authentication method and device, equipment and medium, and relates to the field of communication, and comprises the following steps: an identity authentication credential in an identity authentication request data packet sent by a database security reinforcement product client is used for identity authentication by a database security reinforcement product server; after successful authentication, a client authentication IP and database management system information are cached to a target list, and an authentication result is returned, so that a target management client sends an access authentication request data packet based on the authentication result; the access authentication request data packet is parsed, database management system information is queried according to the parsed information, and the database management system information is matched with to-be-accessed database management system information; if the matching is successful, the access authentication request data packet is forwarded to the database management system for identity authentication, an identity authentication result is returned to the target management client, and identity authentication is completed. The application realizes double-system authentication of a database security reinforcement product and a database management system.

The invention provides a global digital transformation-oriented database security management system, which relates to the field of electric digital data processing and comprises an intelligent threat detection and protection module, a unified identity and dynamic authority control module, a full life cycle data security protection module and an intelligent operation and maintenance and compliance management module, the intelligent threat detection and protection module is used for realizing intelligent recognition, analysis and automatic protection of database threats, and the unified identity and dynamic permission control module is used for realizing cross-platform identity unified management and controlling dynamic permissions based on context. The full-life-cycle data security protection module is used for covering security protection of the whole process of data creation, storage, transportation, use and destruction, and the intelligent operation and compliance management module is used for providing intelligent operation support and automatic compliance management capability; the system solves the technical problems that a traditional database security system cannot cope with complex and changeable threat environments, lacks personalized modeling ability, is extensive in authority management and the like, and the intelligent level and the adaptive ability of database security protection are remarkably improved.

The present invention discloses an identity authentication method for distributed database clusters, belonging to the field of database security. The method comprises setting one host in the cluster as an authentication proxy server; the authentication proxy server receives proxy authentication requests from hosts in other clusters; the other hosts transmit the authentication information of the user currently attempting to log in to the authentication proxy server as a proxy authentication request; the authentication proxy server processes the current proxy authentication request through its own authentication system and feeds back the authentication result to the other hosts; after receiving the authentication result, the other hosts determine whether to allow the current user to log in based on the authentication result. Compared with existing database authentication methods, the use of an authentication proxy allows the authentication system to be shared with other systems while retaining the existing authentication process, allowing the distributed database clusters to share the same set of authentication processes. At the same time, the cluster responsible for the authentication proxy can continue to retain the functions of the database itself.

The embodiment of the invention provides a database security control method which comprises the steps that an operation instruction of a user for operating a database is obtained, and the operation instruction indicates execution action of a first operation type on a first data table and / or a first table field of the database; blocking the operation instruction and recording an alarm log under the condition that the first operation type, the first data table and the first table field are matched with a preset fortress blocking rule; under the condition that the first operation type, the first data table and the first table field are not matched with a second operation type, a second data table and a second table field in a preset fortress blocking rule, rule conflict detection is conducted on the first operation type, the first data table and the first table field and a preset sensitive operation rule; and blocking the operation instruction and recording an alarm log under the condition that the execution action indicated by the operation instruction conflicts with the database operation behavior in the sensitive operation rule.

This application relates to the technical field of database security and discloses an account dynamic monitoring and management system based on a data transmission protocol. The system includes: a protocol parsing module, which parses a specified communication protocol of a specified database and extracts key information related to privileged accounts; a privileged account dynamic discovery module, which dynamically discovers all privileged accounts in a specified database; a behavior anomaly detection module, which analyzes the behavior of privileged accounts, constructs a behavioral baseline for privileged accounts, and identifies risky operations by privileged accounts; and a dynamic response module, which provides targeted security protection strategies after detecting risky operations. By parsing the specified communication protocol of a specified database, the system extracts and parses the login authentication process of privileged accounts within the communication protocol, identifies account behavior in real time, dynamically discovers changing privileged accounts, uses AI technology to analyze privileged account behavior, and automatically adopts appropriate security protection strategies based on the security configuration items of the specified database after detecting risky operations, thereby reducing the impact of threats.

The invention discloses a TLS connection establishment method and device for a transparent encryption database proxy, and belongs to the technical field of database security and communication encryption, and the method is characterized in that a database protocol rule base is built in the proxy, so that the proxy has a protocol perception capability; simulating the server to return a positive response, and then establishing a first TLS connection as a TLS server; meanwhile, the proxy initiates TCP connection to the real database server, actively sends a negotiation request of a corresponding protocol, and serves as a TLS client to establish second TLS connection; and finally, binding the two TLS connection sessions to realize transparent forwarding of the data. The technical problem that an existing transparent encryption agent cannot work in the scene that the database forcibly opens the TLS is solved, coordination of transport layer security and field-level transparent encryption is achieved, and the security of database communication is comprehensively improved.

