CN102799831A - Information safety protection system of application system based on database and information safety protection method - Google Patents

Abstract

Translated fromChinese

本发明公开一种基于数据库的应用系统信息安全保护系统及信息安全保护方法。系统包括基于数据库系统端的中心端、基于应用系统端的终端，以及用于中心端的硬件验证电子密匙；中心端包括文档加密模块、文档解密模块、身份验证模块和安全保护模块；终端包括安全会话模块、安全端口模块和安全保护模块；硬件验证电子密匙包括验证信息和权限信息。通过在数据库系统端和应用系统端建立连接，防止非法用户或未授权用户对数据库进行备份或导出等操作。本发明提供针对数据库和应用系统安全交互的方法，以保证在整个会话过程中的安全性。本发明可以很好的弥补基于数据库的应用系统的安全死角，防止企业内的核心机密。

The invention discloses a database-based application system information security protection system and an information security protection method. The system includes a central terminal based on the database system terminal, a terminal based on the application system terminal, and a hardware verification electronic key for the central terminal; the central terminal includes a document encryption module, a document decryption module, an identity verification module and a security protection module; the terminal includes a secure session module , a security port module and a security protection module; the hardware verification electronic key includes verification information and authority information. By establishing a connection between the database system side and the application system side, prevent illegal or unauthorized users from backing up or exporting the database. The invention provides a safe interaction method for the database and the application system to ensure the safety in the whole conversation process. The invention can well make up for the safety dead angle of the application system based on the database, and prevent core secrets in the enterprise.

Description

Translated fromChinese

基于数据库的应用系统信息安全保护系统及信息安全保护方法Application system information security protection system and information security protection method based on database

技术领域technical field

本发明属于信息安全技术领域，涉及一种信息安全保护系统，尤其涉及一种基于数据库的应用系统的信息安全保护系统，同时还涉及信息安全保护方法。The invention belongs to the technical field of information security, and relates to an information security protection system, in particular to an information security protection system based on a database application system, and also relates to an information security protection method.

背景技术Background technique

随着信息技术的发展，越来越多的企事业单位采用电子技术来处理日常事务，采用电子文档方式存储数据具有效率高、成本低、转移方便等优点。而数据库是这方面的典型代表，尤其是结构化查询语句等的发展。数据库具有方便共享，减少数据冗余、保持数据的独立性、实现数据集中控制、便于方便维护等优点。而且可以和前端的应用很方便的结合在一起，从而给用户更好的提供服务。目前基于数据库的应用系统已经深入到工作的各个方便，比如OA系统、ERP系统等。With the development of information technology, more and more enterprises and institutions use electronic technology to handle daily affairs. Using electronic documents to store data has the advantages of high efficiency, low cost, and convenient transfer. The database is a typical representative in this regard, especially the development of structured query statements. The database has the advantages of convenient sharing, reducing data redundancy, maintaining data independence, realizing centralized data control, and convenient maintenance. Moreover, it can be easily combined with front-end applications to provide users with better services. At present, the application system based on the database has penetrated into various conveniences of work, such as OA system, ERP system and so on.

同时，在考虑数据库提供的便利性的同时，不得不考虑其安全性。影响其安全性方面主要包含：宿主的安全性（所在操作系统的安全性），操作权限，核心数据的加密等。宿主的安全性主要依靠对所在操作系统进行安全漏洞和防护系统进行维护，操作权限包括细颗粒的权限系统，而核心数据加密则是采用MD5等算法对密码等核心数据进行加密。但目前所面临的主要问题是以上方法在面临现实使用时均具有一定的局限性和安全死角。比如系统管理员非法将服务器硬盘拔走，数据库开发人员将公司里面的数据携带出去，管理员有意或无意的非法操作导致数据库内的信息泄露等。At the same time, while considering the convenience provided by the database, its security has to be considered. Aspects that affect its security mainly include: the security of the host (the security of the operating system where it is located), operation permissions, encryption of core data, etc. The security of the host mainly depends on the maintenance of the security holes and protection system of the operating system. The operating authority includes a fine-grained authority system, and the core data encryption uses MD5 and other algorithms to encrypt core data such as passwords. But the main problem we are currently facing is that the above methods all have certain limitations and safety dead ends when faced with actual use. For example, the system administrator illegally unplugs the hard disk of the server, the database developer carries out the data in the company, and the administrator's intentional or unintentional illegal operations lead to information leakage in the database.

