CN117828568B

CN117828568B - Database auditing method, system, equipment and readable storage medium based on fine granularity access control

Info

Publication number: CN117828568B
Application number: CN202410010025.3A
Authority: CN
Inventors: 王伟斌; 陈传凯; 杨小华
Original assignee: Beijing Xinshu Technology Co ltd
Current assignee: Beijing Xinshu Technology Co ltd
Priority date: 2024-01-03
Filing date: 2024-01-03
Publication date: 2024-08-06
Anticipated expiration: 2044-01-03
Also published as: CN117828568A

Abstract

The database auditing method, the system, the device and the readable storage medium based on fine granularity access control realize the encryption and decryption of data in the database by utilizing the time factor and attribute-based encryption technology, and can perform fine granularity audit and monitoring on the operation in the database. The invention realizes the management of the user access rights based on the fine-grained access control algorithm, the database manager sets the access policy, the time of each user accessing the database is regulated, and the user access rights exceeding the limited time are revoked. The system effectively improves the safety and flexibility of the database in a dynamic environment, and shows remarkable advantages in coping with security threats such as misoperation, data leakage and the like.

Description

Database auditing method, system, equipment and readable storage medium based on fine granularity access control

Technical Field

The invention relates to a database auditing method, system, equipment and readable storage medium based on fine granularity access control, belonging to the field of database security.

Background

In recent years, with rapid development of information technology, databases are increasingly used in various fields. The large amount of data stored in the database not only contains important information and resources, but also presents a potential security risk and threat of privacy disclosure. Therefore, how to protect the security and privacy of data in databases, and how to effectively monitor and audit database operations, has become a challenge.

Traditional database audit systems audit and monitor mainly by recording operation logs. Although the database auditing system strengthens the protection of data privacy, the system adopts encryption, anonymization and other technologies to ensure the safety of sensitive data in the processes of acquisition, storage and processing, the method has limitations in fine granularity audit and monitoring. In particular, conventional auditing systems only implement privacy protection for sensitive data, and lack a more secure and efficient solution in terms of control of user access rights. Therefore, in order to realize fine-grained control of the access rights of the user to the database, the functions of user authentication and access rights revocation need to be further added into the database audit system, so that potential security threats and abnormal behaviors cannot be effectively detected and prevented.

Drawings

Fig. 1 is a system flow diagram.

Disclosure of Invention

In order to solve the problems, the invention provides a database auditing method based on fine-grained access control, which comprises the following specific steps:

(1) Storing data and performing other database operations;

(2) Monitoring database operation in real time and generating an audit log;

(3) Realizing access control of user authority by using an encryption algorithm based on a time factor;

(4) The trigger continuously monitors the operation of a user, continuously generates audit records, and periodically cleans up expired data and updates a secret key;

(5) User access time and attribute control is implemented at the application layer.

Further, in the step (3), the encryption algorithm based on the time factor specifically includes the following steps:

3.1 system initialization: the security parameter λ is input, and y=e (g, g) ^α is calculated, where g and α e Z _q represent generator and random numbers, respectively, and e represents a bilinear map. The algorithm outputs a master public key mpk= (H ₁,H₂,g,Y,{K_i }), a master private key msk= (α, { k _i }), where H ₁,H₂ is a Hash function, k _i (i e 1, n) represents a random value corresponding to each attribute a _i in the system,

3.2 Generating a key: the system inputs the user identity mark u _id, the attribute value A _i, the time for the user to acquire the attribute A _i is T _i,1, and the random value T _r are selectedCalculation of SK _4,i,2＝H₁(u_id||T_r||T_i,1), the user private key is (SK ₁,{SK_2,i},{SK_3,i},{SK_4,i,1,SK_4,i,2).

