CN112416909A - Cloud database auditing method and device and server - Google Patents

Abstract

The invention relates to the field of database auditing and discloses a cloud database auditing method, a cloud database auditing device and a cloud database auditing server. The method comprises the following steps: acquiring an SQL audit log; acquiring the content of the protected object configuration information; screening the contents of the SQL audit log and the configuration information of the protected object to obtain an audit record; the audit records are subjected to regulation matching to obtain new audit records; and inserting the new audit record into a database of an audit system, so that the audit of the database on the cloud can be realized, and the safety of the data in the database on the cloud is ensured.

Description

A cloud database auditing method, device and server

technical field

The invention relates to the field of database auditing, in particular to a cloud database auditing method, device and server.

Background technique

Database auditing (DBAudit for short) can record database activities on the network in real time, perform fine-grained audit compliance management on database operations, alert on risky behaviors suffered by the database, and block attack behaviors. It records, analyzes and reports the user's access to the database to help users generate compliance reports afterwards and trace the source of accidents.

The architecture of traditional database auditing can directly use port mirroring or plug-in diversion to filter the traffic we want to the audit device, but the cloud database has restrictions on this, and we cannot directly obtain it through the above methods. traffic, so the database on the cloud cannot be audited.

SUMMARY OF THE INVENTION

Based on this, it is necessary to provide a method, device and server for auditing a database on the cloud in view of the above technical problems, which can implement auditing of the database on the cloud, thereby ensuring the security of the data in the database on the cloud.

In a first aspect, an embodiment of the present invention provides a method for auditing a database on the cloud, and the method includes:

Get SQL audit log;

Obtain the content of the configuration information of the protected object;

Screening the content of the SQL audit log and the protection object configuration information to obtain audit records;

Perform regulatory matching on the audit records to obtain new audit records;

The new audit record is inserted into the database of the audit system.

In some embodiments, the obtaining the SQL audit log includes:

display the configuration page;

Obtain the registration information entered based on the configuration page;

Call the API interface according to the registration information to obtain the SQL audit log.

In some embodiments, the filtering of the content of the SQL audit log and the configuration information of the protection object to obtain an audit record includes:

Based on the same field and/or IP address, the content of the SQL audit log is combined with the content of the protection object configuration in the audit system to obtain an audit record.

In some embodiments, based on the IP address, the content of the SQL audit log is combined with the content of the protection object configuration in the audit system, and before the audit record is obtained, the method further includes:

Character segmentation is performed on the fields of the SQL audit log content to obtain the host address field.

In some embodiments, based on the IP address, the content of the SQL audit log is combined with the content of the protection object configuration in the audit system to obtain an audit record, including:

comparing the host address field with the IP address;

If the host address field is consistent with the IP address, the content of the SQL audit log and the content of the protection object configuration are combined to obtain an audit record.

In some embodiments, based on the same field, the content of the SQL audit log is combined with the content of the protection object configuration in the audit system to obtain the audit record, including:

Compare the fields of the SQL audit log content with the fields of the content configured by the protection object;

If they are consistent, the content corresponding to the field of the SQL audit log is combined with the content corresponding to the field configured in the protection object in the audit system to obtain an audit record.

In some embodiments, performing regulation matching on the audit record to obtain a new audit record includes:

Matching the audit record with the rules invoked by the rule engine to fill the fields in the audit record to obtain a new audit record.

In a second aspect, an embodiment of the present invention also provides an apparatus for auditing a database on the cloud, including:

The first obtaining module is used to obtain the SQL audit log;

The second acquisition module is used to acquire the content of the configuration information of the protected object;

a screening module, used for screening the content of the SQL audit log and the configuration information of the protection object to obtain audit records;

a matching module, configured to perform regulation matching on the audit records to obtain new audit records;

The inserting module is used for inserting the new audit record into the database of the audit system.

In a third aspect, an embodiment of the present invention further provides a server, including:

at least one processor; and,

a memory communicatively coupled to the at least one processor; wherein,

the memory stores instructions executable by the at least one processor, the instructions

is executed by the at least one processor, so that the at least one processor can execute the above-mentioned method for auditing a database on the cloud.

