CN110647771B - Mysql database storage integrity verification protection method and device - Google Patents
Mysql database storage integrity verification protection method and device Download PDFInfo
- Publication number
- CN110647771B CN110647771B CN201910854451.4A CN201910854451A CN110647771B CN 110647771 B CN110647771 B CN 110647771B CN 201910854451 A CN201910854451 A CN 201910854451A CN 110647771 B CN110647771 B CN 110647771B
- Authority
- CN
- China
- Prior art keywords
- mysql database
- visitor
- port number
- white list
- connection
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/14—Error detection or correction of the data by redundancy in operation
- G06F11/1402—Saving, restoring, recovering or retrying
- G06F11/1446—Point-in-time backing up or restoration of persistent data
- G06F11/1458—Management of the backup or restore process
- G06F11/1464—Management of the backup or restore process for networked environments
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Theoretical Computer Science (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- General Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Bioethics (AREA)
- Health & Medical Sciences (AREA)
- Quality & Reliability (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention relates to a mysql database storage integrity verification protection method and a mysql database storage integrity verification protection device, wherein the method comprises the following steps: 1) checking the network connection information of the visitor who is currently connected with the mysql database in real time, judging whether illegal connection exists or not according to the network connection information, and if yes, disconnecting the connection or giving an alarm; 2) monitoring binlog logs of the mysql database in real time, acquiring recent log updating contents, acquiring network connection information of a visitor operating the mysql database according to the recent log updating contents, judging whether illegal connection exists or not according to the network connection information, and if yes, giving an alarm to prompt or directly carrying out backup reduction. The device comprises a processor and a memory, wherein the processor is used for executing instructions stored in the memory to realize the check protection method. The method can efficiently detect the tampered data of the database, and can accurately process the tampered data to well protect the storage integrity of the mysql database.
Description
Technical Field
The invention belongs to the technical field of computer information security, and particularly relates to a mysql database storage integrity verification protection method and device.
Background
The storage integrity detection and protection of the database are core points of the information security of the database. Particularly, the mysql database is mostly used in an intelligent substation, and one-time hacking can bring huge loss to the whole power grid and even the whole country. Based on this, network security protection is becoming increasingly important. Therefore, the storage integrity detection and protection of the mysql database are the vital parts for the security protection of the power grid network. However, in the prior art, the configuration security of the mysql database is mostly monitored, and a storage integrity detection method of the mysql database is lack of research, so a storage integrity verification protection method and device of the mysql database is urgently needed to resist hacker attacks, ensure the storage integrity of the mysql database and improve the network security thereof.
Disclosure of Invention
The invention provides a mysql database storage integrity checking protection method and device, which are used for improving the network security of a mysql database.
In order to solve the technical problem, the mysql database storage integrity verification protection method comprises the following steps:
1) checking the network connection information of the visitor who is currently connected with the mysql database in real time, judging whether the visitor is in illegal connection or not according to the network connection information of the visitor, and if the visitor is in illegal connection, disconnecting the connection or giving an alarm;
2) monitoring a binlog log of the mysql database in real time, acquiring the latest log updating content, acquiring network connection information of an accessor operating the mysql database according to the latest log updating content, judging whether the visitor is in illegal connection or not according to the network connection information of the accessor, and giving an alarm to prompt or directly replacing the current mysql database with the latest backup of the mysql database if the visitor is in illegal connection.
The invention has the beneficial effects that: the mysql database storage integrity checking and protecting method can efficiently detect the tampered data of the database, can accurately process the data to well protect the storage integrity of the mysql database, improves the capability of the mysql database in resisting hacker attacks, improves the network security of the mysql database, and provides good support for the application of the mysql database in a substation monitoring system.
In order to improve the accuracy of check protection, whether illegal connection exists is judged according to the following method: and acquiring a port number of an access person establishing connection with the mysql database, judging whether the port number is in a mysql port white list, and if the port number is not in the mysql port white list, determining that the connection is illegal.