发明内容Contents of the invention

本发明的目的在于提供一种基于数据库的应用系统信息安全保护系统，在能够保证应用系统正常访问数据库的前提下，保证数据库系统的安全性。同时提供一整套基于数据库的应用系统信息安全保护方法，以保证数据库系统能够被正常使用。The purpose of the present invention is to provide a database-based application system information security protection system, which ensures the security of the database system on the premise that the application system can normally access the database. At the same time, it provides a set of database-based application system information security protection methods to ensure that the database system can be used normally.

本发明的技术方案如下：Technical scheme of the present invention is as follows:

一种基于数据库的应用系统信息安全保护系统，所述系统包括一个基于数据库系统端的中心端、一个或多个基于应用系统端的终端，以及一个用于中心端的硬件验证电子密匙；所述中心端设置于数据库服务器上，包括文档加密模块、文档解密模块、身份验证模块和安全保护模块；所述终端设置于应用服务器上，包括安全会话模块、安全端口模块和安全保护模块；各终端分别与中心端相连接；所述硬件验证电子密匙与中心端相连接，包括验证信息和权限信息。A database-based application system information security protection system, the system includes a central terminal based on the database system terminal, one or more terminals based on the application system terminal, and a hardware verification electronic key for the central terminal; the central terminal It is set on the database server, including document encryption module, document decryption module, identity verification module and security protection module; the terminal is set on the application server, including security session module, security port module and security protection module; each terminal communicates with the center respectively The terminal is connected; the hardware verification electronic key is connected with the central terminal, including verification information and authority information.

所述中心端使用文档加密模块对数据库文件进行透明加密保护，使数据库文件在使用过程中保持加密状态；所述文档解密模块对数据库文件在传送过程中进行透明解密操作，使数据库文件能够被正常使用；所述身份验证模块与硬件验证电子密匙进行强制绑定验证；所述安全保护模块用于防止非法操作，保护数据库系统的安全。The central end uses a document encryption module to transparently encrypt and protect the database file, so that the database file remains encrypted during use; the document decryption module performs a transparent decryption operation on the database file during transmission, so that the database file can be normally Use; the identity verification module and the hardware verification electronic key perform mandatory binding verification; the safety protection module is used to prevent illegal operations and protect the safety of the database system.

所述终端使用安全会话模块与中心端进行链接，以此保证应用系统在与数据库进行会话时保持安全状态；所述安全端口模块通过建立的安全会话向数据库发送端口信息，只有被验证的端口才能正常向服务器请求和发送信息；所述安全保护模块用于预防终端在建立链接或会话时被劫持。The terminal uses a secure session module to link with the central terminal, so as to ensure that the application system maintains a secure state when conducting a session with the database; the secure port module sends port information to the database through the established secure session, and only the verified port can Normally request and send information to the server; the security protection module is used to prevent the terminal from being hijacked when establishing a connection or session.

所述硬件验证电子密匙中的验证信息用于与中心端进行强制验证，所述权限信息用于在验证的基础上对用户提供相对应的权限。The verification information in the hardware verification electronic key is used for compulsory verification with the central terminal, and the authorization information is used for providing corresponding rights to the user on the basis of verification.

本发明还提供一种基于数据库的应用系统信息安全保护方法，包括：The present invention also provides a database-based application system information security protection method, including:

数据库文件加密步骤：用户在正常安装中心端并插入硬件验证电子密匙的情况下手动对数据库文件进行加密保护，加密保护后的数据库文件不允许任何连接，只有通过管理员设定的可信终端和可信端口才可以正常通信；Database file encryption steps: The user manually encrypts and protects the database file when the central terminal is installed normally and the hardware verification electronic key is inserted. The encrypted database file does not allow any connection, only through the trusted terminal set by the administrator. It can communicate normally with the trusted port;

数据库文件解密步骤：用户在正常安装中心端并插入硬件验证电子密匙的情况下手动对数据库文件进行解密操作，解密操作后的数据库文件可以在其他电脑上正常使用而无限制；Database file decryption steps: the user manually decrypts the database file after installing the central terminal and inserting the hardware verification electronic key, and the decrypted database file can be used normally on other computers without limitation;