In a fourth aspect, an embodiment of the present invention further provides a non-volatile computer-readable storage medium, where the computer-readable storage medium stores computer-executable instructions, when the computer-executable instructions are executed by a processor , causing the processor to execute the above cloud database auditing method.

Compared with the prior art, the beneficial effects of the present invention are: different from the prior art, the cloud database auditing method, device and server in the embodiments of the present invention separate logs by using SQL insight, and then Filter the SQL audit log in combination with the content of the configuration information of the protection object to generate audit records that conform to the audit equipment, then use the background program to match the audit records to the rules to obtain new audit records, and finally insert the new audit records into the database. It can audit the database on the cloud, so as to ensure the security of the data in the database on the cloud.

Description of drawings

One or more embodiments are exemplified by the pictures in the corresponding drawings, and these exemplifications do not constitute limitations of the embodiments, and elements with the same reference numerals in the drawings are denoted as similar elements, Unless otherwise stated, the figures in the accompanying drawings do not constitute a scale limitation.

Fig. 1 is the hardware structure schematic diagram of the server of the present invention;

2 is a schematic flowchart of a method for auditing a database on the cloud in an embodiment of the present invention;

FIG. 3 is a structural block diagram of an apparatus for auditing a database on the cloud in an embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

It should be noted that, if there is no conflict, various features in the embodiments of the present invention can be combined with each other, which are all within the protection scope of the present invention. In addition, although the functional modules are divided in the schematic diagram of the device, and the logical sequence is shown in the flowchart, in some cases, the modules in the device may be divided differently, or the sequence shown in the flowchart may be performed. or the described steps. Furthermore, the words "first", "second" and "third" used in the present invention do not limit the data and execution order, but only distinguish the same or similar items with basically the same function and effect.

An embodiment of the present invention provides a server. Please refer to FIG. 1 . FIG. 1 is a hardware structure diagram of a server provided by an embodiment of the present invention. The server 100 may be any type of device with computing capability. , eg: Audit server.

Specifically, as shown in FIG. 1 , the server 100 includes one or more processors 102 and a memory 104 . A processor 102 is taken as an example in FIG. 1 . The processor 102 and the memory 104 may be connected through a bus or in other ways, and the connection through a bus is taken as an example in FIG. 1 .

The memory 104, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs and modules, such as those corresponding to the cloud database auditing method in the embodiment of the present invention. Programs, Instructions, and Modules. The processor 102 executes various functional applications and data processing of the server by running the non-volatile software programs, instructions and modules stored in the memory 104, ie, implements the cloud database auditing method in the following embodiments.

The memory 104 may include a stored program area and a stored data area, wherein the stored program area may store an operating system and an application program required by at least one function; the stored data area may store data created according to the use of the cloud database auditing device, and the like. Additionally, memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other non-volatile solid state storage device. In some embodiments, the memory 104 may optionally include memory located remotely from the processor 102, and these remote memories may be connected to the database auditing device on the cloud through a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

As shown in FIG. 2, an embodiment of the present invention provides a method for auditing a database on the cloud. The method is executed by a server, and the method includes:

Step 202, acquiring the SQL audit log.

In the embodiment of the present invention, the SQL audit log is stored in a database on the cloud, and the SQL audit log can also be understood as a SQL insight log, and all operations on the database are recorded in the SQL audit log. Specifically, the server obtains the SQL audit log in the database on the cloud.

In some of the embodiments, as an implementation manner of step 202, it includes: displaying a configuration page; obtaining registration information input based on the configuration page; calling an API interface according to the registration information to obtain a SQL audit log.

In this embodiment of the present invention, if you want to obtain the SQL audit log, you need to register in advance, and the registration information is parameter information, including but not limited to key ID, key signature string, signature result string, timestamp, etc., where, The key ID is similar to an account, the key signature string is similar to a password, and the resulting signature string is similar to a verification code. Specifically, register the database insight log through the configuration interface, and then generate the SDK code to generate the SQL audit log, and then call the API interface through the registration information, that is, the parameter information, so as to obtain the SQL audit log in the database on the cloud.

Step 204: Obtain the content of the configuration information of the protected object.