In order to improve the flexibility of verification protection, if the connection is selected to be not disconnected after the alarm prompt, the port number of the visitor is directly added into a trusted port white list or whether the port number of the visitor is added into the trusted port white list is prompted.
In order to further improve the flexibility and reliability of verification protection, judging whether the connection is illegal, before carrying out alarm prompting or directly replacing the current mysql database with the latest backup of the mysql database, judging whether the port number of an accessor is in a trusted port white list, and if the port number is not in the trusted port white list, carrying out alarm prompting or directly replacing the current mysql database with the latest backup of the mysql database.
In order to improve the reliability of check protection, after the alarm prompt, disconnection is selected, whether the port number of the visitor is in a trusted port number white list or not is checked, and if the port number of the visitor is in the trusted port number white list, the port number of the visitor is deleted from the trusted port white list.
In order to improve the accuracy and reliability of verification protection, a process white list of an accessor allowed to establish connection with the mysql database is configured in advance, if the connection ID of the accessor currently running is located in the process white list, the opened port number of the accessor is obtained, and the mysql port number white list is established.
In order to improve the accuracy and reliability of check protection, a connection ID of an accessor is obtained, and a mapping set of a port number and the link ID is inquired, so that the port number of the accessor is obtained.
In order to improve the network security of the mysql database, the mysql database storage integrity verification protection device comprises a processor and a memory, wherein the processor is used for executing instructions stored in the memory to realize a mysql database storage integrity verification protection method, and the method comprises the following steps:
1) checking the network connection information of the visitor who is currently connected with the mysql database in real time, judging whether the visitor is in illegal connection or not according to the network connection information of the visitor, and if the visitor is in illegal connection, disconnecting the connection or giving an alarm;
2) monitoring a binlog log of the mysql database in real time, acquiring the latest log updating content, acquiring network connection information of an accessor operating the mysql database according to the latest log updating content, judging whether the visitor is in illegal connection or not according to the network connection information of the accessor, and giving an alarm to prompt or directly replacing the current mysql database with the latest backup of the mysql database if the visitor is in illegal connection.
The mysql database storage integrity checking and protecting device can efficiently detect tampered data of the database, can accurately process the tampered data to well protect the storage integrity of the mysql database, improves the capability of the mysql database in resisting hacker attacks, improves the network security of the mysql database, and provides good support for the application of the mysql database in a substation monitoring system.
To improve the accuracy of the check protection, the processor is configured to execute the following instructions stored in the memory: judging whether the connection is illegal according to the following method: and acquiring a port number of an access person establishing connection with the mysql database, judging whether the port number is in a mysql port white list, and if the port number is not in the mysql port white list, determining that the connection is illegal.
To increase flexibility of check protection, the processor is configured to execute the following instructions stored in the memory: and if the connection is not disconnected after the alarm prompt, directly adding the port number of the visitor into a trusted port white list or prompting whether to add the port number of the visitor into the trusted port white list.
To further increase the flexibility and reliability of the check protection, the processor is configured to execute the following instructions stored in the memory: judging whether the connection is illegal, before carrying out alarm prompting or directly replacing the current mysql database with the latest backup of the mysql database, judging whether the port number of the visitor is in a trusted port white list, and if the port number is not in the trusted port white list, carrying out alarm prompting or directly replacing the current mysql database with the latest backup of the mysql database.
To improve check protection reliability, the processor is to execute the following instructions stored in the memory: if the visitor is in the white list of the trusted port, deleting the visitor from the white list of the trusted port.
To improve the accuracy and reliability of the check protection, the processor is configured to execute the following instructions stored in the memory: and if the connection ID of the currently running visitor is positioned in the process white list, acquiring the opened port number of the currently running visitor, and establishing the mysql port number white list.