电子密匙验证步骤：通过将中心端的相关信息与硬件验证电子密匙中的验证信息进行匹配，如果匹配不成功，数据库无法使用，若匹配成功则激活相应的权限模块；Electronic key verification step: by matching the relevant information of the center with the verification information in the hardware verification electronic key, if the matching is unsuccessful, the database cannot be used, and if the matching is successful, the corresponding authority module is activated;

安全会话步骤：终端先与中心端进行地址、端口验证，若成功收到中心端安全验证后的回复则发送用户和操作信息，若验证成功则可以正常会话；反之则无法正常向数据库发送或提取信息。Security session steps: the terminal first verifies the address and port with the center, and if it successfully receives the reply after the security verification from the center, it will send the user and operation information, and if the verification is successful, it can communicate normally; otherwise, it cannot send or extract to the database normally information.

所述数据库文件加密的具体步骤如下：管理员在安装有中心端的电脑上插入硬件验证电子密匙，输入相关信息，中心端同时读取硬件验证电子密匙中的验证信息，将输入的相关信息、硬件验证电子密匙中的验证信息与中心端内置的相关信息进行比对；若比对失败，则访问被拒绝，用户无法进行相应操作；若比对成功，用户可继续进行下一步操作；当用户选取一个或多个数据库文件进行手动加密操作时，中心端自动比对用户的权限信息，若用户拥有足够的权限进行操作，则可正常进行加密，反之操作被拒绝；当用户对数据库进行加密操作后，可设定相应的数据库权限信息，包括可通信IP与端口，以及是否允许解密操作。The concrete steps of described database file encryption are as follows: the administrator inserts the hardware authentication electronic key on the computer that is installed with the central end, inputs relevant information, and the central end simultaneously reads the verification information in the hardware authentication electronic key, and the input relevant information 1. Compare the verification information in the hardware verification electronic key with the relevant information built in the central terminal; if the comparison fails, the access will be rejected, and the user cannot perform corresponding operations; if the comparison is successful, the user can continue to the next step; When the user selects one or more database files for manual encryption operation, the center automatically compares the user's authority information. If the user has sufficient authority to operate, the encryption can be performed normally, otherwise the operation is rejected; when the user performs the operation on the database After the encryption operation, you can set the corresponding database permission information, including the communication IP and port, and whether to allow the decryption operation.

所述数据库文件解密的具体步骤如下：管理员在安装有中心端的电脑上插入硬件验证电子密匙，输入相关信息，中心端同时读取硬件验证电子密匙中的验证信息，将输入的相关信息、硬件验证电子密匙中的验证信息与中心端内置的相关信息进行比对；若比对失败，则访问被拒绝，用户无法进行相应操作；若比对成功，用户可继续进行下一步操作；当用户选取一个或多个数据库文件进行手动解密操作时，中心端自动比对用户的权限信息，若用户拥有足够的权限进行操作，则可正常进行解密，反之操作被拒绝。The specific steps of decrypting the database file are as follows: the administrator inserts the electronic key for hardware verification on the computer where the central terminal is installed, and inputs relevant information, and the central terminal reads the verification information in the electronic key for hardware verification at the same time, and the input relevant information 1. Compare the verification information in the hardware verification electronic key with the relevant information built in the central terminal; if the comparison fails, the access will be rejected, and the user cannot perform corresponding operations; if the comparison is successful, the user can continue to the next step; When the user selects one or more database files for manual decryption, the center automatically compares the user's authority information. If the user has sufficient authority to operate, the decryption can be performed normally, otherwise the operation is rejected.