In the embodiment of the present invention, the configuration information of the protection object is stored in the audit system, and the content of the configuration information of the protection object includes but is not limited to the original IP address of the protection object, the policy of the protection object, the rules of the protection object, the port and the database version number, etc. . Specifically, the server obtains the content of the configuration information of the protection object from the auditing system.

Step 206: Screen the contents of the SQL audit log and the configuration information of the protection object to obtain audit records.

In the embodiment of the present invention, the audit record is a record conforming to the audit equipment, and the audit record is obtained by screening the contents of the SQL audit log and the configuration information of the protection object, but the audit record obtained after screening is incomplete the audit record file, and the audit record needs to be processed subsequently.

In some of the embodiments, as an implementation manner of step 206, it includes: based on the same field and/or IP address, combining the content of the SQL audit log with the content of the protection object configuration in the audit system to obtain the audit Record.

In this embodiment of the present invention, the audit records may be obtained in various manners, including but not limited to being based on the same fields and/or IP addresses. Wherein, the audit record is obtained based on the IP address, and the host address field is compared with the IP address; if the host address field is consistent with the IP address, the content of the SQL audit log and the content of the protection object configuration are combined , to obtain audit records. Specifically, after the server calls the API interface through the parameter information, it will return the return content in a certain format, for example, a certain format can be jsson format or xml format, etc., the returned content contains the field of the SQL audit log content, and then use the character The string segmentation function performs string segmentation on the fields of the content of the SQL audit log, extracts the host address field, and then compares the host address field with the original IP address of the protection object. If the IP addresses are the same, the content of the SQL audit log and the content of the protection object configuration are combined to form an audit record.

In addition, an audit record is obtained based on the same field, and the field of the SQL audit log content is compared with the field of the content configured by the protection object; if they are consistent, the content corresponding to the field of the SQL audit log is compared with that in the audit system. The contents corresponding to the fields configured in the protection object are combined to obtain audit records. Specifically, after the server calls the API interface through the parameter information, it will return the return content in a certain format, for example, a certain format can be jsson format or xml format, etc., the returned content contains the fields of the SQL audit log content, through the same Field, the content corresponding to the field of the SQL audit log is combined with the content corresponding to the field of the protection object configuration in the audit system to form an audit record suitable for the database audit server.

Step 208, performing regulation matching on the audit records to obtain new audit records.

In the embodiment of the present invention, the new audit record is a complete audit record file, and the new audit record includes the original IP address, original port, operation statement, client subject information, occurrence time, etc., wherein the client subject information includes but Not limited to database name, database access tool, database account, etc. Specifically, after obtaining the audit record, it is necessary to perform regulation matching on the audit record, so that an audit record that conforms to the audit system can be obtained.

In some of the embodiments, as an implementation manner of step 208, the method includes: matching the audit record with the rules invoked by the rule engine to fill in the fields in the audit record to obtain a new audit record.

In this embodiment of the present invention, the new audit record must be a complete audit record, and the rules invoked by the rule engine include but are not limited to keywords, operation types, rule effective time, and rule whitelists. Specifically, the server matches the obtained audit records with the rules invoked by the rule engine. The main purpose of matching is to refill the audit records. Because the audit records obtained by screening in advance are incomplete, it is necessary to pass the rules engine to the audit records. Some fields of the audit record are judged to determine whether the field is missing some content. If there is a missing content, the rule engine invokes the rules to fill the missing content of the audit record with a new field to generate an audit record that conforms to the audit system. Exemplarily, if the audit record lacks a keyword, the rule engine invokes the keyword to fill in the audit record, thereby generating an audit record conforming to the audit system.

Step 210, inserting the new audit record into the database of the audit system.

The server performs storage processing on the new audit record.

In the embodiment of the present invention, the log is separated by adopting SQL insight, and then the SQL audit log is filtered in combination with the content of the configuration information of the protection object to generate an audit record conforming to the audit equipment, and then the background program is used to make rules for the audit record. Match, obtain new audit records, and finally insert the new audit records into the database, so as to realize the audit of the database on the cloud, thereby ensuring the security of the data in the database on the cloud.

It should be noted that, in the above embodiments, the above steps do not necessarily exist in a certain order. Those of ordinary skill in the art can understand from the description of the embodiments of the present invention that in different embodiments, the above steps There may be different execution orders, that is, parallel execution, alternate execution, and so on.

Correspondingly, an embodiment of the present invention also provides an apparatus 300 for auditing a database on the cloud, as shown in FIG. 3 , including:

The first obtaining module 302 is used to obtain the SQL audit log;

A second obtaining module 304, configured to obtain the content of the configuration information of the protected object;

A screening module 306, configured to screen the contents of the SQL audit log and the configuration information of the protection object to obtain audit records;

a matching module 308, configured to perform regulation matching on the audit record to obtain a new audit record;

The inserting module 310 is used for inserting the new audit record into the database of the audit system.

In the cloud database auditing device provided by the embodiment of the present invention, the SQL audit log is acquired through the first acquisition module, the content of the configuration information of the protection object is acquired through the second acquisition module, and then the SQL audit log and the protection object are acquired through the screening module. The content of the object configuration information is screened to obtain audit records, and further, the audit records are regulated and matched through the matching module to obtain new audit records, and finally the new audit records are inserted into the database of the audit system through the insert module, In this way, the auditing of the database on the cloud can be realized, thereby ensuring the security of the data in the database on the cloud.

Optionally, in other embodiments of the apparatus, please refer to FIG. 3 , the apparatus 300 further includes:

The segmentation module 312 is configured to perform character segmentation on the fields of the SQL audit log content to obtain the host address field.

Optionally, in other embodiments of the apparatus, the first obtaining module 302 is specifically configured to:

display the configuration page;

Obtain the registration information entered based on the configuration page;

Call the API interface according to the registration information to obtain the SQL audit log.

Optionally, in other embodiments of the apparatus, the screening module 306 is specifically configured to:

Based on the same field and/or IP address, the content of the SQL audit log is combined with the content of the protection object configuration in the audit system to obtain an audit record.

comparing the host address field with the IP address;

If the host address field is consistent with the IP address, the content of the SQL audit log and the content of the protection object configuration are combined to obtain an audit record.

Compare the fields of the SQL audit log content with the fields of the content configured by the protection object;

If they are consistent, the content corresponding to the field of the SQL audit log is combined with the content corresponding to the field configured in the protection object in the audit system to obtain an audit record.

Optionally, in other embodiments of the apparatus, the matching module 308 is specifically configured to:

Matching the audit record with the rules invoked by the rule engine to fill the fields in the audit record to obtain a new audit record.

It should be noted that the above-mentioned cloud database auditing apparatus can execute the cloud database auditing method provided by the embodiments of the present invention, and has functional modules and beneficial effects for executing the method application, which are not described in detail in the embodiments of the cloud database auditing apparatus of the present invention. For technical details, refer to the cloud database auditing method provided by the embodiment of the present invention.

Embodiments of the present invention further provide a non-volatile computer-readable storage medium, where the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by one or more processors, can cause The above-mentioned one or more processors can execute the method for auditing a database on the cloud in any of the above-mentioned method embodiments.

The server of the embodiment of the present invention exists in various forms, including but not limited to:

(1) Tower server

The general tower server case is similar to our commonly used PC case, and the large tower case is much thicker. In general, there is no fixed standard for the external dimensions.

(2) Rack server

Rack-mounted servers are a type of server with a standard width of 19-inch racks, and the height ranges from 1U to several U, due to the dense deployment of enterprises. Placing servers on racks is not only beneficial for routine maintenance and management, but may also avoid unexpected failures. First, place the server without taking up too much space. Rack servers are neatly arranged in the rack without wasting space. Secondly, cables, etc. can also be neatly stored in the rack. All power cables and LAN cables can be routed in the cabinet, which can reduce the number of connection cables accumulated on the ground, thereby preventing accidents such as kicking off the cables. The specified dimensions are the width (48.26cm=19 inches) and height (multiples of 4.445cm) of the server. Racks that meet this requirement are sometimes referred to as "19-inch racks" because they are 19 inches wide.

(3) Blade server

Blade server is a low-cost server platform of HAHD (High Availability High Density, High Availability High Density), which is specially designed for special application industries and high-density computer environments. Each "blade" is actually a system motherboard. , similar to an independent server. In this mode, each motherboard runs its own system, serving different user groups specified, and is not related to each other. However, these motherboards can be aggregated into a server cluster using system software. In cluster mode, all motherboards can be connected to provide a high-speed network environment, and can share resources to serve the same user group.

(4) Cloud server

A cloud server (Elastic Compute Service, ECS) is a simple, efficient, safe and reliable computing service with scalable processing capabilities. Its management method is simpler and more efficient than physical servers, and users can quickly create or release any number of cloud servers without purchasing hardware in advance. The distributed storage of cloud servers is used to integrate a large number of servers into a supercomputer, providing a large amount of data storage and processing services. Distributed file systems and distributed databases allow access to common storage resources and realize IO sharing of application data files. The virtual machine can break through the limitation of a single physical machine, and the dynamic resource adjustment and allocation can eliminate the single point of failure of servers and storage devices, and achieve high availability.

The device embodiments described above are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

From the description of the above embodiments, those of ordinary skill in the art can clearly understand that each embodiment can be implemented by means of software plus a general hardware platform, and certainly can also be implemented by hardware. Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and the program is During execution, it may include the processes of the embodiments of the above-mentioned methods. Wherein, the storage medium can be a magnetic disk, an optical disk, a read-only

Storage memory (Read-Only Memory, ROM) or random access memory (Random Access Memory, RAM) and so on.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; under the idea of the present invention, the technical features in the above embodiments or different embodiments can also be combined, The steps may be carried out in any order, and there are many other variations of the different aspects of the invention as described above, which are not provided in detail for the sake of brevity; although the invention has been The skilled person should understand that it is still possible to modify the technical solutions recorded in the foregoing embodiments, or to perform equivalent replacements on some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the implementation of the present invention. scope of technical solutions.

Claims (10)

1. A cloud database auditing method, wherein the method comprises: Get SQL audit log; Obtain the content of the configuration information of the protected object; Screening the content of the SQL audit log and the protection object configuration information to obtain audit records; Perform regulatory matching on the audit records to obtain new audit records; The new audit record is inserted into the database of the audit system. 2. method according to claim 1, is characterized in that, described obtaining SQL audit log, comprises: display the configuration page; Obtain the registration information entered based on the configuration page; Call the API interface according to the registration information to obtain the SQL audit log. 3. The method according to claim 1 or 2, wherein the filtering of the content of the SQL audit log and the protection object configuration information to obtain an audit record, comprising: Based on the same field and/or IP address, the content of the SQL audit log is combined with the content of the protection object configuration in the audit system to obtain an audit record. 4. The method according to claim 3, wherein, based on the IP address, the content of the SQL audit log is combined with the content of the protection object configuration in the audit system, before obtaining the audit record, the method also include: Character segmentation is performed on the fields of the SQL audit log content to obtain the host address field. 5. The method according to claim 4, wherein, based on the IP address, the content of the SQL audit log is combined with the content of the protection object configuration in the audit system to obtain an audit record, comprising: comparing the host address field with the IP address; If the host address field is consistent with the IP address, the content of the SQL audit log and the content of the protection object configuration are combined to obtain an audit record. 6. The method according to claim 3, wherein, based on the same field, the content of the SQL audit log is combined with the content of the protection object configuration in the audit system to obtain an audit record, comprising: Compare the fields of the SQL audit log content with the fields of the content configured by the protection object; If they are consistent, the content corresponding to the field of the SQL audit log is combined with the content corresponding to the field configured in the protection object in the audit system to obtain an audit record. 7. The method according to claim 1, wherein, performing regulation matching on the audit record to obtain a new audit record, comprising: Matching the audit record with the rules invoked by the rule engine to fill the fields in the audit record to obtain a new audit record. 8. A database auditing device on the cloud, comprising: The first obtaining module is used to obtain the SQL audit log; The second acquisition module is used to acquire the content of the configuration information of the protected object; a screening module, used for screening the content of the SQL audit log and the configuration information of the protection object to obtain audit records; a matching module, configured to perform regulation matching on the audit records to obtain new audit records; The inserting module is used for inserting the new audit record into the database of the audit system. 9. A server, characterized in that, comprising: at least one processor; and, a memory communicatively coupled to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the execution of any of claims 1-7 method. 10. A non-volatile computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions that, when executed by a processor, cause the processing The controller performs the method of any one of claims 1-7.

Images