CN112613302A - Dynamic credibility judgment method for clauses executing select statement based on database - Google Patents

Abstract

The invention provides a dynamic credibility judgment method for clauses executing select sentences based on a database, which comprises the following steps: s1, performing static credibility measurement on the most basic keywords in select SQL; s2, setting a clause keyword template in a trusted query statement by an administrator in a trusted database, calculating a trusted measurement value through an encryption algorithm and storing the trusted measurement value in a trusted calculation base; s3, when the database runs in a trusted environment, a user queries by using a select statement containing a group by clause, extracts keywords in the query statement and combines the keywords into a character string, and then carries out encryption operation on the character string to obtain a trusted measurement value; and S4, comparing the credibility measurement value in the S3 with the credibility measurement value in the credibility calculation base to obtain a credibility report. The dynamic credibility judgment method for the clauses executing the select statement based on the database checks the main keywords under the condition of credibility, and can effectively reduce the dynamic credibility calculation of the non-select statement operation of the user.

Description

Dynamic credibility judgment method for clauses executing select statement based on database

Technical Field

The invention belongs to the technical field of databases, and particularly relates to a dynamic credibility judgment method for clauses executing select sentences based on a database.

Background

With the rapid development of information technology, the data security problem is becoming more complex, and the trusted computing technology is also developing continuously as an important means for protecting data security. Today, trusted computing is used in a number of ways, such as identity theft protection, digital rights management, and the like. In order to solve the insecurity of a computer and a network structure and improve the safety fundamentally, a trusted hardware environment is started based on a trusted root of a trusted control module (TPMC) to measure the reliability of an operating system, a trust relationship is expanded to the operating system environment, the reliability of application and the network is measured to form a trusted safe operating environment guaranteed by a trusted chain, and the trusted measurement is carried out when a database is installed, so that the environment credibility and the static credibility of the database are realized, but the further credibility measurement of dynamic information of the database is lacked. The user performs credibility measurement on the operation of increasing, deleting, modifying and checking the data information in the database through SQL to know whether the user behavior is credible or not, which is very important for protecting the data security of the database. Meanwhile, the SQL statement has a plurality of keywords, various keywords can form various combinations, each combination is used as one group for carrying out credibility measurement, and a large amount of storage space and credibility measurement time are wasted.

Disclosure of Invention

In view of the above, in order to overcome the above drawbacks, the present invention is directed to a dynamic credible judgment method for executing clauses of select statements based on a database.

In order to achieve the purpose, the technical scheme of the invention is realized as follows:

a dynamic credibility judgment method for clauses of select statements executed based on a database comprises the following steps:

s1, performing static credibility measurement on the most basic keywords in select SQL to expand a credibility chain;

s2, setting a clause keyword template in a trusted query statement by an administrator in a trusted database, calculating a trusted measurement value through an encryption algorithm and storing the trusted measurement value in a trusted calculation base;

s3, when the database runs in a trusted environment, a user queries by using a select statement containing a group by clause, extracts keywords in the query statement and combines the keywords into a character string, and then carries out encryption operation on the character string to obtain a trusted measurement value;

and S4, comparing the credibility metric value in the S3 with the credibility metric value in the credibility calculation base to obtain a credibility report, feeding the comparison result back to the database, and executing subsequent operation by the credibility database system according to the dynamic credibility calculation result of the user query statement.

Further, in step S3, a syntax analyzer is used to perform syntax check on the query statement, a compiler is combined to generate a syntax analysis tree, and a keyword is extracted.

Further, the credibility value corresponding to the keyword extracted in the step S3 is stored in the credibility storage root.

Further, the information digest corresponding to the credibility measurement value in the step S2 is stored in a specific PCR in the credible storage root, and the measurement process is stored in the measurement log.

Compared with the prior art, the dynamic credibility judgment method for the clauses executing the select statement based on the database has the following advantages:

the dynamic credibility judgment method for the clauses executing the select statement based on the database has the following advantages that: firstly, a select keyword combination can form a plurality of credible templates, the substitution time is spent for traversing the templates in dynamic credibility judgment, the method is used for checking under the condition that the main keywords are credible, dynamic credible calculation of user non-select statement operation can be effectively reduced, in addition, whether the user operation is credible or not can be monitored in real time, the database security is improved, and the data security can be more effectively protected. .

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate an embodiment of the invention and, together with the description, serve to explain the invention and not to limit the invention. In the drawings:

FIG. 1 is an overall flow diagram;

FIG. 2 is a schematic diagram of a parse tree;

FIG. 3 is an example view of a parse tree;

FIG. 4 is an example parse tree diagram of FIG. two.

Detailed Description

It should be noted that the embodiments and features of the embodiments may be combined with each other without conflict.

In the description of the present invention, it is to be understood that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", and the like, indicate orientations or positional relationships based on those shown in the drawings, and are used only for convenience in describing the present invention and for simplicity in description, and do not indicate or imply that the referenced devices or elements must have a particular orientation, be constructed and operated in a particular orientation, and thus, are not to be construed as limiting the present invention. Furthermore, the terms "first", "second", etc. are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first," "second," etc. may explicitly or implicitly include one or more of that feature. In the description of the present invention, "a plurality" means two or more unless otherwise specified.

In the description of the present invention, it should be noted that, unless otherwise explicitly specified or limited, the terms "mounted," "connected," and "connected" are to be construed broadly, e.g., as meaning either a fixed connection, a removable connection, or an integral connection; can be mechanically or electrically connected; they may be connected directly or indirectly through intervening media, or they may be interconnected between two elements. The specific meaning of the above terms in the present invention can be understood by those of ordinary skill in the art through specific situations.

The present invention will be described in detail below with reference to the embodiments with reference to the attached drawings.

As shown in fig. 1 and fig. 2, a dynamic credibility judgment method for executing clauses of select statements based on a database includes the following steps:

s1, performing static credibility measurement on the most basic keywords in select SQL to expand a credibility chain;

s2, setting a clause keyword template in a trusted query statement by an administrator in a trusted database, calculating a trusted measurement value through an encryption algorithm and storing the trusted measurement value in a trusted calculation base;

s3, when the database runs in a trusted environment, a user queries by using a select statement containing a group by clause, extracts keywords in the query statement and combines the keywords into a character string, and then carries out encryption operation on the character string to obtain a trusted measurement value;

and S4, comparing the credibility metric value in the S3 with the credibility metric value in the credibility calculation base to obtain a credibility report, feeding the comparison result back to the database, and executing subsequent operation by the credibility database system according to the dynamic credibility calculation result of the user query statement.

In step S3, a syntax analyzer is used to perform syntax check on the query statement, a compiler is used to generate a syntax analysis tree, and keywords are extracted.

And the credibility value corresponding to the keyword extracted in the step S3 is stored in the credibility storage root.

And the information digest corresponding to the credible measurement value in the step S2 is stored in a specific PCR in the credible storage root, and the measurement process is stored in the measurement log.

The method comprises the steps that an administrator sets a static credible template and a dynamic credible template, keywords are extracted by a grammar analyzer, selected main keywords are selected for carrying out hash operation, calculation results are recorded in a PCR (polymerase chain reaction), remaining keywords are combined into a character string, the character string is subjected to hash operation by using an abstract algorithm in a subsystem with storage protection in the TCM, a characteristic value obtained after measurement is stored in a specific credible calculation base, and a characteristic value obtained by carrying out credible measurement on an inquiry statement input by a user is compared.

The user enters a query statement. The parser examines the syntax of the user query and then constructs a parse tree for the query statement. The primary keywords are extracted and merged into a string, and static confidence metrics are compared with records in the PCR.

And on the premise that the main keyword is credible, performing hash calculation on other keywords of the statement input by the user, comparing the credible measurement result of the keyword with the credible measurement result in the S1, and generating a credible report.

If the report shows that the contrast fails, the user is prompted for an error and access to the database is denied. If the report shows that the comparison is successful, the user can continue to perform select query operation and return a query result.

The technical scheme of the application is further explained by combining the specific examples as follows:

s1: the security administrator of the system sets a comparison template in the trusted database. The administrator makes the following statement settings

“user1；

8:00AM～16:00PM；

Select...from...where...group by”

And merging the keyword group by into a character string, performing credibility measurement by using an SM3 algorithm to obtain a characteristic value 0xB3F7 …, and storing a measurement result into a credible calculation base.

S2: and a user uses a select statement containing group by and order by clauses to inquire, a syntax analysis tree is generated through a syntax analyzer and a compiler, main keywords of the inquiry statement are extracted to carry out static credibility measurement, and a credibility chain is expanded.

S3, merging other keywords into character strings to carry out hash operation to obtain the normal query of the digest value feature code: select a from tb1 where name is 'zhang san' group by a;

the resulting parse tree is shown in fig. 3.

And extracting keywords 'group by..' and combining the keywords into a character string, and performing credibility measurement by using an SM3 algorithm to obtain a feature code 0xB3F7 ….

When the query is malicious: select a from tb1 where name is three group by a Order by age; the parse tree for this query statement is shown in FIG. 4:

extracting keywords 'group by... order by..', merging into a character string, and obtaining a characteristic value 0xC97A … by using the confidence measure of the SM3 algorithm. And saving the two measurement results in a trusted storage root.

And S4, comparing the two credibility measurement values in the S3 with the credibility measurement result of the S1 respectively. If the comparison between the confidence measure result 0xB3F7 … of the normal query and the confidence measure result 0xB3F7 … in S1 is basically the same, the comparison is successful, and the database returns a statement of "allow access" and simultaneously returns the query result.

In the malicious query statement, because the keyword of the order by appears, the characteristic value of the keyword of the query statement changes, the comparison between the measurement result 0xC97A … and the credible measurement result 0xB3F7 … in S1 is unsuccessful, the database returns the statement of 'access denial', and the user cannot use the statement to query the statement, and the user needs to modify the statement to query again.

The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents, improvements and the like that fall within the spirit and principle of the present invention are intended to be included therein.

Claims (4)

1. The dynamic credibility judgment method for executing clauses of select sentences based on the database is characterized by comprising the following steps of:

s1, performing static credibility measurement on the most basic keywords in select SQL to expand a credibility chain;

s2, setting a clause keyword template in a trusted query statement by an administrator in a trusted database, calculating a trusted measurement value through an encryption algorithm and storing the trusted measurement value in a trusted calculation base;

s3, when the database runs in a trusted environment, a user queries by using a select statement containing a group by clause, extracts keywords in the query statement and combines the keywords into a character string, and then carries out encryption operation on the character string to obtain a trusted measurement value;

and S4, comparing the credibility metric value in the S3 with the credibility metric value in the credibility calculation base to obtain a credibility report, feeding the comparison result back to the database, and executing subsequent operation by the credibility database system according to the dynamic credibility calculation result of the user query statement.

2. The method of claim 1, wherein the method comprises: in step S3, a syntax analyzer is used to perform syntax check on the query statement, a compiler is used to generate a syntax analysis tree, and keywords are extracted.

3. The method of claim 1, wherein the method comprises: and the credibility value corresponding to the keyword extracted in the step S3 is stored in the credibility storage root.

4. The method of claim 1, wherein the method comprises: and the information digest corresponding to the credible measurement value in the step S2 is stored in a specific PCR in the credible storage root, and the measurement process is stored in the measurement log.

Images