所述电子密匙验证的具体步骤如下：通过将中心端的相关信息与硬件验证电子密匙中的验证信息进行匹配，若匹配失败，数据库无法使用；若匹配成功，则激活相应的权限模块，其包含以下几种情况：1）若中心端无硬件验证电子密匙，则数据库无法正常使用，但外网连接无限制；2）当中心端在插入硬件验证电子密匙时，如果中心端取出的硬件验证电子密匙的验证信息与中心端内置的相关信息不匹配，则中心端无法正常使用，此时数据库无法正常使用，但外网连接无限制；3）当中心端插入硬件验证电子密匙同时验证信息匹配，则限制外网连接，只允许通过合法端口才能正常与数据库进行通信，同时相应的权限模块被激活。The specific steps of the verification of the electronic key are as follows: by matching the relevant information of the central terminal with the verification information in the hardware verification electronic key, if the matching fails, the database cannot be used; if the matching is successful, the corresponding authority module is activated, and its Including the following situations: 1) If the central terminal does not have a hardware verification electronic key, the database cannot be used normally, but there is no limit to the external network connection; 2) When the central terminal is inserting the hardware verification electronic key, if the central terminal takes out the electronic key If the verification information of the hardware verification electronic key does not match the relevant information built in the central terminal, the central terminal cannot be used normally, and the database cannot be used normally at this time, but there is no limit to the external network connection; 3) When the central terminal inserts the hardware verification electronic key At the same time, if the verification information matches, the connection to the external network is restricted, and only legal ports are allowed to communicate with the database normally, and the corresponding permission module is activated at the same time.

所述安全会话的具体步骤如下：终端先将应用系统所在宿主主机的相关信息，包括IP地址信息、端口信息发送给中心端，中心端进行比对，若比对失败，则访问被拒绝；若比对成功，则将比对信息返回给终端；终端携带相关的链接信息，包括用户信息、操作信息发送给中心端，此时中心端进行二次比对，若比对失败，则访问被拒绝；若比对成功，则会话可正常进行；若中心端在收到终端多次请求，但多次比对均失败，则激活相应的保护信息，暂时中断与该终端的一切通信验证活动。The specific steps of the secure session are as follows: the terminal first sends relevant information about the host computer where the application system is located, including IP address information and port information, to the central terminal, and the central terminal performs a comparison. If the comparison fails, the access is rejected; If the comparison is successful, the comparison information will be returned to the terminal; the terminal will carry relevant link information, including user information and operation information, and send it to the center. At this time, the center will perform a second comparison. If the comparison fails, the access will be rejected. ; If the comparison is successful, the session can proceed normally; if the center receives multiple requests from the terminal, but the multiple comparisons fail, it activates the corresponding protection information and temporarily suspends all communication verification activities with the terminal.

本发明的有益技术效果是：The beneficial technical effect of the present invention is:

本发明通过在数据库系统端和应用系统端建立连接，防止非法用户或未授权用户对数据库进行备份或导出等操作。本发明提供针对数据库和应用系统安全交互的方法，以保证在整个会话过程中的安全性。本发明可以很好的弥补基于数据库的应用系统的安全死角，防止企业内的核心机密。The invention prevents illegal users or unauthorized users from backing up or exporting the database by establishing a connection between the database system end and the application system end. The invention provides a safe interaction method for the database and the application system to ensure the safety in the whole conversation process. The invention can well make up for the safety dead angle of the application system based on the database, and prevent core secrets in the enterprise.

本发明附加的方面和优点将在下面具体实施方式部分的描述中给出，部分将从下面的描述中变得明显，或通过本发明的实践了解到。Additional aspects and advantages of the invention will be set forth in the description which follows in the detailed description, and in part will be obvious from the description, or may be learned by practice of the invention.

附图说明Description of drawings

图1是本发明的系统框图。Fig. 1 is a system block diagram of the present invention.

图2是数据库系统初始化加密流程图。Figure 2 is a flow chart of database system initialization encryption.

图3是数据库系统解密流程图。Fig. 3 is a flow chart of database system decryption.

图4是硬件验证电子密匙与数据库系统正常协作流程图。Fig. 4 is a flow chart of the normal cooperation between the hardware verification electronic key and the database system.

图5是数据库系统与应用系统正常通信流程图。Fig. 5 is a flow chart of normal communication between the database system and the application system.

具体实施方式Detailed ways

下面结合附图对本发明的具体实施方式做进一步说明。The specific embodiments of the present invention will be further described below in conjunction with the accompanying drawings.

本发明提供一种基于数据库的应用系统安全保护系统，系统结构如图1所示，包括一个基于数据库系统端的中心端、一个或多个基于应用系统端的终端，以及一个用于中心端的硬件验证电子密匙。The present invention provides a database-based application system security protection system. The system structure is shown in Figure 1, including a central terminal based on the database system terminal, one or more terminals based on the application system terminal, and a hardware verification electronic terminal for the central terminal key.

