Hierarchical security technology for refining analytic database management system

The security of database system depends on the database management system to a great extent. If the security mechanism of database management system is very strong, the security of database system can be better. The current market is the relational database management system, its security function is very weak, which leads to the security of the database system has a certain threat.

Because the database system is managed in file form under the operating system, intruders can steal the database files directly using the operating system, or use the OS tools to illegally forge and tamper with the contents of the database files. This vulnerability to general database users is difficult to detect, analysis and blockage of such vulnerabilities are considered to be B2 level security technical measures.

The level security technology of database management system is mainly used to solve this problem, that is, the security of database data can be ensured when the previous two levels have been breached, which requires the database management system to have a strong security mechanism. One of the effective ways to solve this problem is to encrypt the database file by database management system, which makes it difficult for people to decipher and read the data even if it is unfortunately leaked or lost.

We can consider the implementation of encryption of database data at three different levels, which are the OS layer, the DBMS kernel layer, and the DBMS outer layer respectively.

⑴ is encrypted at the OS layer. The data relationship in the database file cannot be identified in the OS layer, so it is not possible to produce a reasonable key and it is difficult to manage and use the key properly. Therefore, for large databases, it is difficult to encrypt database files at the OS level.

⑵ implements encryption at the DBMS kernel layer. This type of encryption means that the data is added/off before physical access is performed. The advantage of this encryption is that the encryption function is strong, and the encryption function will not affect the function of the DBMS, you can achieve the encryption function and the database management system seamless coupling. The disadvantage is that the cryptographic operations are performed on the server side, aggravating the load on the server, and the interface between the DBMS and the cryptographic device requires the support of the DBMS developer.

Defining the encryption Requirements tool

Dbms

Database application System

Encryption device

(software or hardware)

⑶ encryption is implemented on the outer layer of the DBMS. A more practical approach is to make the database encryption system as an outer tool of the DBMS, and automatically complete the addition/removal of database data according to the encryption requirements:

Define Cryptographic requirements Tool cipher

(software or hardware)

Dbms

Database application System

Using this encryption method for encryption, plus/off operation can be performed on the client, its advantage is not to aggravate the load of the database server and can achieve the encryption of the network transmission, the disadvantage is that the encryption function will be limited, and the database management system is slightly less coupling.

The following is a further explanation of the rationale behind the implementation of the encryption function on the DBMS layer:

The database encryption system is divided into two functional and independent main components: one is the cryptographic Dictionary management program, the other is the database Plus/remove engine. The database encryption system saves the user to the database information specific encryption request and the basic information in the encryption dictionary, through calls the data Plus/off the secret engine to realize to the database table encryption, the signcryption and the data conversion and so on function. The addition/removal of database information is done in the background and is transparent to the database server.

Cryptographic Dictionary Management Program

Encryption system

Application

Database plus off-key engine

Database server

Encrypted dictionary

User Data

The database encryption system implemented in the above way has many advantages: first of all, the system is completely transparent to the end-user of the database, the administrator can carry out the conversion of plaintext and ciphertext according to the need; Secondly, the encryption system is completely independent of the database application system, and the data encryption function can be realized without changing the database application system. Third, The encryption and decryption process is done on the client and does not affect the efficiency of the database server.

Database Plus/off engine is the core of the database encryption system, which is located between the application and the database server, and is responsible for the process of adding/removing the database information in the background, which is transparent to the application developers and operators. The data Plus/remove engine does not have an operating interface, which is automatically loaded and resides in memory when needed, and communicates with the cryptographic Dictionary manager and the user application through the internal interface. The database Plus/Remove engine consists of three modules: a plus/remove processing module, a user interface module, and a database interface module, as shown in Figure 4. The main task of the Database interface module is to accept the user's request for action. It is also passed to the "Plus/Remove processing module", in addition to the "Plus/Remove processing module" To access the database server, and the external interface parameters and the internal data structure of the plus/off engine conversion. The "Add/Remove Processing module" completes the initialization of the database Plus/remove engine, the processing of internal special commands, the retrieval of encrypted dictionary information, the Management of encrypted dictionary buffer, the encryption and transformation of SQL commands, the removal of query results and the implementation of encryption algorithm, and some common auxiliary functions are also included.

The main processes for data plus/off processing are as follows:

1. Syntax analysis of SQL commands, if the syntax is correct, go to the next step, if not correct, then turn to 6, directly to the database server processing SQL command.

2. is the internal control command for the database Plus/remove engine? If so, the internal control command is processed and then 7 is transferred; if not, go to the next step.

3. Check that the database Plus/Remove engine is off or if SQL commands only need to compile? If yes, turn to 6), otherwise go to the next step.

4. Retrieve the encryption dictionary, according to the encryption definition of the SQL command to add off the semantic analysis.

Does the 5.SQL command require encryption processing? If so, encrypt the SQL command, replace the original SQL command, and then go to the next step.

6. Transfer SQL commands to the database server for processing.

The 7.SQL command completes and clears the SQL command buffer.