The embodiment of the invention provides a database authentication method and device, and relates to the technical field of database security, in the method, a user state system table is set in a first relational database; the first relational database receives a login request sent by a first user; if the locking state of the first user in the user state system table is a locked state, sending a first login response to the first user; if the locking state of the first user in the user state system table is an unlocked state, authenticating the first user; if the authentication fails, the login failure frequency of the first user in the user state system table is smaller than the preset prompt frequency, and the common login identifier list of the first user comprises the current login identifier of the first user, outputting a login prompt character string of the first user in the user state system table; and when a second login request sent by the first user is received, authenticating the first user. According to the scheme, the security of the relational database can be improved.

The invention provides a database security control method and device, a storage medium and a program product. The database security control method comprises the following steps: acquiring M pieces of user behavior data in a database, wherein M is a natural number greater than 1; the security level value of the ith user behavior data is calculated to obtain the ith security level value, and i is larger than or equal to 1 and smaller than or equal to M; determining a target security level value according to a minimum value in the M security level values and a predetermined increment value; and screening out the user behavior data with the security risk from the M pieces of user behavior data by using the target security level value, wherein the security level value of the user behavior data with the security risk is smaller than the target security level value.

The invention discloses a data asset management system based on multi-source heterogeneous data fusion, which belongs to the technical field of data management, and comprises the following modules: a database security judgment module used for obtaining a database security state; the data asset protection regulation and control module is used for obtaining a data asset protection level; the data recovery module is used for recovering abnormal data and updating downstream data; the global data traceability tracking module is used for generating a recovery judgment instruction; the computing resource management module is used for adjusting the execution state of global derivative data recovery processing; the data asset assessment secondary adjustment module is used for carrying out secondary adjustment on the execution interval of data asset security assessment, and the problems that in the prior art, due to the fact that a scientific research database is maliciously attacked, source data is maliciously tampered, and the source data is continuously transmitted in the data sharing and multiplexing process; and the problem that the source derived data is continuously polluted is solved.

The invention relates to a triple-correlation whole-process monitoring method based on a data flow scene, and aims to solve the technical problem that the whole-process monitoring of data flow scenes of flow sharing, cross access and collaborative analysis is less realized through multiple correlation in the data security technology of the existing similar digital power grid. The method is characterized in that through database auditing and API monitoring of original log data, end-to-end application data link description, tracking and displaying of sensitive data links, full-path monitoring of the data links and deep integration between database security operation and maintenance, database security evaluation and a database security bastion host are achieved; forming a data security defense system; the data link and the sensitive data link respectively form a complete transmission path from a terminal to an application to an API to a database, and a plurality of paths form a complete data flow topology and are digitally presented; a data association model is introduced to monitor the system and process execution condition of internal data security, and the data association model is accessed.

The application relates to the technical field of database security, and discloses a row-level data encryption and desensitization protection method and system for a cloud native database, wherein the method comprises the following steps: receiving a query request, obtaining an access context, and reading a target row primary key, a sensitive field label and a policy version; constructing a row-level protection state based on a tenant identifier, the row primary key, an access purpose and the policy version; determining a row-level protection level according to preset sensitive level, permission level, copy risk level and query operation level division rules; generating field ciphertext and a blind index based on the row-level protection state; and generating stable desensitization values as constraints of the row-level protection level and a field format template. The technical scheme is based on the dynamic construction of a row-level protection state based on an access context and the generation of a homologous driving desensitization mode, achieves the technical effect of outputting consistent and stable desensitization values, and realizes the effective reservation of database bottom-layer association keys.

The invention provides a database encryption and decryption method and device, computing equipment and a storage medium. According to the method, under the condition that the data processing request is received, the target data page serving as the operation object of the transaction engine is determined based on the to-be-processed data corresponding to the received data processing request; and generating the target key based on the address information of the target data page, the data located at the target position in the target data page and the initialization key, so that when the target data page is processed by the transaction engine based on the data processing request, the target key is generated. And performing encryption operation and / or decryption operation on the target data page by using the target key so as to automatically realize encryption and decryption operation of the data page in the operation process of the transaction engine, thereby realizing guarantee on the security of the database.