To improve the accuracy and reliability of the check protection, the processor is configured to execute the following instructions stored in the memory: and acquiring the connection ID of the visitor, and inquiring the mapping set of the port number and the link ID so as to acquire the port number of the visitor.
Drawings
FIG. 1 is a flowchart of a mysql database storage integrity verification protection method according to the present invention;
FIG. 2 the present invention uses a third party tool to tamper with a database map;
FIG. 3 is a mysql database storage integrity check chart of the present invention;
FIG. 4 is a representation of the mysql database restore backup of the present invention.
Detailed Description
The technical scheme of the invention is further explained in detail in the following with the accompanying drawings.
The embodiment of the mysql database storage integrity checking and protecting method is disclosed.
The mysql database storage integrity checking protection method disclosed by the invention comprises the following steps as shown in figure 1:
1) checking the network connection information of the visitor who is currently connected with the mysql database in real time, judging whether the visitor is in illegal connection or not according to the network connection information of the visitor, and if the visitor is in illegal connection, disconnecting the visitor or giving an alarm;
2) monitoring a binlog log of the mysql database in real time, acquiring the latest log updating content, acquiring network connection information of an accessor operating the mysql database according to the latest log updating content, judging whether the visitor is in illegal connection or not according to the network connection information of the accessor, and giving an alarm to prompt or directly replacing the current mysql database with the latest backup of the mysql database if the visitor is in illegal connection.
The step 1) and the step 2) are generally performed simultaneously, if only the step 1) is performed, a bug may exist, so that an illegal visitor falsifies the database information, and therefore the database information can be compensated through the step 2), and the storage safety of the database is greatly improved through the method provided by the invention.
The specific method for judging the illegal connection comprises the following steps: and acquiring a port number of an access person establishing connection with the mysql database, judging whether the port number is in a mysql port white list, and if the port number is not in the mysql port white list, determining that the connection is illegal. The mysql port white list can be established in the following way: through application configuration, a process white list of an accessor which is allowed to establish connection with the mysql database is established in advance, when the accessor establishes connection with the mysql database, a port number opened by the process is obtained, and then the port number is added into the mysql port white list, so that the mysql port white list is established. The visitor port number can be obtained by the following method: and monitoring the port number of an accessor establishing connection with the mysql database in real time, and establishing a mapping set between the connection ID and the port number of the accessor, so that when the accessor is connected with the database, the port number of the accessor can be obtained according to the connection ID.
The above-mentioned optimal method for judging the illegal connection can be, of course, also judged in other ways, for example, checking the network connection information of the visitor who has logged in the database at present, acquiring all the process information of the visitor who establishes the network connection with the database, judging whether the process information conforms to the preset process access rule, if not, judging the illegal connection.
The invention can also set a credible port white list, which is not set in advance, but when the system judges that the visitor is not in the mysql port white list and the alarm prompts the user to be illegal connection, the user allows the mysql database to be accessed due to the actual application requirement, and at this time, the visitor can be added into the credible port white list. However, the visitor in the trusted port white list only temporarily has the right to access the mysql database, and still needs to judge whether the visitor is legal when the visitor accesses the mysql database again, and if the user chooses to disconnect this time, the visitor is deleted from the trusted port white list, and further, the visitor can also be deleted from the connection ID and port number mapping set of the mysql database and stored in the history mapping set. The trusted port white list is dynamically updated.
And in the step 2), a binlog log of the mysql database is monitored in real time, and the binlog log is a binary log of the mysql database and is used for recording SQL (except for data query) statement information of the database operation of the user. The visitor who operates (such as modifying, deleting and the like) on the database but is not in the mysql port white list in the step 2) can consider the visitor as an illegal connection, but if the visitor is a connection currently approved by the user, an alarm should not be given or backup restoration is not required. Therefore, after the system judges that the connection is illegal, whether the visitor is in the trusted port white list or not can be further judged, if the visitor is not in the trusted port white list, whether the backup and restoration operation is carried out or not is prompted by an alarm, or the backup and restoration operation is directly carried out, otherwise, the alarm prompt or the backup and restoration operation is not carried out. The backup database mentioned in step 2) is backed up in real time. The method avoids the condition that the connection operation allowed by the user is regarded as illegal operation, and improves the flexibility and reliability of monitoring.