3.3 Encryption: the access policy is set by the database administrator, the system selects the random value t _i,s_i∈Z_q, The time limit node with attribute A _i is set before T _i,2 OtherwiseSetting Tag mark bits, respectively uploading SK _4,i,2 and Tag to a time verification server by a database visitor and a database administrator, and calculating C _3,i＝H₁(SK_4,i,2,u_id I Tag by the time verification server to send to the database administrator, wherein Tag E {0,1} is represented in the front-back direction, tag is in the back direction when the value of Tag is 0, otherwise, tag is in the front direction; encryption of message m, computing c=my ^s,C_m＝H₂ (c||m); output ciphertext ct= (C, C _m,{C_1,i},{C_2,i},{C_3,i });

3.4 authentication attribute time: the time validation server computes ht' _i＝H₁(u_id′||A′_i||T_r), SK' _4,i,2＝H₁(u_id′||T_r||T′_i,1); if SK _4,i,2≠SK′_4,i,2, the time verification server terminates attribute time authentication and returns an empty character; the time verification server compares T _i,2＜T′_i,1 according to the Tag, and if the Tag is marked as forward, T _i,2≥T′_i,1; otherwise, T _i,2＜T′_i,1, the user attribute meets the access policy requirement, and the time verification server calculatesOtherwise, the user attribute time does not meet the access policy requirement, and the time verification server terminates attribute time authentication and returns an empty character. When all the attributes in the user attribute set meet the access policy attribute time requirement, the time validation server returns the user { TV _i }.

3.5 Decryption: the successful time authentication of the attribute set of the database visitor returns { TV _i }, inputs plaintext CT and private key SK _i from the time verification server, calculatesIf it isThe plaintext m is output, otherwise the null character is returned.

3.6 User attribute revocation: when user u _id needs to revoke attribute a _i, reselecting T _r 'for the user by the time verification server, updating user time parameter T _r to T _r'; after receiving the message returned by the time verification server, the user updates the local key.

3.7 Revoke user: when the system needs to revoke the user u _id, the attribute authorization terminal sends a user revocation instruction to the time verification server, and the time verification server deletes the local user time parameter T _r.

The invention also provides a database auditing system based on fine-grained access control, which comprises a database management module, an auditing module and an encryption module, wherein the database management module is responsible for data storage and other database operations, the auditing module monitors the database operations in real time and generates an audit log, and the encryption module realizes access control of user permission based on a time factor.

(1) The database management module stores data and performs other database operations;

(2) And an auditing module: monitoring database operation in real time and generating an audit log;

(3) An encryption module: realizing access control of user authority by using an encryption algorithm based on a time factor;

(4) Audit management module: generating an audit record, and cleaning out-of-date data and an update key;

(5) And an application management module: an application program layer is realized, and the authority of an administrator is provided.

Further, in the encryption module, the encryption algorithm based on the time factor comprises the following specific steps:

The present invention also provides an apparatus comprising: the device comprises a data acquisition device, a processor and a memory; the data acquisition device is used for acquiring data; the memory is used for storing one or more program instructions; the processor is configured to execute one or more program instructions to perform any of the methods described above.

The present invention further provides a computer readable storage medium having one or more program instructions embodied therein for performing any of the methods described above.

In order to reduce the complexity of the key generation algorithm, other symmetric encryption algorithms are not used in the private key calculation process, the number of the private keys is reduced as much as possible while the time factor authentication is met, and the efficiency reduction caused by excessive calculation overhead in the private key generation process is prevented.

The invention utilizes the time factor and attribute-based encryption technology to encrypt and decrypt the data in the database, and can audit and monitor the operation in the database in a fine granularity. The invention realizes the management of the user access rights based on the fine-grained access control algorithm, the database manager sets the access policy, the time of each user accessing the database is regulated, and the user access rights exceeding the limited time are revoked. The system effectively improves the safety and flexibility of the database in a dynamic environment, and shows remarkable advantages in coping with security threats such as misoperation, data leakage and the like.

Detailed Description

In order to solve the problems, the invention provides a database auditing method based on access control, which utilizes a time factor and attribute-based encryption technology to realize encryption and decryption of data in a database, and can audit and monitor the operation in the database in a fine granularity.

The invention designs an encryption algorithm based on access control, which can realize cryptograph processing and time-based access control on database data. The attribute authorization terminal is responsible for system initialization and key distribution, and receives a user revocation request or issues an attribute revocation instruction; the database manager is responsible for setting access strategies for data, encrypting the data according to the access strategies, storing ciphertext in the database, and strictly controlling access time of a user; and the database visitor acquires the user key from the authorized terminal, uploads the key time parameter to the time verification server for verification after downloading the ciphertext, and the ciphertext can be decrypted when the user attribute and the time meet the access policy. The encryption algorithm flow is shown in fig. 1, and the specific steps are as follows:

(1) System initialization

Order theFor the attribute space of the system, lambda is a safety parameter, the order of the cyclic multiplication groups G and G _T is prime q, a primitive G is generated, a bilinear map e is G×G- & gtG _T, a random value alpha epsilon Z _q is given, Y=e (G, G) ^α, each attribute A _i in the system corresponds to a random value k _i∈Z_q (i epsilon [1, n ]), and calculation is performedH₁:H ₂:{0,1}^*→{0,1}^λ, wherein l _T is the time factor length. The system master public key and master private key are mpk= (H ₁,H₂,g,Y,{K_i}),MSK＝(α,{k_i }) respectively.

(2) Generating a key

Each user in the system has unique identity mark u _id, and the random value T _r is saved by the attribute authorization terminal and the time verification server and is selectedCalculation ofThe authority selects a random value a _i∈Z_q for each user attribute A _i, calculatesAssuming that the time for the user to acquire attribute A _i is T _i,1, calculate SK _4,i,2＝H₁(u_id||T_r||T_i,1), the user private key is (SK ₁,{SK_2,i},{SK_3,i},{SK_4,i,1,SK_4,i,2).

(3) Encryption

Setting access policy by database manager, selecting random value s _i∈Z_q for each A _i in attribute space, calculatingSelecting the random value T _i, let the user possess the time limit node of attribute A _i before T _i,2 Otherwise

The data visitor and the database manager upload SK _4,i,2 and the Tag to the time verification server respectively, and the time verification server calculates C _3,i＝H₁(SK_4,i,2,u_id I Tag) to be sent to the database manager, wherein the Tag E {0,1} is represented in the front-back direction, the Tag is marked as the backward direction when the value of the Tag is 0, and otherwise, the Tag is marked as the forward direction.

The encryption of the message m is performed, c=my ^s,C_m＝H₂ (c||m) is calculated by the database administrator. Output ciphertext ct= (C, C _m,{C_1,i},{C_2,i},{C_3,i }) the database manager sends the ciphertext to the data visitor.

(4) Authentication attribute time

The time validation server computes ht' _i＝H₁(u_id′||A′_i||T_r),SK' _4,i,2＝H₁(u_id′||T_r||T′_i,1). If SK _4,i,2≠SK′_4,i,2, the time verification server terminates the attribute time authentication and returns a null character.

The time verification server compares T _i,2＜T′_i,1 according to the Tag, and if the Tag is marked as forward, T _i,2≥T′_i,1; otherwise, T _i,2＜T′_i,1, the user attribute meets the access policy requirement, and the time verification server calculatesOtherwise, the user attribute time does not meet the access policy requirement, and the time verification server terminates attribute time authentication and returns an empty character. When all the attributes in the user attribute set meet the access policy attribute time requirement, the time validation server returns the user { TV _i }.

(5) Decryption

Successful time authentication of the data visitor property set will be returned from the time verification server { TV _i }, data visitor calculation If H ₂(c||m₃)＝C_m, outputting the plaintext m, otherwise, returning the empty character.

(6) Revoking user attributes

When user u _id needs to revoke attribute a _i, the attribute authorization terminal sends an attribute revocation instruction to the time verification server, which pauses the attribute time authentication for user u _id, and the data visitor uploads { SK _4,j,1,SK_4,j,2|A_j∈U_id }, j e [1, n ] in its own private key. The time validation server reselects T _r 'for the user, calculates ht' _j＝H₁(u_id||A_j||T_r), SK′_4,j,2＝H₁(u_id||T_r′||T_j,1)。

The time verification server returns { SK '_4,j,1,SK′_4,j,2 } to the data visitor, updating the user time parameter T _r to T _r'. After receiving the message returned by the time verification server, the user updates { SK _4,j,1,SK_4,j,2 } in the local key and deletes (SK _2,i,SK_3,i,SK_4,i,1,SK_4,i,2).

(7) Revoking a user

When the system needs to cancel the user u _id, the attribute authorization terminal sends a user cancel instruction to the time verification server, and the time verification server deletes the local user time parameter T _r.

Specifically, suppose that user Alice wishes to ensure the security, integrity, and availability of a database through fine-grained access control. Alice wishes to design an audit system to ensure that only authorized personnel can access a particular database record, reducing the risk of data leakage and unauthorized access. The specific operation is as follows:

1. Database table design

First, the database tables are extended to accommodate new encryption and audit requirements. A time stamp field is added to the user data table for recording the write time of each piece of data. In addition, to support attribute-based encryption, a storage field for an encryption key needs to be added to the table.

2. Encryption

The attribute encryption algorithm is realized by combining the time factors, so that the data can be revoked after the appointed time, specifically, the attribute authorization terminal completes the system initialization and the distribution of the user key, distributes the private key (SK ₁,{SK_2,i},{SK_3,i},{SK_4,i,1,SK_4,i,2) to the user requester, and the design of the attribute-based encryption algorithm is as follows:

Setting access policy by database manager, computing Selecting a random value T _i, calculating assuming that the time-limited node of the user Alice owns the attribute A _i is before T _i,2

The data visitor and the database manager upload SK _4,i,2 and Tag, respectively, to a time verification server, which calculates C _3,i＝H₁(SK_4,i,2,u_id i Tag) and sends it to the database manager.

The table information m in the database is encrypted, c=my ^s,C_m＝H₂ (c||m) is calculated by the database administrator. Output ciphertext ct= (C, C _m,{C_1,i},{C_2,i},{C_3,i }) the database manager sends the ciphertext to user Alice.

After encryption is completed, performing attribute time authentication by a time authentication server, and after the fact that SK _4,i,2＝SK′_4,i,2 is established is confirmed, comparing T _i,2 with T' _i,1 by the time authentication server according to the Tag, and if the Tag is forward, determining T _i,2≥T'_i,1; otherwise, T _i,2＜T'_i,1. When the user attribute meets the access policy requirement, the time verification server calculatesAnd returns { TV _i } to Alice. Otherwise, the time verification server terminates the attribute time authentication and returns the null character.

When Alice's attribute a _i is revoked, the attribute authorization terminal sends an attribute revocation instruction to the time verification server, which suspends attribute time authentication. Reselecting T _r' for Alice by the time verification server, returning to Alice private keyTo update the local key and update Alice time parameter T _r to T _r'.

And for the revocation of the identity of the Alice user, the time verification server deletes the time parameter T _r of Alice after receiving the revocation instruction sent by the attribute authorization terminal.

3. Auditing

And inserting an audit list into the database for recording an audit log of the user operation. The design of the audit table should take into account record key information such as user name, type of operation, time of operation, etc.

4. Generating audit records

And monitoring the operation of the user on the data by using a database trigger, and triggering the generation of the audit record. Meanwhile, a periodic task or a timing script is set, expired data is cleaned, an encryption key is updated, and timeliness and safety of the database are ensured.

5. Implementing an application layer

In the application, it is ensured that the user checks the time stamp and encryption key when writing the data, and that the audit record is generated. Limit writing to expired data and provide administrator rights to adjust access time and encryption attributes of the data.

Through the steps, the database auditing system based on fine granularity access control can be implemented, and the safety, timeliness and audit traceability of the database are improved in practical application.

The invention realizes the management of the user access rights based on the fine-grained access control algorithm, the database manager sets the access policy, the time of each user accessing the database is regulated, and the user access rights exceeding the limited time are revoked. The system effectively improves the safety and flexibility of the database in a dynamic environment, and has obvious advantages in coping with security threats such as misoperation, data leakage and the like.

The units, devices or modules etc. set forth in the above embodiments may be implemented in particular by a computer chip or entity or by a product having a certain function. For convenience of description, the above devices are described as being functionally divided into various modules, respectively. Of course, when implementing the present application, the functions of each module may be implemented in the same or multiple pieces of software and/or hardware, or a module implementing the same function may be implemented by multiple sub-modules or a combination of sub-units. The above-described apparatus embodiments are merely illustrative, for example, the division of the units is merely a logical function division, and there may be additional divisions when actually implemented, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.

Those skilled in the art will also appreciate that, in addition to implementing the controller in a pure computer readable program code, it is well possible to implement the same functionality by logically programming the method steps such that the controller is in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers, etc. Such a controller can be regarded as a hardware component, and means for implementing various functions included therein can also be regarded as a structure within the hardware component. Or even means for achieving the various functions may be regarded as either software modules implementing the methods or structures within hardware components.

The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, classes, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

From the above description of embodiments, it will be apparent to those skilled in the art that the present application may be implemented in software plus a necessary general hardware platform. Based on such understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art in the form of a software product, which may be stored in a storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, etc., including several instructions for causing a computer device (which may be a personal computer, a mobile terminal, a server, or a network device, etc.) to execute the method according to the embodiments or some parts of the embodiments of the present application.

Various embodiments in this specification are described in a progressive manner, and identical or similar parts are all provided for each embodiment, each embodiment focusing on differences from other embodiments. The application is operational with numerous general purpose or special purpose computer system environments or configurations. For example: personal computers, server computers, hand-held or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.

The foregoing description of the embodiments has been provided for the purpose of illustrating the general principles of the application, and is not meant to limit the scope of the application, but to limit the application to the particular embodiments, and any modifications, equivalents, improvements, etc. that fall within the spirit and principles of the application are intended to be included within the scope of the application.

Claims

1. A database auditing method based on fine granularity access control is characterized in that: the method comprises the following specific steps:

(1) Storing data and performing other database operations;

(2) Monitoring database operation in real time and generating an audit log;

(5) Realizing access time and attribute control of a user at an application program layer;

In the step (3), the encryption algorithm based on the time factor comprises the following specific steps:

3.1 system initialization: inputting a security parameter lambda, and calculating Y=e (g, g) ^α, wherein g and alpha epsilon Z _q respectively represent a generator and a random number, and e represents bilinear mapping; the algorithm outputs a master public key mpk= (H ₁,H₂,g,Y,{K_i }), a master private key msk= (α, { k _i }), where H ₁,H₂ is a Hash function, k _i (i e 1, n) represents a random value corresponding to each attribute a _i in the system,

3.2 Generating a key: the system inputs the user identity mark u _id, the attribute value A _i, the time for the user to acquire the attribute A _i is T _i,1, and the random value T _r are selectedCalculation of SK _4,i,2＝H₁(u_id||T_r||T_i,1), then the user private key is (SK ₁,{SK_2,i},{SK_3,i},{SK_4,i,1,SK_4,i,2);

3.4 authentication attribute time: the time validation server computes ht' _i＝H₁(u_id′||A′_i||T_r), SK' _4,i,2＝H₁(u_id′||T_r||T′_i,1); if SK _4,i,2≠SK′_4,i,2, the time verification server terminates attribute time authentication and returns an empty character; the time verification server compares T _i,2<T′_i,1 according to the Tag, and if the Tag is marked as forward, T _i,2≥T′_i,1; otherwise, T _i,2<T′_i,1, the user attribute meets the access policy requirement, and the time verification server calculatesOtherwise, the user attribute time does not meet the access policy requirement, the time verification server terminates attribute time authentication and returns an empty character; when all the attributes in the user attribute set meet the access policy attribute time requirement, the time verification server returns the user { TV _i };

3.5 decryption: the successful time authentication of the attribute set of the database visitor returns { TV _i }, inputs plaintext CT and private key SK _i from the time verification server, calculates If it isOutputting a plaintext m, otherwise, returning an empty character;

3.6 user attribute revocation: when user u _id needs to revoke attribute a _i, reselecting T _r 'for the user by the time verification server, updating user time parameter T _r to T _r'; after receiving the message returned by the time verification server, the user updates the local key;

2. The utility model provides a database audit system based on fine granularity access control, this system includes database management module, audit module and encryption module, and wherein, database management module is responsible for data storage and other database operations, and audit module real-time supervision database operation generates audit log, and encryption module realizes user's authority's access control based on the time factor, its characterized in that:

(5) And an application management module: an application program layer is realized, and an administrator authority is provided;

In the encryption module, the encryption algorithm based on the time factor comprises the following specific steps:

3. A database auditing apparatus based on fine-grained access control, the apparatus comprising: the device comprises a data acquisition device, a processor and a memory; the data acquisition device is used for acquiring data; the memory is used for storing one or more program instructions; the processor is configured to execute one or more program instructions for performing the method of claim 1.

4. A fine grain access control based database auditing computer readable storage medium containing one or more program instructions for performing the method of claim 1.