中心端设置于数据库服务器上，包括文档加密模块、文档解密模块、身份验证模块和安全保护模块。数据库服务器上还设置有数据库系统。The central end is set on the database server, including a document encryption module, a document decryption module, an identity verification module and a security protection module. The database server is also provided with a database system.

终端设置于应用服务器上，包括安全会话模块、安全端口模块和安全保护模块。应用服务器上还设置有应用系统。各终端分别与中心端相连接。The terminal is set on the application server, including a safe session module, a safe port module and a safety protection module. An application system is also set on the application server. Each terminal is connected to the central terminal respectively.

硬件验证电子密匙与中心端相连接，包括验证信息和权限信息。The hardware verification electronic key is connected with the central terminal, including verification information and authority information.

基于上述系统，本发明所提供的基于数据库的应用系统安全保护方法包括如下步骤流程，结合图2～图5进行说明：Based on the above system, the database-based application system security protection method provided by the present invention includes the following steps and flow, which will be described in conjunction with FIGS. 2 to 5:

数据库系统初始化加密流程Database system initialization encryption process

如图2所示，管理员在安装有中心端的电脑上插入硬件验证电子密匙（以下简称EKEY），此时输入相关信息，中心端会同时读取EKEY中的验证信息，自动将输入的相关信息、中心端内置的相关信息、EKEY中的验证信息这三者进行对比。若比对失败，则访问被拒绝，用户无法进行相应操作；若比对成功，用户可继续进行下一步操作。当用户选取一个或多个数据库文件进行手动加密操作时，此时中心端会自动比对用户的权限信息，若用户拥有足够的权限进行操作，此时可正常进行加密，反之操作被拒绝。当用户对数据库进行加密操作后，可设定相应的数据库权限信息，例如可通信IP与端口，是否允许解密操作等。As shown in Figure 2, the administrator inserts the hardware verification electronic key (hereinafter referred to as EKEY) on the computer installed with the central terminal, and enters relevant information at this time, and the central terminal will read the verification information in the EKEY at the same time, and automatically convert the entered relevant information The information, the relevant information built in the center, and the verification information in EKEY are compared. If the comparison fails, the access is denied and the user cannot perform corresponding operations; if the comparison is successful, the user can continue to the next step. When the user selects one or more database files for manual encryption operation, the center will automatically compare the user's authority information at this time. If the user has sufficient authority to operate, the encryption can be performed normally at this time, otherwise the operation will be rejected. After the user encrypts the database, he can set the corresponding database permission information, such as the communication IP and port, whether to allow decryption, etc.

数据库系统解密流程Database system decryption process

如图3所示，管理员在安装有中心端的电脑上插入EKEY，此时输入相关信息，中心端会同时读取EKEY中的验证信息，自动将输入的相关信息、中心端内置的相关信息、EKEY中的验证信息这三者进行对比。若比对失败，则访问被拒绝，用户无法进行相应操作；若比对成功，用户可继续进行下一步操作。当用户选取一个或多个数据库文件进行手动解密操作时，此时中心端会自动比对用户的权限信息，若用户拥有足够的权限进行操作，此时可正常进行解密，反之操作被拒绝。As shown in Figure 3, the administrator inserts the EKEY on the computer with the central terminal installed. At this time, the relevant information is input, and the central terminal will read the verification information in the EKEY at the same time, and automatically convert the entered relevant information, the relevant information built in the central terminal, The verification information in EKEY is compared among the three. If the comparison fails, the access is denied and the user cannot perform corresponding operations; if the comparison is successful, the user can continue to the next step. When the user selects one or more database files for manual decryption, the center will automatically compare the user's authority information. If the user has sufficient authority to operate, the decryption can be performed normally at this time, otherwise the operation will be rejected.

EKEY与数据库正常协作流程EKEY and database normal cooperation process

如图4所示，通过将中心端的相关信息与EKEY中的验证信息进行匹配，如果匹配不成功，则数据库无法使用；若匹配成功，则激活相应的权限模块，其包含以下几种情况：1）若中心端无EKEY，则数据库无法正常使用，但外网连接无限制；2）当中心端在插入EKEY的时候，如果中心端取出的EKEY的验证信息与内置的相关信息不匹配，则中心端无法正常使用，此时数据库无法正常使用，但外网连接无限制；3）当中心端插入EKEY同时验证信息匹配，则限制外网连接，只允许通过合法端口才能正常与数据库进行通信，同时相应的权限模块被激活。As shown in Figure 4, by matching the relevant information of the central terminal with the verification information in EKEY, if the matching is unsuccessful, the database cannot be used; if the matching is successful, the corresponding authority module is activated, which includes the following situations: 1 ) If there is no EKEY at the central end, the database cannot be used normally, but there is no limit to the external network connection; 2) When the central end is inserting the EKEY, if the verification information of the EKEY taken out by the central end does not match the built-in relevant information, the central end The terminal cannot be used normally, and the database cannot be used normally at this time, but there is no limit to the external network connection; 3) When the central terminal inserts the EKEY and verifies that the information matches, the external network connection is restricted, and only legal ports are allowed to communicate with the database normally. The corresponding permission module is activated.

数据库系统与应用系统正常通信流程Normal communication process between database system and application system

如图5所示，终端先将应用系统所在的宿主主机的相关信息，例如IP地址信息、端口信息等发送给中心端，此时中心端进行比对，若比对失败，访问被拒绝；若比对成功，则将比对信息返回给终端，继续进行下一步；此时终端携带相关的链接信息，例如用户信息、操作信息等发送给中心端，此时中心端进行二次比对，若比对失败，访问被拒绝；若比对成功，则会话可正常进行。若中心端在收到终端多次请求，但多次比对均失败，则激活相应的保护信息，暂时中断与该终端的一切通信验证活动。As shown in Figure 5, the terminal first sends relevant information about the host where the application system is located, such as IP address information, port information, etc., to the central terminal. At this time, the central terminal performs a comparison. If the comparison fails, the access is rejected; if If the comparison is successful, the comparison information will be returned to the terminal and continue to the next step; at this time, the terminal carries relevant link information, such as user information, operation information, etc., to the center, and the center performs a second comparison. If the comparison fails, access is denied; if the comparison succeeds, the session can proceed normally. If the center terminal receives multiple requests from the terminal, but the multiple comparisons fail, it will activate the corresponding protection information and temporarily suspend all communication verification activities with the terminal.

以上所述的仅是本发明的优选实施方式，本发明不限于以上实施例。可以理解，本领域技术人员在不脱离本发明的基本构思的前提下直接导出或联想到的其他改进和变化，均应认为包含在本发明的保护范围之内。What is described above is only a preferred embodiment of the present invention, and the present invention is not limited to the above examples. It can be understood that other improvements and changes directly derived or conceived by those skilled in the art without departing from the basic idea of the present invention shall be considered to be included in the protection scope of the present invention.

Claims (9)

1. application system information safety protection system based on database; It is characterized in that: said system comprises a center-side based on the Database Systems end, one or more terminal based on the application system end, and the close spoon of hardware verification electronics that is used for center-side;

Said center-side is arranged on the database server, comprises file encryption module, document deciphering module, authentication module and security protection module;

Said terminal is arranged on the application server, comprises secured session module, secure port module and security protection module; Each terminal is connected with center-side respectively;

The close spoon of said hardware verification electronics is connected with center-side, comprises authorization information and authority information.

2. according to the said application system information safety protection system of claim 1 based on database; It is characterized in that: said center-side uses the file encryption module that the data library file is carried out the transparent encryption protection, makes database file in use keep encrypted state; Said document deciphering module carries out transparent decryption oprerations to the data library file in transport process, make the database file can be by normal use; The close spoon of said authentication module and hardware verification electronics forces to bind checking; Said security protection module is used to prevent illegal operation, the safety of protected data storehouse system.

3. according to the said application system information safety protection system based on database of claim 1, it is characterized in that: said terminal conversation module safe in utilization links with center-side, guarantees that with this application system keeps safe condition when carrying out session with database; Said secure port module to database transmit port information, has only the port of being verified could be normally to server requests and transmission information through the secured session set up; Said security protection module is used to prevent the terminal when setting up link or session, to be held as a hostage.

4. according to the said application system information safety protection system of claim 1 based on database; It is characterized in that: the authorization information in the close spoon of said hardware verification electronics is used for carrying out enforces authentication with center-side, and said authority information is used on the basis of checking, to the user corresponding authority being provided.

5. the information safety protecting method of any said application system information safety protection system based on database in the claim 1 to 4 is characterized in that may further comprise the steps:

The database file encrypting step: the user is in the normal mounting center-side and insert under the situation of the close spoon of hardware verification electronics and manually the data library file is carried out encipherment protection; Database file behind the encipherment protection does not allow any connection, has only the trusted terminal set through the keeper and the trusted port just can proper communication;

The database file decryption step: the user is in the normal mounting center-side and insert under the situation of the close spoon of hardware verification electronics and manually the data library file is carried out decryption oprerations, and the database file after the decryption oprerations can normally use on other computers and unrestrictedly;

The close spoon of electronics verification step: by the relevant information of center-side and the authorization information in the close spoon of hardware verification electronics are mated, if coupling is unsuccessful, database can't use, and then activates corresponding authority module if the match is successful;

The secured session step: address, port authorization are earlier carried out with center-side in the terminal, then send user and operation information if successfully receive the answer behind the center-side safety verification, can normal conversation if verify successfully then; Otherwise then can't normally send or information extraction to database.

6. according to the said application system information safety protecting method of claim 5 based on database; It is characterized in that: the concrete steps that said database file is encrypted are following: the keeper is being equipped with the close spoon of insertion hardware verification electronics on the computer of center-side; The input relevant information; Center-side reads the authorization information in the close spoon of hardware verification electronics simultaneously, and authorization information and the built-in relevant information of center-side in the close spoon of relevant information, the hardware verification electronics of input are compared; If comparison failure, access denied then, the user can't carry out corresponding operating; If compare successfully, the user can proceed next step operation; When the user chose one or more database files and carries out manual cryptographic operation, center-side was compared user's authority information automatically, if the user has enough authorities and operates, then can normally encrypt, otherwise operation was rejected; After the user carries out cryptographic operation to database, can set the corresponding database authority information, comprise can communicate by letter IP and port, and whether allow decryption oprerations.

7. according to the said application system information safety protecting method of claim 5 based on database; It is characterized in that: the concrete steps of said database file deciphering are following: the keeper is being equipped with the close spoon of insertion hardware verification electronics on the computer of center-side; The input relevant information; Center-side reads the authorization information in the close spoon of hardware verification electronics simultaneously, and authorization information and the built-in relevant information of center-side in the close spoon of relevant information, the hardware verification electronics of input are compared; If comparison failure, access denied then, the user can't carry out corresponding operating; If compare successfully, the user can proceed next step operation; When the user chose one or more database files and carries out manual decryption oprerations, center-side was compared user's authority information automatically, if the user has enough authorities and operates, then can normally decipher, otherwise operation was rejected.

8. according to the said application system information safety protecting method of claim 5 based on database; It is characterized in that: the concrete steps of the close spoon checking of said electronics are following: by the relevant information of center-side and the authorization information in the close spoon of hardware verification electronics are mated; If it fails to match, database can't use; If the match is successful, then activate corresponding authority module, it comprises following several situation: 1) if center-side does not have the close spoon of hardware verification electronics, then database can't normally use, but outer net connects unrestrictedly; 2) when center-side when inserting the close spoon of hardware verification electronics; If the authorization information and the built-in relevant information of center-side of the close spoon of the hardware verification electronics that center-side is taken out do not match; Then center-side can't normally be used, and this moment, database can't normally use, but outer net connects unrestrictedly; 3) insert the close spoon of hardware verification electronics simultaneous verification information matches when center-side, then limit outer net and connect, only allow could normally to communicate with database by legal port, authority module is activated accordingly simultaneously.

9. according to the said application system information safety protecting method of claim 5 based on database; It is characterized in that: the concrete steps of said secured session are following: the terminal belongs to application system the relevant information of host's main frame earlier; Comprise that IP address information, port information send to center-side; Center-side is compared, if comparison failure, then access denied; If compare successfully, then comparison information is returned to the terminal; Relevant link information is carried at the terminal, comprises that user profile, operation information send to center-side, and this moment, center-side was carried out the secondary comparison, if comparison failure, then access denied; If compare successfully, then session can normally be carried out; If center-side is receiving that the terminal repeatedly asks, but repeatedly all failures of comparison then activate corresponding protection information, temporary transient all checking activities of communicating by letter of interrupting with this terminal.

Images