The mysql database stores an embodiment of an integrity check protection device.
The mysql database storage integrity check protection device comprises a processor and a memory, wherein the processor is used for executing instructions stored in the memory to realize the mysql database storage integrity check protection method. The specific content of the mysql database storage integrity check protection method is described in the above method embodiment, and will not be described in detail here.
A specific example of tampering with the database using a third party tool is shown in fig. 2, and as shown in fig. 2, the mysql database to be protected is modified using a third party tool, and one of the values is modified and saved. As shown in fig. 3, the storage integrity check protection device checks the tampered data, and performs an alarm and an operation prompt. As shown in the database restore backup diagram of FIG. 4, after selecting the restore database option, the database is restored to the most recent backup.
As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
Finally, it should be noted that: the above embodiments are only for illustrating the technical solutions of the present invention and not for limiting the same, and although the present invention is described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that: modifications and equivalents may be made to the embodiments of the invention without departing from the spirit and scope of the invention, which is to be covered by the claims.
Claims (7)
1. A mysql database storage integrity check protection method is characterized by comprising the following steps:
1) the network connection information of the visitor who is currently connected with the mysql database is checked in real time, whether the visitor is illegal to connect or not is judged according to the network connection information of the visitor, and whether the visitor is illegal to connect or not is judged according to the following method: acquiring a port number of an accessor establishing connection with the mysql database, judging whether the port number is in a mysql port white list established in advance, and if the port number is not in the mysql port white list, judging that illegal connection exists;
if the connection is illegal, alarming and prompting, and if the connection is not disconnected after alarming and prompting, directly adding the port number of the visitor into a trusted port white list or prompting whether to add the port number of the visitor into the trusted port white list; the visitor in the trusted port white list only has the authority of temporarily accessing the mysql database, and when the visitor accesses the mysql database again, the validity of the visitor still needs to be judged;
2) monitoring a binlog log of the mysql database in real time, acquiring latest log updating content, acquiring network connection information of an accessor operating the mysql database according to the latest log updating content, judging whether the accessor is in illegal connection or not according to the network connection information of the accessor, judging whether a port number of the accessor is in a trusted port white list or not if the accessor is in illegal connection, and giving an alarm to prompt or directly replacing the current mysql database with the latest backup of the mysql database if the accessor is not in the trusted port white list.
2. The mysql database storage integrity check protection method according to claim 1, wherein in step 1), after an alarm prompt, disconnection is selected, whether the port number of the visitor is in a trusted port number white list is checked, and if so, the port number is deleted from the trusted port white list.
3. The mysql database storage integrity check protection method according to claim 1, wherein a process white list of an accessor allowed to establish a connection with the mysql database is configured in advance, and if a connection ID of an accessor currently running is located in the process white list, a port number opened by the accessor is acquired, and the mysql port number white list is established.
4. The mysql database storage integrity check protection method according to claim 1, wherein a connection ID of the visitor is obtained, and a mapping set of a port number and the connection ID is queried to obtain the port number of the visitor.
5. A mysql database storage integrity check protection device, characterized in that the device comprises a processor and a memory, wherein the processor is used for executing instructions stored in the memory to realize the mysql database storage integrity check protection method as claimed in any of claims 1-2.
6. The mysql database storage integrity check protection device of claim 5, wherein the processor is further configured to execute the following instructions stored in the memory: and if the connection ID of the currently running visitor is positioned in the process white list, acquiring the opened port number of the currently running visitor, and establishing the mysql port number white list.
7. The mysql database storage integrity check protection device of claim 5, wherein the processor is further configured to execute the following instructions stored in the memory: and acquiring the connection ID of the visitor, and inquiring a mapping set of the port number and the connection ID so as to acquire the port number of the visitor.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910854451.4A CN110647771B (en) | 2019-09-10 | 2019-09-10 | Mysql database storage integrity verification protection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910854451.4A CN110647771B (en) | 2019-09-10 | 2019-09-10 | Mysql database storage integrity verification protection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110647771A CN110647771A (en) | 2020-01-03 |
| CN110647771B true CN110647771B (en) | 2021-11-16 |
Family
ID=69010300
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910854451.4A Active CN110647771B (en) | 2019-09-10 | 2019-09-10 | Mysql database storage integrity verification protection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110647771B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114579967B (en) * | 2022-03-16 | 2022-09-23 | 北京珞安科技有限责任公司 | Rapid construction method of program white list |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103176987A (en) * | 2011-12-21 | 2013-06-26 | 中国电信股份有限公司 | Method and device for controlling database access |
| CN107360178A (en) * | 2017-07-31 | 2017-11-17 | 郑州云海信息技术有限公司 | A kind of method that network access is controlled using white list |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2016000019A1 (en) * | 2014-06-30 | 2016-01-07 | Jagonal Pty Ltd | System and method for rendering buildings in three dimensions |
-
2019
- 2019-09-10 CN CN201910854451.4A patent/CN110647771B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103176987A (en) * | 2011-12-21 | 2013-06-26 | 中国电信股份有限公司 | Method and device for controlling database access |
| CN107360178A (en) * | 2017-07-31 | 2017-11-17 | 郑州云海信息技术有限公司 | A kind of method that network access is controlled using white list |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110647771A (en) | 2020-01-03 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106775716B (en) | Trusted PLC (programmable logic controller) starting method based on measurement mechanism | |
| CN112187792A (en) | Network information safety protection system based on internet | |
| CN110011848B (en) | Mobile operation and maintenance auditing system | |
| CN110063042B (en) | Database fault response method and terminal thereof | |
| CN104951708A (en) | File measurement and protection method and device | |
| CN112231702B (en) | Application protection method, device, equipment and medium | |
| CN109815697B (en) | Method and device for processing false alarm behavior | |
| CN113132318A (en) | Active defense method and system for information safety of power distribution automation system master station | |
| CN110647771B (en) | Mysql database storage integrity verification protection method and device | |
| CN108229162B (en) | Method for realizing integrity check of cloud platform virtual machine | |
| CN109784051B (en) | Information security protection method, device and equipment | |
| CN114969712A (en) | Trusted program dynamic measurement method and device based on LSM framework | |
| CN110443039A (en) | Detection method, device and the electronic equipment of plug-in security | |
| CN112422527B (en) | Threat assessment system, method and device for substation power monitoring system | |
| CN111767300B (en) | Dynamic desensitization method and device for penetration of internal and external networks of electric power data | |
| CN117032831A (en) | Trusted DCS upper computer system, starting method thereof and software starting method thereof | |
| CN109933351A (en) | A kind of method and apparatus of reparation and upgrading linux system | |
| CN112464176B (en) | Authority management method and device, electronic equipment and storage medium | |
| WO2019056545A1 (en) | Test machine automation management method and apparatus, device, and storage medium | |
| CN113987435A (en) | Illegal copyright detection method and device, electronic equipment and storage medium | |
| CN102739690B (en) | Safety data exchange process monitoring method and system | |
| CN115118509B (en) | Method for detecting authority of debugging files of secondary equipment of transformer substation and safety control device | |
| CN114978737B (en) | Comprehensive management system for Doppler weather radar data | |
| CN117093404B (en) | Method, system and equipment for automatically recovering untrusted process in trusted dynamic measurement process | |
| CN116909838B (en) | Abnormal log reporting method, system, terminal equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |