KR100913190B1 - Method for database preservation web-based 3 tier environment and apparatus thereof - Google Patents

Abstract

Disclosed are a method and a device for database security in a web-based three-tier environment. After extracting SQL statements from a web source in a database security server that performs a database security service in a web-based three-tier environment, the SQL for each web page is extracted. The user who stores the character list and performs the HTTP connection for accessing the database server via the web server in the web access information collection module when the HTTP connection for accessing the database server via the web server of the user computer or the internal user computer is performed. Data from the user computer or internal user computer that accesses the database server via the web server from the database security gateway installed between the web server and the database server after extracting the connection data of the computer or internal user computer. It extracts the base server connection data and performs data matching between the web server connection data extracted from the web access information collection module and the database server connection data extracted from the database security gateway from the database security server to the database server of the user computer or the internal user computer. Perform access control.

Web-Based, 3-Tier, Database, Security, Audit, Control

Description

Method for database preservation web-based 3 tier environment and apparatus according to web-based 3-tier environment

The present invention relates to a database security method and apparatus thereof.

More specifically, by collecting and managing access information for each tier in a three-tier environment using a web server, a web application server (WAS), and the like, a database in an environment using a web-based service A method and apparatus for securing a database in a web-based three-tier environment that can perform security.

In general, in almost all organizations including public institutions and corporations, databases are recognized as valuable assets for value creation, and their importance is emphasized at the center of information technology (IT).

Accordingly, many concepts for managing data and various solutions for accommodating data have been actively developed, and in particular, the importance of database security products to prevent data leakage or damage or modification due to malicious purposes is important. It's getting bigger.

With the rapid increase in the value of personal information due to the development of the Internet, in the case of personal information leakage accidents through web services, which have occurred frequently in recent years, direct damages such as the loss of corporate image and the demand for compensation for information leakage, etc. Social and economic losses have been caused by additional damages caused by unauthorized use of information, and in order to prepare for such a surge of personal information leakage, relevant laws are being enacted in each country.

Due to the legislation of governments for the protection of personal information, public institutions and corporations recognize that database security products should be applied as essential products, and the market for database security products is expanding in the future.

Database security products currently on the market to provide database security can be divided into two categories: products that encrypt data and store it in the database, and products that control the users who access the database and audit the access history. .

Among them, security products whose main functions are access control and auditing, provide access and auditing functions for end users accessing the database.

That is, in the case of the two-tier system in which the user PC 1 directly attempts to access the database server 3 as shown in FIG. 1, the database security server 2 accesses the database server 3. It is possible to audit the access control and access of the user PC (1).

However, in the case of the three-tier method of accessing the database server 40 via the web server or the web application server 20 from the user PC 10 as shown in Figure 2, the database security server 30 in the Since the information of the web server or the web application server 20 appears as user information, there is a problem that cannot provide the control and audit function for the actual user PC 10 accessing the database server 40.

In other words, access to the database server via the current web server or web application server cannot obtain end user information. Therefore, the authenticated user in the web server or web application server can access the database server without any restrictions. In particular, in the case of a web server or a web application server, since the execution source itself is open, an accident in which the contents of the database may be hacked by a malicious user or leaked by an internal user may occur. In this case, even if a database security product is installed, there is no way to identify the user who has leaked the contents of the database.

As the IT environment changes to a three-tier environment, database security products for existing two-tier environments face technical limitations that cannot support database security in these IT environments. The demand for enhanced security of customers is on the rise.

An object of the present invention to solve the above problems, access information for a web server, a web application server located in the middle to provide a database security function in a three-tier environment using a web server, a web application server, etc. The present invention provides a method and apparatus for securing a database in a web-based three-tier environment that can provide database security in a three-tier environment by linking the database and database security.

It is another object of the present invention to integrate and store a web server providing a service, access information for a web application server and database access information generated from a web server and a web application server, and to manage a database and a web server / web application server. Database security in a web-based three-tier environment that collects associated access control and audit data, controls database access from unauthorized web pages or modules, and provides reporting capabilities for access in three-tier environments. A method and apparatus are provided.

Database security method of a web-based three-tier environment according to the present invention for achieving this purpose, (1-1) SQL statements in a web source in a database security server that performs a database security service of a web-based three-tier environment Extracting and storing a list of SQL characters for each web page, and (1-2) for accessing a database server via a web server of a user computer or an internal user computer in a web access information collection module installed in a web server. Checking whether the HTTP connection is established, and (1-3) extracting the web server access data of the user computer or the internal user computer that performs the HTTP connection for accessing the database server via the web server in the web access information collection module. Transmitting the extracted web server access data to a database security server, and (1-4) the web server and the database server. Extracting database server connection data of user computer or internal user computer accessing the database server through the web server at the database security gateway installed in between, and (1-5) step (1-3) at the database security server. Data matching between the web server access data extracted from the web access information collection module and the database server access data extracted from the database security gateway through steps (1-4), and based on the data matching result, Performing access control to the database server, and (1-6) web server access data and database server access data extracted in steps (1-3) and (1-4) from the database security server, (1 -5) Access control to database server via web server executed in step 5) Persistently storing, managing, and characterized in that it comprises the step of generating a report.

In addition, the database security method of the web-based three-tier environment according to the present invention, (2-1) extracts SQL statements from a web source in a database security server that performs a database security service of a web-based three-tier environment, (2-2) Web access information collection module installed in web server to access database server via web server / web application server of user computer or internal user computer. A step of checking whether an HTTP connection is made, and (2-3) a web server of a user computer or an internal user computer that performs an HTTP connection for accessing a database server via a web server / web application server in a web access information collection module. Extracting the access data and transmitting the extracted web server access data to the database security server; (2-4) Extracting query information of a user computer or an internal user computer for accessing a database server from a query sniffing module installed in an application server, and transmitting the extracted query information to a database security server; (2-5) a web server / web application; Extracting database server connection data of a user computer or an internal user computer accessing the database server through a web server / web application server at a database security gateway installed between the server and the database server, and (2-6) a database security server. In (2-3), the web server access data extracted from the web access information collection module, the query information extracted from the query sniffing module through (2-4), and the database security gateway extracted through (2-5). Data Matching of Database Server Connection Data And controlling access to the database server of the user computer or the internal user computer based on the result of data matching, (2-7) steps (2-3) and (2-4) at the database security server. Continuously store and manage the web server access data and query information extracted in the step, and the access control result to the database server via the web server / web application server performed in step (2-6) and generate a report It is another feature that comprises the step of.

In addition, the database security method of the web-based three-tier environment according to the present invention, (3-1) extracts SQL statements in the web source from a database security server that performs a database security service of the web-based three-tier environment, Storing the SQL character list for each page, and (3-2) accessing the database server via the web server of the user computer or the internal user computer in the web access information collection module provided in the web access monitoring gateway installed at the front of the web server. (3-3) a user computer or an internal user performing an HTTP connection for accessing a database server via a web server in the web access information collection module provided in the web access monitoring gateway; Extract web server access data of computer and transfer extracted web server access data to database security server And the step of; (3-4) extracting the database server connection data of the user computer or the internal user computer accessing the database server via the web server at the database security gateway installed between the web server and the database server, and (3-5) the database. Data matching of web server access data extracted from web access information collection module provided in web access monitoring gateway through step (3-3) and database server access data extracted from database security gateway through step (3-4) Performing access control to the database server of the user computer or the internal user computer based on the result of data matching, and (3-6) steps (3-3) and (3-4) at the database security server. Web server connection data and database server connection data extracted in step (3-5) Another feature is the step of continuously storing, managing, and generating a report of access control results to a database server via a web server running in the system.

In addition, the database security method of the web-based three-tier environment according to the present invention, (4-1) extracts SQL statements in a web source from a database security server that performs a database security service of a web-based three-tier environment, Storing the SQL character list for each page, and (4-2) accessing the database server via the web server of the user computer or the internal user computer in the web access information collection module provided in the web access monitoring gateway installed at the front of the web server. (4-3) the web of the user computer or the internal user computer that performs the HTTP connection for accessing the database server via the web server / web application server in the web access information collection module (4-3). Extracting the server access data and transmitting the extracted web server access data to the database security server; Extracting the query information of the user computer or the internal user computer for accessing the database server from the query sniffing module installed in the web application server, and transmitting the extracted query information to the database security server (4-5) Extracting database server connection data of a user computer or an internal user computer accessing the database server via the web server / web application server at a database security gateway installed between the server / web application server and the database server, (4-6 ) Web server access data extracted from web access information collection module through step (4-3) of database security server, query information extracted from query sniffing module through step (4-4), database through (4-5) step Of database server connection data extracted from security gateway. Performing data matching, and controlling access of the user computer or the internal user computer to the database server based on the data matching result, and (4-7) steps (4-3) and (4- in the database security server. Continuously store and manage web server access data and query information extracted in step 4) and access control results to database server via web server / web application server performed in step (4-6). It is another feature to include the step of generating.

In addition, the database security method of the web-based three-tier environment according to the present invention, (5-1) to extract the SQL statements in the web source from the database security server that performs the database security service of the web-based three-tier environment, Storing a list of SQL characters for each page, and (5-2) connecting a tap device to a network switch that performs switching of a user computer or an internal user computer that requests HTTP access to a web server. Checking whether an HTTP connection for accessing a database server via a web server of a computer or an internal user computer is performed; and (5-3) a database via a web server in the web access information collection module provided in the packet sniffing device. Web server access data of user computer or internal user computer that performs HTTP connection for server access. Extracting and transmitting the extracted web server access data to the database security server, and (5-4) a user computer or internal user accessing the database server via the web server at the database security gateway installed between the web server and the database server. Extracting the database server connection data of the user computer; and (5-5) the web server connection data extracted from the web access information collection module provided in the packet sniffing device through the step (5-3) of the database security server; Performing data matching of the database server connection data extracted from the database security gateway through step -4), and controlling access to the database server of the user computer or the internal user computer based on the data matching result; and (5- 6) Steps (5-3) and (5-4) at the database security server. Web server access data and database server access data extracted from, and continuously storing and managing the results of access control to the database server via the web server performed in step (5-5), and generating a report It is another feature to do.

In addition, the database security method of the web-based three-tier environment according to the present invention, (6-1) extracts SQL statements in a web source from a database security server that performs a database security service of a web-based three-tier environment, Storing a list of SQL characters per page, and (6-2) connecting to a network switch that performs switching of a user computer or an internal user computer requesting an HTTP connection to a web server. Checking whether an HTTP connection for accessing a database server via a web server / web application server of a computer or an internal user computer is performed; and (6-3) a web server / web in a web access information collection module in a packet sniffing device. User computer or HTTP server making HTTP connection for connecting to database server through application server Extracting the web server access data of the user computer, and transmitting the extracted web server access data to the database security server, and (6-4) user computer or internal access to the database server in the query sniffing module installed in the web application server Extracting the query information of the user computer and transmitting the extracted query information to the database security server, and (6-5) the web server / web application server at the database security gateway installed between the web server / web application server and the database server. Extracting the database server connection data of the user computer or internal user computer accessing the database server via (6-6) and the web extracted from the web access information collection module in step (6-3) of the database security server. Server sniffing, query sniffing through steps (6-4) Through the query information extracted from the module, and (6-5), data matching of the database server connection data extracted from the database security gateway is performed, and access control of the user computer or the internal user computer to the database server is performed based on the data matching result. And (6-7) web server access data and query information extracted in steps (6-3) and (6-4) of the database security server, and the web server performed in step (6-6) Another feature includes the continuous storage and management of access control results to the database server via the web application server and the generation of reports.

In addition, the database security device of the web-based three-tier environment according to the present invention, when the HTTP connection for accessing the database server via a web server from a user computer or an internal user computer connected through a network communication network, the user com A web server provided with a web access information collecting module for extracting web server access data including access time, access IP address, calling web page, query execution process ID, and query of a computer or an internal user computer; Installed between web server and database, database access data including access time, access server IP address, user ID, application name, query execution process ID, and query of user computer or internal user computer accessing database through web server. A database security gateway for extracting; It stores various digital contents, provides a database server which provides predetermined data requested from a user computer or an internal user computer connected via a web server, and extracts SQL statements from a web source, and lists SQL characters for each web page. The access time received from the web access information collection module in the web server, the access IP address, the calling web page, the query execution process ID, the web server access data including the query, the access time received from the database security gateway, and the access server. Stores and manages database server connection data including IP address, user ID, application name, query execution process ID, and query, and checks for consistency using query execution process ID and query among web server connection data and database server connection data. Perform data matching, and Based on the matching result, it controls the access control from the database security gateway to the database server of the user computer or the internal user computer, and the web server access data extracted from the web access information collection module and the database server access data extracted from the database security gateway It characterized in that it comprises a database security server for generating a report based on the access control results to the database server via the server.

In addition, the database security device of the web-based three-tier environment according to the present invention, HTTP for accessing a database server via a web server / web application server from a user computer or an internal user computer installed in a web server and connected through a network communication network When the connection is established, the web access information collection module extracts web server access data including access time, access IP address, calling web page, and query of the user computer or internal user computer, and is installed in the web application server to access the database server. A web server / web application server equipped with a query sniffing module for extracting query information including a connection time and a query of a user computer or an internal user computer; Installed between the web server / web application server and the database, the access time, access server IP address, user ID, application name, query execution process of the user computer or internal user computer accessing the database via the web server / web application server. A database security gateway for extracting database connection data including IDs and queries; It stores various digital contents, provides a database server which provides predetermined data requested from a user computer or an internal user computer connected via a web server / web application server, and extracts SQL statements from a web source. It stores a list of SQL characters for each character, and accesses web server connection data including access time, connection IP address, calling web page, and query received from web access information collection module in web server, and query received from query sniffing module in web application server. Stores and manages query information including time and query, access time received from database security gateway, access server IP address, user ID, application name, query execution process ID, and database server connection data including query Server connection data, query information, database Perform data matching to check whether the server access data is matched by using the access time and query, and control access control from the database security gateway to the database server of the user computer or the internal user computer based on the data matching result. Web server connection data extracted from the connection information collection module, query information extracted from the query sniffing module, database server connection data extracted from the database security gateway, and access control to the database server via the web server / web application server. Another feature is that it includes a database security server that generates reports based on the results.

In addition, the database security apparatus of the web-based three-tier environment according to the present invention is installed in front of the web server, HTTP connection for accessing the database server via a web server from a user computer or an internal user computer connected through a network communication network A web access monitoring gateway equipped with a web access information collection module which extracts web server access data including access time, access IP address, calling web page, query execution process ID, and query of the corresponding user computer or internal user computer; ; Installed between web server and database, database access data including access time, access server IP address, user ID, application name, query execution process ID, and query of user computer or internal user computer accessing database through web server. A database security gateway for extracting; A database server which stores various digital contents and provides predetermined data requested by a user computer or an internal user computer connected via a web server; And extracting SQL statements from the web source, storing a list of SQL characters per web page, access time received from the web access information collection module in the web access monitoring gateway, access IP address, calling web page, query execution process ID, Web server connection data including query, access time received from database security gateway, access server IP address, user ID, application name, query execution process ID, database server connection data including query are stored and managed. Data matching is performed to confirm the match using the query execution process ID and the query among the database server and the database server access data, and access control from the database security gateway to the database server of the user computer or the internal user computer is performed based on the data matching result. Control, And another database security server that generates a report based on the results of access control to the database server via the web server and the web server access data extracted from the web access information collection module and the database server access data extracted from the database security gateway. It features.

In addition, the database security apparatus of a web-based three-tier environment according to the present invention is installed in front of a web server / web application server and connected to a user computer or an internal user computer via a network communication network via a web server / web application server. When an HTTP connection is established to access a database server, web access information is collected to extract web server access data including access time, access IP address, calling web page, query execution process ID, and query. A web access monitoring gateway equipped with a module; A web server / web application server installed in the web application server and including a query sniffing module configured to extract query information including a connection time and a query of a user computer or an internal user computer for accessing a database server through a web access monitoring gateway; Installed between the web server / web application server and the database, the access time, access server IP address, user ID, application name, query execution process of the user computer or internal user computer accessing the database via the web server / web application server. A database security gateway for extracting database connection data including IDs and queries; A database server storing various digital contents and providing predetermined data requested by a user computer or an internal user computer connected via a web server / web application server; And a web server that extracts an SQL statement from a web source, stores a list of SQL characters for each web page, and includes a connection time, an access IP address, a calling web page, and a query received from a web access information collection module in a web access monitoring gateway. Access data, query information including query time sent from query sniffing module in web application server, query information including query, access time received from database security gateway, access server IP address, user ID, application name, query execution process ID, query Stores and manages database server connection data, including the database server, performs data matching to check whether the web server connection data, query information, and database server connection data are matched using the connection time and query, and performs the data matching result. Users at the database security gateway It controls access control to the database server of the computer or internal user computer, and web server access data extracted from the web access information collection module, query information extracted from the query sniffing module, and database server access data extracted from the database security gateway. And a database security server that generates a report based on a result of access control to the database server via the web server / web application server.

In addition, the database security device of a web-based three-tier environment according to the present invention is connected and installed by a tap device to a network switch that performs switching of a user computer or an internal user computer requesting an HTTP connection to a web server, and the user computer. Alternatively, when an HTTP connection is made to access a database server from an internal user computer via a web server, the access time, access IP address, calling web page, query, etc. of the user computer or internal user computer are executed through the packet mirrored from the network switch. A packet sniffing device equipped with a web access information collecting module for extracting web server access data including a process ID and a query; Installed between web server and database, database access data including access time, access server IP address, user ID, application name, query execution process ID, and query of user computer or internal user computer accessing database through web server. A database security gateway for extracting; A database server which stores various digital contents and provides predetermined data requested by a user computer or an internal user computer connected via a web server; Extract the SQL statement from the web source, store the list of SQL characters for each web page, access time received from the web access information collection module in the packet sniffing device, access IP address, calling web page, query execution process ID, Web server connection data including query, access time received from database security gateway, access server IP address, user ID, application name, query execution process ID, database server connection data including query are stored and managed. Data matching is performed to confirm the match using the query execution process ID and the query among the database server and the database server access data, and access control from the database security gateway to the database server of the user computer or the internal user computer is performed based on the data matching result. Control, web contact Another feature is that it includes Web server access data extracted from the information collection module and database server access data extracted from the database security gateway, and a database security server that generates a report based on the results of access control to the database server via the web server. do.

In addition, the database security apparatus of the web-based three-tier environment according to the present invention is connected and installed by a tap device to a network switch that performs switching of a user computer or an internal user computer requesting HTTP access to a web server / web application server. When the HTTP connection for accessing the database server from the user computer or the internal user computer via the web server / web application server is performed, the access time and the access IP of the user computer or the internal user computer through the packet mirrored from the network switch. A packet sniffing device equipped with a web access information collecting module for extracting web server access data including an address, a calling web page, a query execution process ID, and a query; A web server / web application server installed in the web application server and having a query sniffing module configured to extract query information including a query time and a connection time of a user computer or an internal user computer for accessing a database server through a network switch; Installed between the web server / web application server and the database, the access time, access server IP address, user ID, application name, query execution process of the user computer or internal user computer accessing the database via the web server / web application server. A database security gateway for extracting database connection data including IDs and queries; A database server storing various digital contents and providing predetermined data requested by a user computer or an internal user computer connected via a web server / web application server; And extracting SQL statements from a web source, storing a list of SQL characters for each web page, and accessing a web server including access time, access IP address, calling web page, and query received from a web access information collection module in a packet sniffing device. Data, the query information including the connection time received from the query sniffing module in the web application server, the query information including the query, the connection time received from the database security gateway, the access server IP address, the user ID, the application name, the query execution process ID, and the query. Stores and manages database server access data, including web server access data, query information, and data matching to check whether the database server access data is matched using the access time and query, and based on the data matching result. User computer or database security gateway Controls access control of internal user computer to database server. Web server access data extracted from web access information collection module, query information extracted from query sniffing module, and database server access data extracted from database security gateway. And a database security server that generates a report based on a result of access control to the database server via the web server / web application server.

As described above, according to the database security method and apparatus of the web-based three-tier environment of the present invention, the information of the user accessing the web, the query information called by the user, and the query is executed to access the database. Information can be integratedly managed, audit data such as the information of end users and web pages connected to the contents of database access can be collected, and database access and unregistered via the web of unspecified users. Access to the database through web pages and queries can be blocked, and the report creation function using the collected information can be prevented, so that the contents of the database can be hacked by malicious users or leaked by the internal users. To secure databases in 3-tier environments It can work.

Hereinafter, a method and apparatus for securing a database in a web-based three-tier environment according to the present invention will be described in detail with reference to the accompanying drawings.

First, prior to the detailed description of the present invention, a database security product currently released in Korea and overseas is based on an installation method and an operation method of a security system, such as an agent method, a sniffing method, and a gateway method. It can be divided into three.

In the agent method, an agent for security is installed in a database to control a user accessing a database or to store audit information about the access contents. Security can be applied to all accesses to the database so that the strongest security policy can be established and operated. However, because the agent is installed on the database server, it puts an additional load on the database. If the agent fails, access to the database may be restricted.

The sniffing method is a tap device connected to and installed on a network switch to which a database server is connected. The sniffing method monitors access to a database server in the middle of the network, and does not put a load on the database server and the network. However, there are limitations on the access control and it is mainly used for collecting audit data.

The gateway system is installed between the network switch and the database server, and the user connects to the database server via security equipment. Products commonly called gateways provide services in the form of inline, proxy, and IP-forwarding. It is possible to control the access of users, collect audit data, and form the mainstream of access control and audit products. Although it does not put a load on the database server, it is located in the middle of the network, so if there are many database transactions, a distributed environment should be configured.

The present invention provides a Hyper Text Transfer Protocol (HTTP) information collection agent method (first and second embodiments), an HTTP information collection gateway method (third and fourth embodiments), and an HTTP information collection sniffing method (fifth). , Example 6) and the like will be described in detail below.

First Example

FIG. 3 is a diagram schematically showing a configuration of a first embodiment of a database security apparatus of a web-based three-tier environment according to the present invention, and FIG. 4 is a view for explaining an example of data matching performed by the database security server of FIG. As a diagram, the first embodiment of the present invention is a database security based on the HTTP information collection agent method when the user computer 120 or the internal user computer 130 accesses the database server 170 via the web server 150. To illustrate.

As shown in FIG. 3, the database security device includes a network communication network 110, a plurality of user computers 120, a plurality of internal user computers 130, a network switch 140, a web server 150, a database security gateway. 160, a database server 170, a database security server 180, and the like.

The web server 150 may include a web server 152 that processes an HTTP connection of the user computer 120 or the internal user computer 130 through the network communication network 110, and a user computer connected through the network communication network 110. 120 or when the HTTP connection for accessing the database server 170 via the web server 150 from the internal user computer 130 is performed, the access time and connection of the corresponding user computer 120 or the internal user computer 130 Web access information collection module 154 which extracts web server connection data including IP address, calling web page, query execution process ID, query, and sends them to database security server 180, JSP, ASP, ASP.Net, PHP Web development languages (156) such as, Perl, CGI, and JDBC, ADO, ADO.Net, ODBC, etc., which are application program interfaces that connect databases to execute SQL (Structured Query Language) in Java programs. Emitter is composed of a base connected to the client 158.

The database security gateway 160 is installed between the web server 150 and the database server 170 to process transmission and reception of TNS (Transaction Network Service) packets, and accesses the database server 170 via the web server 150. Extract the database access data including the access time, access server IP address, user ID, application name, query execution process ID, and query of the user computer 120 or the internal user computer 130 to the database security server 180. do.

The database server 170 stores various digital contents and provides predetermined data requested by the user computer 120 or the internal user computer 130 connected through the web server 150.

The database security server 180 performs a preprocessing process of extracting SQL statements from a web source, storing a list of SQL characters for each web page, and accessing time, access IP address, and the like received from the web access information collection module 154. Web server access data and database including calling web page, query execution process ID, query, access time received from the security gateway 160, access server IP address, user ID, application name, query execution process ID, database including query Stores and manages server access data, performs data matching to check whether the web server access data and database server access data are matched using a query execution process ID and a query, and based on the data matching result, the database security gateway (160). ) From your computer 120 or from your internal user computer 130 Emitter controls the access control to the database server 170.

At this time, the database security server 180, the web server connection data extracted from the web access information collection module 154 and the database server connection data extracted from the database security gateway 160, and the database server via the web server 150 ( 170, the function of generating a report based on the access control result can be further performed.

In addition, the access control of the user computer 120 or the internal user computer 130 to the database server 170 via the web server 150 performed by the database security server 180 is controlled by the same user within a certain time. Alternatively, the user can access a specific column more than the specified number of times, access an unregistered query or web page, a table or column that does not have access authority, or execute an SQL transformation attack.

A first embodiment of a database security method for a web-based three-tier environment according to the present invention configured as described above will be described in detail with reference to FIG.

A database security server 180 that performs a database security service of a web-based 3-tier environment extracts an SQL statement from a web source (S110), and performs a preprocessing process of storing a list of SQL characters for each web page (S120). .

Subsequently, the database server via the web server 150 of the user computer 120 or the internal user computer 130 through the network communication network 110 in the web access information collection module 154 installed in the web server 150. (170) Check whether the HTTP connection for the connection is performed (S130).

When the HTTP connection of the user computer 120 or the internal user computer 130 is performed, the user who performs the HTTP connection for accessing the database server 170 via the web server 150 in the web access information collection module 154. Extract the web server access data of the computer 120 or the internal user computer 130, and transmits the extracted web server access data to the database security server 180 (S140).

At this time, the web server access data extracted from the web access information collection module 154 through step S140 are audit data such as access time, access IP address, calling web page, query execution process ID, and query.

When the connection of the database server 170 via the web server 150 of the user computer 120 or the internal user computer 130 is performed, the database security gateway 160 installed between the web server 150 and the database server 170. Extract the database server access data of the user computer 120 or the internal user computer 130 accessing the database server 170, and transmits the extracted database server access data to the database security server 180 (S150). .

At this time, the database server access data extracted from the database security gateway 160 through the step S150 is audit data such as access time, access server IP address, user ID, application name, query execution process ID, query, and the like.

Thereafter, the database security server 180 performs data matching between the web server access data extracted from the web access information collection module 154 and the database server access data extracted from the database security gateway 160 through step S150 (step S140). S160).

At this time, the database security server 180 checks whether or not the web server access data extracted from the web access information collection module 154 matches with the query execution process ID and the query among the database server access data extracted from the database security gateway 160. Perform data matching to check.

Then, the access control to the database server 170 of the user computer 120 or the internal user computer 130 via the web server 150 is performed based on the data matching result (S170).

In this case, access control to the database server 170 is controlled when the same user accesses a specific table or a specific column more than a predetermined number of times within a predetermined time, or a query or web page or access right that is not registered in S110 and S120. Perform database security by controlling for missing tables or columns, or controlling for SQL transformation attacks.

On the other hand, in the database security server 180, the web server access data and database server access data extracted in the step S140 and S150, and access control results to the database server 170 via the web server 150 performed in step S160 It continuously stores and manages and performs a function of generating a related report as necessary (S180). At this time, the audit data of the web server access data and database server access data that are continuously stored and managed can be used later for abnormal database access information alerts, tracking of malicious HTTP access users, and tracking access to database data of malicious internal users. .

2nd Example

FIG. 6 is a diagram schematically showing a configuration of a second embodiment of a database security apparatus of a web-based three-tier environment according to the present invention, and FIG. 7 is a view for explaining an example of data matching performed by the database security server of FIG. As a diagram, a second embodiment of the present invention is provided in which the user computer 220 or the internal user computer 230 passes through a web server / web application server 250 (ie, a structure of a web server + web application server (WAS)). This is to describe the database security according to the HTTP information collection agent method when accessing the database server 270.

As shown in FIG. 6, the database security device includes a network communication network 210, a plurality of user computers 220, a plurality of internal user computers 230, a network switch 240, a web server / web application server 250. , A database security gateway 260, a database server 270, and a database security server 280.

The web server / web application server 250 is connected via a web server 252a or a network communication network 210 that processes the HTTP connection of the user computer 220 or the internal user computer 230 through the network communication network 210. When the HTTP connection for accessing the database server 270 via the web server / web application server 250 is performed from the user computer 220 or the internal user computer 230, the corresponding user computer 220 or the internal user computer ( A web server 252 provided with a web access information collection module 252b for extracting web server access data including a connection time, an access IP address, a calling web page, and a query of the web server 230, and transmitting it to a database security server 280; Connection time, query of user computer 220 or internal user computer 230 for database connection client 254b, database server 270, etc., WAS 254a, JDBC, ADO, ADO.Net, ODBCExtracting hamhan query information comprises a database, the security server 280, a query module sniffing web application server 254, the (254c) is provided for transmitting to.

The database security gateway 270 is installed between the web server / web application server 250 and the database server 270 to handle transmission and reception of TNS packets, and the database server 270 via the web server / web application server 250. Database access data including access time, access server IP address, user ID, application name, query execution process ID, and query of the user computer 220 or internal user computer 230 to access the database security server 280 To send).

The database server 270 stores various digital contents and provides predetermined data requested by the user computer 220 or the internal user computer 230 connected through the web server / web application server 250.

The database security server 280 extracts an SQL statement from a web source, performs a preprocessing process for storing a list of SQL characters for each web page, and access time, access IP address, and the like received from the web access information collection module 252b. Calling web page, web server access data including query, access time received from query sniffing module 254c, query information including query, access time received from database security gateway 260, access server IP address, user Stores and manages database server connection data including ID, application name, query execution process ID, and query, and checks whether the server server data, query information, and database server connection data match the connection time and query. Performing data matching, and based on the data matching result, the database security gateway 260. Up controls the user computer 220 or the access control to the database server 270, internal user computer 230.

At this time, the database security server 280, the web server connection data extracted by the web access information collection module 252b, the query information extracted by the query sniffing module 254c, and the database extracted by the database security gateway 260 A report may be further generated based on server access data and a result of access control to the database server 270 via the web server / web application server 250.

In addition, the access control of the user computer 220 or the internal user computer 230 to the database server 270 via the web server / web application server 250 performed by the database security server 280 is the same user. Executes a specific number of times for a certain table or column within a certain time, accesses an unregistered query or web page, a table or column that does not have access authority, or executes an SQL transformation attack.

A second embodiment of a database security method for a web-based three-tier environment according to the present invention configured as described above will be described in detail with reference to FIG.

The database security server 280 performing the database security service extracts an SQL statement from the web source (S210), and performs a preprocessing process of storing the SQL character list for each web page (S220).

Then, the web server of the user computer 220 or the internal user computer 230 through the network communication network 210 in the web access information collection module 252b installed in the web server 252 in the web server / web application server 250. / Check whether the HTTP connection for connecting to the database server 270 via the web application server 250 is performed (S230).

When the HTTP connection of the user computer 220 or the internal user computer 230 is performed, the web connection information collection module 252b may be used to access the database server 270 via the web server / web application server 250. The web server access data of the user computer 220 or the internal user computer 230 performing HTTP access is extracted, and the extracted web server access data is transmitted to the database security server 280 (S240).

At this time, the web server access data extracted by the web access information collection module 252b through step S240 are audit data such as access time, access IP address, calling web page, and query.

Thereafter, the query sniffing module 254c installed in the web application server 254 extracts the query information of the user computer 220 or the internal user computer 230 for accessing the database server 270, and extracts the extracted query information from the database security. The server 280 transmits the data to the server 280 (S250).

At this time, the query information extracted by the query sniffing module 254c through step S250 is audit data such as access time and query.

When the connection of the database server 270 via the web server / web application server 250 of the user computer 220 or the internal user computer 230 is performed, the web server / web application server 250 and the database server 270 are connected. Extracts the database server connection data of the user computer 220 or the internal user computer 230 that accesses the database server 270 from the database security gateway 260 installed therebetween, and extracts the extracted database server connection data from the database security server. In step 280, and transmits to (280).

At this time, the database server access data extracted from the database security gateway 260 through step S260 are audit data such as access time, access server IP address, user ID, application name, query execution process ID, and query.

Thereafter, the database security server 280 uses the web server access data extracted from the web access information collection module 252b through step S240, the query information extracted from the query sniffing module 254c through step S250, and the database security gateway through step S260. Data matching of the database server access data extracted in step 260 is performed (S270).

At this time, the database security server 280 is connected to the web server access data extracted from the web access information collection module 252b, the query information extracted from the query sniffing module 254c, the database server access data extracted from the database security gateway 260 Perform data matching to check for matches using and queries.

Then, the access control is performed to the database server 270 of the user computer 220 or the internal user computer 230 via the web server / web application server 250 based on the data matching result (S280).

In this case, the access control to the database server 270 is controlled when the same user accesses a specific table or a specific column more than a predetermined number of times within a predetermined time as in the above-described embodiment, or a query or web that is not registered in S210 and S220. Perform database security by controlling pages, tables or columns that you do not have access to, or by controlling against SQL transformation attacks.

Finally, the database security server 280 passes through the web server access data, query information, and database server access data extracted in steps S240, S250, and S260, and the web server / web application server 250 performed in step S280. It continuously stores and manages the access control result to the database server 270, and performs a function of generating a related report as necessary (S290). At this time, the audit data of the web server access data, query information and database server access data that are continuously stored and managed can be checked for abnormal database access information alerts, tracking of malicious HTTP access users, and tracking access to database data of malicious internal users. It can be utilized.

3rd Example

FIG. 9 is a diagram schematically showing a configuration of a third embodiment of a database security apparatus of a web-based three-tier environment according to the present invention, and FIG. 10 is a view for explaining an example of data matching performed by the database security server of FIG. As a diagram, a third embodiment of the present invention is a database security based on the HTTP information collection gateway method when the user computer 320 or the internal user computer 330 accesses the database server 380 via the web server 360. To illustrate.

As shown in FIG. 9, the database security device includes a network communication network 310, a plurality of user computers 320, a plurality of internal user computers 330, a network switch 340, a web access monitoring gateway 350, and a web. A server 360, a database security gateway 370, a database server 380, a database security server 390, and the like.

The web access monitoring gateway 350 is installed between the network switch 340 and the web server 360, and performs an HTTP connection for accessing the database server 380 via the web server 360 through the network communication network 310. Extracting web server access data including access time, access IP address, calling web page, query execution process ID, and query of the executing user computer 320 or internal user computer 330 and transmitting to the database security server 390 The web connection information collection module 352 is provided.

The web server 360 may include a web server 362 which processes an HTTP connection of the user computer 320 or the internal user computer 330 through the web access monitoring gateway 350, JSP, ASP, ASP.Net, PHP, Web development languages 364 such as Perl and CGI, and database connection clients 366 such as JDBC, ADO, ADO.Net, and ODBC, which are application program interfaces that connect databases.

The database security gateway 370 is installed between the web server 360 and the database server 380 to handle transmission and reception of TNS packets, and the database server 380 via the web access monitoring gateway 350 and the web server 360. Database security server 390 by extracting the database access data including access time, access server IP address, user ID, application name, query execution process ID, and query of the user computer 320 or internal user computer 330 accessing To send).

The database server 380 stores various digital contents, and predetermined data requested by the user computer 320 or the internal user computer 330 connected via the web access monitoring gateway 350 and the web server 360. To provide.

The database security server 390 performs a preprocessing process of extracting SQL statements from a web source, storing a list of SQL characters for each web page, and from the web access information collection module 352 in the web access monitoring gateway 350. Access time, access IP address, calling web page, query execution process ID, web server access data including query, access time received from database security gateway 370, access server IP address, user ID, application name, Stores and manages database server connection data including query execution process ID and query, performs data matching to check whether the query execution process ID and query are matched among web server connection data and database server connection data, and data matching Based on the result of the execution, the database security gateway (370) in the user computer (320) Alternatively, the access control to the database server 380 of the internal user computer 330 is controlled.

At this time, the database security server 390, the web server access data extracted from the web access information collection module 352 and the database server access data extracted from the database security gateway 370, the web access monitoring gateway 350, the web server ( A function of generating a report may be further performed based on a result of access control to the database server 380 via 360.

In addition, the access control of the user computer 320 or the internal user computer 330 to the database server 380 via the web server 360 performed by the database security server 390 is controlled by the user within a certain time period. Executes more than the specified number of times for a specific column, accesses an unregistered query or web page, a table or column that does not have access authority, or executes an SQL transformation attack.

A third embodiment of a database security method for a web-based 3-tier environment according to the present invention configured as described above will be described in detail with reference to FIG.

The database security server 390, which performs a database security service of a web-based 3-tier environment, extracts an SQL statement from a web source (S310), and performs a preprocessing process of storing a list of SQL characters for each web page (S320). .

Subsequently, in the web access information collection module 352 provided in the web access monitoring gateway 350, the database via the web server 360 of the user computer 320 or the internal user computer 330 through the network communication network 310. It is checked whether the HTTP connection for accessing the server 380 is performed (S330).

When the HTTP connection of the user computer 320 or the internal user computer 330 is performed, the connection time and connection of the user computer 320 or the internal user computer 330 which performs the HTTP connection in the web access information collection module 352. The web server access data, which is audit data such as an IP address, a calling web page, a query execution process ID, and a query, is extracted, and the extracted web server access data is transmitted to the database security server 390 (S340).

When the connection of the database server 380 via the web server 360 of the user computer 320 or the internal user computer 330 is performed, the database security gateway 370 installed between the web server 360 and the database server 380. Database server which is audit data such as access time, access server IP address, user ID, application name, query execution process ID, query, etc. of user computer 320 or internal user computer 330 accessing database server 380 Extracting the access data, and transmits the extracted database server access data to the database security server (390) (S350).

The database security server 390 then executes the query execution process ID and query among the web server access data extracted from the web access information collection module 352 through step S340 and the database server access data extracted from the database security gateway 370 through step S350. In operation S360, data matching for checking a match is performed.

Based on the data matching result, the same user to the database server 380 of the user computer 320 or the internal user computer 330 via the web server 360 accesses a predetermined number of times or more within a predetermined time to a specific table or a specific column. In this case, the control is performed, or the control is performed on the non-registered query or web page, the table or column to which the user does not have the access right, or the access control against the SQL transformation attack (S370).

On the other hand, in the database security server 390, the web server access data extracted in the above-described step 340 and S350 to be utilized for alerting abnormal database access information, tracking of malicious HTTP access user, tracking of access to database data of malicious internal users. And continuously storing and managing database server access data and access control results to the database server 380 via the web server 360 performed in step S360, and generating a related report as necessary ( S380).

4th Example

FIG. 12 is a diagram schematically showing a configuration of a fourth embodiment of a database security apparatus of a web-based three-tier environment according to the present invention, and FIG. 13 is a view for explaining an example of data matching performed by the database security server of FIG. As a diagram, a fourth embodiment of the present invention is an HTTP information collection gateway scheme when a user computer 420 or an internal user computer 430 accesses the database server 480 via a web server / web application server 460. This is to explain database security.

As shown in FIG. 12, the database security device includes a network communication network 410, a plurality of user computers 420, a plurality of internal user computers 430, a network switch 440, a web access monitoring gateway 450, and a web. Server / web application server 460, database security gateway 470, database server 480, database security server 490, and the like.

The web access monitoring gateway 450 is installed between the network switch 440 and the web server / web application server 460, and the database server via the web server / web application server 460 through the network communication network 410 ( Database security server 490 by extracting web server access data including access time, access IP address, calling web page, and query of user computer 420 or internal user computer 430 performing HTTP access for access. Web access information collection module 452 is transmitted to the.

The web server / web application server 460 includes a web server 462 that handles HTTP connections of the user computer 420 or the internal user computer 430 through the web access monitoring gateway 450, WAS 464a, and JDBC. Database by extracting query information including access time and query of the user's computer 420b or the internal user's computer 430 for database connection client 464b, database server 480, ADO, ADO.Net, ODBC, etc. It is composed of a web application server 464 equipped with a query sniffing module 464c for transmitting to the security server 490.

The database security gateway 470 is installed between the web server / web application server 460 and the database server 480 to handle transmission and reception of TNS packets, and the database server 480 via the web server / web application server 460. Database access data including access time, access server IP address, user ID, application name, query execution process ID, and query of the user computer 420 or internal user computer 430 accessing the database security server 490 To send).

The database server 480 stores various digital contents and provides predetermined data requested by the user computer 420 or the internal user computer 430 connected via the web server / web application server 460.

The database security server 490 performs a preprocessing process of extracting SQL statements from a web source, storing a list of SQL characters for each web page, and transmitting the data from the web access information collection module 452 in the web access monitoring gateway 450. Web server connection data including connection time received, connection IP address, calling web page, query, connection information received from query sniffing module 464c in web server / web application server 460, query information including query, Stores and manages database server access data including access time, access server IP address, user ID, application name, query execution process ID, and query received from the database security gateway 470, web server access data, and query information. Data matching is performed to check whether the data is matched by using the connection time and query among database server connection data. It said, data matching is performed based on a result of controlling the access control to database server 480 of the user computer 420 or inside the user's computer 430 in a database the security gateway 470.

At this time, the database security server 490, the web server connection data extracted from the web access information collection module 452, the query information extracted from the query sniffing module 464c, and the database extracted from the database security gateway 470 A function of generating a report may be further performed based on server access data and a result of access control to the database server 480 via the web server / web application server 460.

In addition, the access control of the user computer 420 or the internal user computer 430 to the database server 480 via the web server / web application server 460 performed by the database security server 490 is controlled by the same user. Executes a specific number of times for a certain table or column within a certain time, accesses an unregistered query or web page, a table or column that does not have access authority, or executes an SQL transformation attack.

A fourth embodiment of a method for securing a database in a web-based three-tier environment according to the present invention configured as described above will be described in detail with reference to FIG.

The database security server 390, which performs a database security service of a web-based 3-tier environment, extracts an SQL statement from a web source (S410), and performs a preprocessing process of storing a list of SQL characters for each web page (S420). .

Subsequently, the web server / web application server 460 of the user computer 420 or the internal user computer 430 through the network communication network 410 in the web access information collection module 452 provided in the web access monitoring gateway 450. Check whether the HTTP connection for accessing the database server 460 is performed via S430.

When the HTTP connection of the user computer 420 or the internal user computer 430 is performed, the access time and connection of the user computer 420 or the internal user computer 430 performing the HTTP connection in the web access information collection module 452. The web server access data, which is audit data such as an IP address, a calling web page, and a query, is extracted, and the extracted web server access data is transmitted to the database security server 490 (S440).

Thereafter, the query sniffing module 464c installed in the web application server 464 extracts query information which is audit data such as access time and query of the user computer 420 or the internal user computer 430 for accessing the database server 480. Then, the extracted query information is transmitted to the database security server 490 (S450).

When the database server 480 is connected via the web server / web application server 460 of the user computer 420 or the internal user computer 430, the web server / web application server 460 and the database server 480 are connected. Connection time, access server IP address, user ID, application name, query execution process ID of the user computer 420 or the internal user computer 430 accessing the database server 480 from the database security gateway 470 installed between Extract the database server connection data that is the audit data, such as query, and transmits the extracted database server connection data to the database security server (490) (S460).

Thereafter, the database security server 480 uses the web server access data extracted from the web access information collection module 452 through S440, the query information extracted from the query sniffing module 464c through S450, and the database security gateway through S460. Data matching is performed to check whether the database server access data extracted in step 470 matches using the access time and the query (S470).

Based on the data matching result, the same user to the database server 480 of the user computer 420 or the internal user computer 430 via the web server / web application server 460 is connected to a specific table or a specific column within a predetermined time. If the user accesses a predetermined number of times or more, or controls the non-registered query or web page, the table or column that does not have access authority in S410 and S420, or performs the access control against the SQL transformation attack (S480).

On the other hand, the database security server 490 is a web server extracted in the above-described step S440, S450 and S460 to be utilized for alarming abnormal database access information, tracking of malicious HTTP access user, tracking of access to database data of malicious internal users It continuously stores and manages access data, query information, database server access data, and access control results to the database server 480 via the web server / web application server 460 performed in step S470. The function of generating a related report is performed (S490).

5th Example

FIG. 15 is a diagram schematically showing a configuration of a fifth embodiment of a database security apparatus of a web-based three-tier environment according to the present invention, and FIG. 16 is a view for explaining an example of data matching performed by the database security server of FIG. As a drawing, a fifth embodiment of the present invention is a database security based on HTTP information collection sniffing scheme when a user computer 520 or an internal user computer 530 accesses a database server 580 via a web server 560. To illustrate.

As shown in FIG. 15, the database security device includes a network communication network 510, a plurality of user computers 520, a plurality of internal user computers 530, a network switch 540, and a packet sniffing device 550. ), A web server 560, a database security gateway 570, a database server 580, a database security server 590, and the like.

The packet sniffing device 550 is connected and installed by a tap device to a network switch 540 which performs switching of a user computer 520 or an internal user computer 530 that requests an HTTP connection to the web server 560, When the HTTP connection for accessing the database server 580 from the user computer 520 or the internal user computer 530 via the web server 560 is performed, the user computer (through the mirrored packet from the network switch 540) is performed. Web access information collection module which extracts web server access data including access time, access IP address, calling web page, query execution process ID, query of 520 or internal user computer 530 and transmits to database security server 590 352 is provided.

The web server 560 is a web server 562 that handles the HTTP connection of the user computer 520 or the internal user computer 530, and a web development language such as JSP, ASP, ASP.Net, PHP, Perl, CGI ( 564), and a database connection client 566 such as JDBC, ADO, ADO.Net, ODBC, etc., which is an application program interface for connecting a database.

The database security gateway 570 is installed between the web server 560 and the database server 580 to handle transmission and reception of TNS packets, and the user computer 520 accessing the database server 580 via the web server 560. Or extracts the database connection data including the connection time, access server IP address, user ID, application name, query execution process ID, and query of the internal user computer 530 and transmits it to the database security server 590.

The database server 580 stores various digital contents and provides predetermined data requested by the user computer 520 or the internal user computer 530 connected via the web server 360.

The database security server 590 extracts an SQL statement from a web source, performs a preprocessing process of storing a list of SQL characters for each web page, and receives the data from the web access information collection module 552 in the packet sniffing device 550. Web server access data including access time, access IP address, calling web page, query execution process ID, query and access time received from 570 to database security gateway, access server IP address, user ID, application name, query Stores and manages database server access data including execution process ID and query, performs data matching to check whether the query execution process ID and query are matched between web server access data and database server access data, and performs data matching Based on the results, the database security gateway 570 may be used to And it controls the control connection to the database server 580 in the sub-user computer 530. The

At this time, the database security server 590, the web server connection data extracted from the web access information collection module 552 and the database server connection data extracted from the database security gateway 570, and the database server via the web server 560 ( 580 may further perform the function of generating a report based on the access control result.

In addition, access control of the user computer 520 or the internal user computer 530 to the database server 580 via the web server 560 performed by the database security server 590 is controlled by the user within a certain time period. Executes more than the specified number of times for a specific column, accesses an unregistered query or web page, a table or column that does not have access authority, or executes an SQL transformation attack.

A fifth embodiment of a database security method for a web-based three-tier environment according to the present invention configured as described above will be described in detail with reference to FIG.

The database security server 590, which performs a database security service in a web-based 3-tier environment, extracts an SQL statement from a web source (S510) and performs a preprocessing process of storing a list of SQL characters for each web page (S520). .

Subsequently, the web server 560 of the user computer 520 or the internal user computer 530 is connected to the web connection information collection module 552 included in the packet sniffing device 550 based on the packets mirrored from the network switch 540. It is checked whether the HTTP connection for accessing the database server 580 is performed (S530).

When the HTTP connection of the user computer 320 or the internal user computer 330 is performed, the user computer 520 or the internal user who performs the HTTP connection in the web access information collection module 552 included in the packet sniffing device 550. Extract the web server access data, which is audit data such as access time, access IP address, calling web page, query execution process ID, query, etc. of the computer 530, and transmit the extracted web server access data to the database security server 590. (S540).

When the connection of the database server 580 via the web server 560 of the user computer 520 or the internal user computer 530 is performed, the database security gateway 570 installed between the web server 560 and the database server 580. Database server that is audit data such as access time, access server IP address, user ID, application name, query execution process ID, query, etc. of user computer 520 or internal user computer 530 accessing database server 580 Extracting the access data, and transmits the extracted database server access data to the database security server (590) (S550).

Thereafter, the database security server 590 performs the query execution process ID and the query among the web server access data extracted from the web access information collection module 552 through step S540 and the database server access data extracted from the database security gateway 570 through step S550. In operation S560, data matching for checking a match is performed.

Based on the data matching result, the same user to the database server 580 of the user computer 520 or the internal user computer 530 via the web server 560 is connected to the specific table or the specific column more than a predetermined number of times within a predetermined time. If so, or controls the non-registered queries or web pages, tables or columns that do not have access rights in step S510, S520, or access control for SQL transformation attack (S570).

On the other hand, in the database security server 590, the web server access data extracted in the above-described step 540 and S550 to be utilized for alarming abnormal database access information, tracking of malicious HTTP access user, tracking of access to database data of malicious internal users. And continuously storing and managing database server access data and access control results to the database server 580 via the web server 560 performed in step S560, and generating a related report as necessary ( S580).

6th Example

FIG. 18 is a diagram schematically showing a configuration of a sixth embodiment of a database security apparatus of a web-based three-tier environment according to the present invention, and FIG. 19 is a view for explaining an example of data matching performed by the database security server of FIG. As a drawing, a sixth embodiment of the present invention is an HTTP information collection sniffing scheme when a user computer 620 or an internal user computer 630 accesses a database server 680 via a web server / web application server 660. This is to explain database security.

As shown in FIG. 18, the database security device includes a network communication network 610, a plurality of user computers 620, a plurality of internal user computers 630, a network switch 640, a packet sniffing device 650, and a web server. / Web application server 660, database security gateway 670, database server 680, database security server 690 and the like.

The packet sniffing device 650 is connected to the web server / web application server 660 by the tap device to the network switch 640 which performs the switching of the user computer 620 or the internal user computer 630 requesting an HTTP connection. , And, when an HTTP connection is made from the user computer 620 or the internal user computer 630 to connect to the database server 680 via the web server / web application server 660, mirroring from the network switch 640. Database security server 690 by extracting web server access data including access time, access IP address, calling web page, query execution process ID, and query of the corresponding user computer 620 or internal user computer 630 through one packet. Web access information collection module 652 for transmitting to.

The web server / web application server 660 is a web server 662 that handles HTTP connections of the user computer 620 or internal user computer 630 via the network switch 640, and the WAS 664a, JDBC, ADO. Database security server by extracting query information including access time and query of the database connection client 664b, ADO.Net, ODBC, etc., the user computer 620 or the internal user computer 630 for accessing the database server 680 It consists of a web application server 664 equipped with a query sniffing module 664c for sending to 690.

The database security gateway 670 is installed between the web server / web application server 660 and the database server 680 to handle transmission and reception of TNS packets, and the database server 680 via the web server / web application server 660. Database security server 690 by extracting the database access data including access time, access server IP address, user ID, application name, query execution process ID, and query of the user computer 620 or internal user computer 630 accessing To send).

The database server 680 stores various digital contents and provides predetermined data requested by the user computer 620 or the internal user computer 630 connected via the web server / web application server 660.

The database security server 690 performs a preprocessing process of extracting SQL statements from a web source, storing a list of SQL characters for each web page, and receiving the data from the web access information collection module 652 in the packet sniffing device 650. Web server access data including access time, access IP address, calling web page, query, access time received from query sniffing module 664c in web server / web application server 660, query information including query, database Store and manage database server connection data including access time, access server IP address, user ID, application name, query execution process ID, and query received from security gateway 670, web server connection data, query information, Performs data matching to check whether the database server access data match using query time and query. The access control from the database security gateway 670 to the database server 680 of the user computer 620 or the internal user computer 630 is controlled based on the data matching result.

At this time, the database security server 690, the web server connection data extracted from the web access information collection module 652, the query information extracted from the query sniffing module 664c, and the database extracted from the database security gateway 670 A report may be further generated based on the server access data and the result of the access control to the database server 680 via the web server / web application server 660.

In addition, the access control of the user computer 620 or the internal user computer 630 via the web server / web application server 660 performed by the database security server 690 to the database server 680 is controlled by the same user. Executes a specific number of times for a certain table or column within a certain time, accesses an unregistered query or web page, a table or column that does not have access authority, or executes an SQL transformation attack.

A sixth embodiment of a database security method for a web-based 3-tier environment according to the present invention configured as described above will be described in detail with reference to FIG.

A database security server 690 that performs a database security service of a web-based 3-tier environment extracts an SQL statement from a web source (S610), and performs a preprocessing process of storing a list of SQL characters for each web page (S620). .

Then, the web server / web application server of the user computer 620 or the internal user computer 630 based on the packets mirrored from the network switch 640 in the web access information collection module 652 provided in the packet sniffing device 650. It is checked whether the HTTP connection for accessing the database server 680 via 660 is performed (S630).

When the HTTP connection of the user computer 620 or the internal user computer 630 is performed, the user computer 620 or the internal user performing the HTTP connection in the web access information collection module 652 included in the packet sniffing device 650. Web server access data, which is audit data such as access time, access IP address, calling web page, query, etc. of the computer 630, is extracted, and the extracted web server access data is transmitted to the database security server 690 (S640).

Thereafter, the query sniffing module 664c installed in the web application server 664 extracts query information that is audit data such as access time and query of the user computer 620 or the internal user computer 630 for accessing the database server 680. Then, the extracted query information is transmitted to the database security server 690 (S650).

When the database server 680 is connected via the web server / web application server 660 of the user computer 620 or the internal user computer 630, the web server / web application server 660 and the database server 680 are connected. Connection time, access server IP address, user ID, application name, query execution process of the user computer 620 or internal user computer 630 accessing the database server 680 from the database security gateway 670 installed between Extracting the database server connection data that is the audit data, such as ID, query, and transmits the extracted database server connection data to the database security server (690) (S660).

Thereafter, the database security server 680 uses the web server access data extracted from the web access information collection module 652 through step S640, the query information extracted from the query sniffing module 664c through step S650, and the database security gateway through step S660. In operation 670, data matching is performed to determine whether the database server access data is extracted using the access time and the query.

Based on the data matching result, the same user to the database server 680 of the user computer 620 or the internal user computer 630 via the web server / web application server 660 is connected to a specific table or a specific column within a predetermined time. If the user accesses a predetermined number of times or more, or controls the non-registered query or web page, the table or the column which does not have the access right in step S610 and S620, or performs the access control for the SQL transformation attack (S680).

On the other hand, the database security server 690, the web server extracted in the above-described step S640, S650 and S660 to be utilized for alarming abnormal database access information, tracking of malicious HTTP access user, tracking of access to database data of malicious internal users It continuously stores and manages access data, query information and database server access data, and the result of access control to the database server 680 via the web server / web application server 660 performed in step S670. Perform a function to generate a report (S690).

Herein, while the present invention has been described with reference to the preferred embodiments, those skilled in the art will variously modify the present invention without departing from the spirit and scope of the invention as set forth in the claims below. And can be changed.

1 and 2 schematically illustrate a typical web-based two-tier environment and a three-tier environment;

3 is a diagram schematically showing the configuration of a first embodiment of a database security apparatus for a web-based three-tier environment according to the present invention;

4 is a view for explaining an example of data matching performed in the database security server of FIG.

5 is a flowchart showing in detail the operation of the first embodiment of the method for securing a database in a web-based 3-tier environment according to the present invention;

6 is a diagram schematically showing the configuration of a second embodiment of a database security apparatus for a web-based three-tier environment according to the present invention;

7 is a view for explaining an example of data matching performed in the database security server of FIG.

8 is a flow chart showing in detail the operation of the second embodiment of a method for securing a database in a web-based 3-tier environment according to the present invention;

9 is a view schematically showing the configuration of a third embodiment of a database security apparatus for a web-based three-tier environment according to the present invention;

10 is a view for explaining an example of data matching performed in the database security server of FIG.

11 is a flow chart showing in detail the operation of the third embodiment of a database security method for a web-based 3-tier environment according to the present invention;

12 is a diagram schematically showing the configuration of a fourth embodiment of a database security apparatus for a web-based three-tier environment according to the present invention;

FIG. 13 is a diagram for explaining an example of data matching performed by the database security server of FIG. 12. FIG.

14 is a flow chart showing in detail the operation of the fourth embodiment of a method for securing a database in a web-based three-tier environment according to the present invention;

15 is a view schematically showing the configuration of a fifth embodiment of a database security apparatus for a web-based 3-tier environment according to the present invention;

FIG. 16 is a view for explaining an example of data matching performed by the database security server of FIG. 15; FIG.

17 is a flow chart showing in detail the operation of the fifth embodiment of a method for securing a database in a web-based three-tier environment according to the present invention;

18 is a diagram schematically showing the configuration of a sixth embodiment of a database security device for a web-based three-tier environment according to the present invention;

19 is a view for explaining an example of data matching performed by the database security server of FIG. 18;

20 is a flowchart showing in detail the operation of the sixth embodiment of a method for securing a database in a web-based three-tier environment according to the present invention.

Claims (46)

(1-1) extracting SQL statements from a web source in a database security server performing a database security service of a web-based 3-tier environment, and storing a SQL character list for each web page; (1-2) checking whether an HTTP connection for accessing a database server via a web server of a user computer or an internal user computer is performed in a web access information collection module installed in the web server; (1-3) The web access information collection module extracts web server access data of a user computer or an internal user computer performing HTTP access for accessing a database server via the web server, and extracts the extracted web server access data. Transmitting to the database security server; (1-4) extracting database server access data of a user computer or an internal user computer accessing the database server via the web server from a database security gateway installed between the web server and the database server; (1-5) Web server access data extracted from the web access information collection module through step (1-3) in the database security server and database server access extracted from the database security gateway through step (1-4) Performing data matching of data, and performing access control of the user computer or the internal user computer to the database server based on the data matching result; And (1-6) Web server access data and database server access data extracted in steps (1-3) and (1-4) in the database security server, and in the step (1-5) And continuously storing and managing a result of access control to the database server via a web server, and generating a report. The method of claim 1, wherein the web server access data extracted from the web access information collection module of step (1-3), A method for securing a database in a web-based three-tier environment, characterized by connection time, access IP address, calling web page, query execution process ID, and query. The method of claim 1, wherein the database server access data extracted from the database security gateway of the step (1-4), A method of securing a database in a web-based three-tier environment, characterized in that the connection time, access server IP address, user ID, application name, query execution process ID, and query. The method of claim 1, wherein the data matching performed in the database security server of the step (1-5), Web-based three-tier environment characterized in that the web server access data extracted from the web access information collection module and the database server access data extracted from the database security gateway to check whether the matching using the query execution process ID and query. Database security methods. The method of claim 1, wherein the access control to the database server performed by the database security server in the step (1-5), When the same user accesses a specific table or a specific column more than a predetermined number of times within a predetermined time, or controls a query or web page not registered in step (1-1) and a table or column to which access rights are not granted, A method for securing a database in a web-based three-tier environment, characterized by controlling against SQL transformation attacks. (2-1) extracting SQL statements from a web source in a database security server performing a database security service of a web-based 3-tier environment, and storing a list of SQL characters for each web page; (2-2) checking whether an HTTP connection for accessing a database server via a web server / web application server of a user computer or an internal user computer is performed in a web access information collection module installed in the web server; (2-3) The web access information collection module extracts web server access data of a user computer or an internal user computer performing HTTP access for accessing a database server via the web server / web application server, and extracts the extracted web. Transmitting server access data to the database security server; (2-4) extracting query information of a user computer or an internal user computer for accessing the database server from a query sniffing module installed in a web application server, and transmitting the extracted query information to the database security server; (2-5) A database server access data of a user computer or an internal user computer accessing the database server via the web server / web application server at a database security gateway installed between the web server / web application server and the database server. Extracting; (2-6) the web server access data extracted from the web access information collection module through step (2-3) in the database security server, the query information extracted from the query sniffing module through step (2-4), Performing data matching of the database server access data extracted from the database security gateway through step (2-5), and performing access control of the user computer or the internal user computer to the database server based on the data matching result step; And (2-7) Web server access data and query information extracted in steps (2-3) and (2-4) in the database security server, and the web server / performed in step (2-6). And continuously storing and managing access control results to the database server via a web application server, and generating a report. The web server access data extracted from the web access information collection module of step (2-3), Database security method in a web-based three-tier environment, characterized in that the connection time, access IP address, calling web page, query. The method of claim 6, wherein the query information extracted by the query sniffing module of the step (2-4), Database security method of a web-based 3-tier environment, characterized in that the connection time, query. The method of claim 6, wherein the database server access data extracted from the database security gateway of the step (2-5), A method of securing a database in a web-based three-tier environment, characterized in that the connection time, access server IP address, user ID, application name, query execution process ID, and query. The method of claim 6, wherein the data matching performed by the database security server of the step (2-6), The web server access data extracted from the web access information collection module, the query information extracted from the query sniffing module, and the database server access data extracted from the database security gateway are used to check whether they match using the access time. Database security method of a web-based three-tier environment, characterized in that. The method of claim 6, wherein the access control to the database server performed by the database security server of the step (2-6), When the same user accesses a specific table or a specific column more than a predetermined number of times within a predetermined time, or controls a query or web page not registered in the step (2-1) and a table or column to which access rights are not granted, A method for securing a database in a web-based three-tier environment, characterized by controlling against SQL transformation attacks. (3-1) extracting SQL statements from a web source in a database security server performing a database security service of a web-based 3-tier environment, and storing a SQL character list for each web page; (3-2) checking whether an HTTP connection for accessing a database server via a web server of a user computer or an internal user computer is performed in a web access information collection module provided in a web access monitoring gateway installed at a front end of the web server; (3-3) The web access information collection module provided in the web access monitoring gateway extracts web server access data of a user computer or an internal user computer that performs HTTP access for accessing a database server via the web server. Transmitting the extracted web server access data to the database security server; (3-4) extracting database server access data of a user computer or an internal user computer accessing the database server via the web server from a database security gateway installed between the web server and the database server; (3-5) Web server access data extracted from the web access information collection module provided in the web access monitoring gateway through step (3-3) in the database security server and the database through step (3-4). Performing data matching of the database server access data extracted by the security gateway, and controlling access to the database server of the user computer or the internal user computer based on the data matching result; And (3-6) Web server access data and database server access data extracted in steps (3-3) and (3-4) in the database security server, and the step performed in step (3-5) And continuously storing and managing a result of access control to the database server via a web server, and generating a report. The web server access data extracted from the web access information collection module of step (3-3), A method for securing a database in a web-based three-tier environment, characterized by connection time, access IP address, calling web page, query execution process ID, and query. The method of claim 12, wherein the database server access data extracted from the database security gateway of the step (3-4), A method of securing a database in a web-based three-tier environment, characterized in that the connection time, access server IP address, user ID, application name, query execution process ID, and query. The method of claim 12, wherein the data matching performed by the database security server of the step (3-5), Web-based three-tier environment characterized in that the web server access data extracted from the web access information collection module and the database server access data extracted from the database security gateway to check whether the matching using the query execution process ID and query. Database security methods. The method of claim 12, wherein the access control to the database server performed by the database security server in the step (3-5), If the same user accesses a certain number of times for a specific table or column within a certain time, control or control the query or web page which is not registered in the above step (3-1) and the table or column to which access is not granted. Database security method in a web-based three-tier environment, characterized in that the control against SQL transformation attack. (4-1) extracting an SQL statement from a web source in a database security server performing a database security service of a web-based 3-tier environment, and storing a SQL character list for each web page; (4-2) checking whether an HTTP connection for accessing a database server via a web server of a user computer or an internal user computer is performed in a web access information collection module provided in a web access monitoring gateway installed at a front end of the web server; (4-3) In the web access information collection module, extract web server access data of a user computer or an internal user computer performing HTTP access for accessing a database server via a web server / web application server, and extract the extracted web server. Transmitting access data to the database security server; (4-4) extracting query information of a user computer or an internal user computer for accessing the database server from a query sniffing module installed in a web application server, and transmitting the extracted query information to the database security server; (4-5) Database server access of a user computer or an internal user computer accessing the database server via the web server / web application server in a database security gateway installed between the web server / web application server and the database server. Extracting data; (4-6) Web server access data extracted from the web access information collection module through step (4-3) in the database security server, query information extracted from the query sniffing module through step (4-4), Performing data matching of the database server access data extracted by the database security gateway through step (4-5), and performing access control of the user computer or the internal user computer to the database server based on the data matching result step; And (4-7) Web server access data and query information extracted in steps (4-3) and (4-4) in the database security server, and the web server / performed in step (4-6). And continuously storing and managing access control results to the database server via a web application server, and generating a report. 18. The method of claim 17, wherein the web server access data extracted from the web access information collection module of step (4-3), Database security method in a web-based three-tier environment, characterized in that the connection time, access IP address, calling web page, query. The method of claim 17, wherein the query information extracted by the query sniffing module of the step (4-4), Database security method of a web-based 3-tier environment, characterized in that the connection time, query. The method of claim 17, wherein the database server access data extracted from the database security gateway of the step (4-5), A method of securing a database in a web-based three-tier environment, characterized in that the connection time, access server IP address, user ID, application name, query execution process ID, and query. 18. The method of claim 17, wherein the data matching performed by the database security server of step (4-6) is performed. The web server access data extracted from the web access information collection module, the query information extracted from the query sniffing module, and the database server access data extracted from the database security gateway are used to check whether they match using the access time. Database security method of a web-based three-tier environment, characterized in that. The method of claim 17, wherein the access control to the database server performed by the database security server in the step (4-6), If the same user accesses a specific table or a specific column more than a certain number of times within a certain period of time, or controls a query or web page not registered in step (4-1) and a table or column to which access is not granted. Database security method in a web-based three-tier environment, characterized in that the control against SQL transformation attack. (5-1) extracting SQL statements from a web source in a database security server performing a database security service in a web-based 3-tier environment, and storing a SQL character list for each web page; (5-2) Connected by a tap device to a network switch that performs switching of a user computer or an internal user computer requesting an HTTP connection to a web server, and via a web server of the user computer or the internal user computer in an installed packet sniffing device. Checking whether an HTTP connection for accessing one database server is performed; (5-3) extracts and extracts web server access data of a user computer or an internal user computer that performs an HTTP connection for accessing a database server via the web server in a web access information collection module provided in the packet sniffing device; Transmitting the web server access data to the database security server; (5-4) extracting database server access data of a user computer or an internal user computer accessing the database server via the web server from a database security gateway installed between the web server and the database server; (5-5) Web server access data extracted from the web access information collection module provided in the packet sniffing device through step (5-3) in the database security server and the database security through step (5-4). Performing data matching of the database server connection data extracted by the gateway, and performing access control of the user computer or the internal user computer to the database server based on the data matching result; And (5-6) Web server access data and database server access data extracted in steps (5-3) and (5-4) in the database security server, and the step performed in step (5-5) And continuously storing and managing a result of access control to the database server via a web server, and generating a report. 24. The method of claim 23, wherein the web server access data extracted from the web access information collection module of step (5-3), A method for securing a database in a web-based three-tier environment, characterized by connection time, access IP address, calling web page, query execution process ID, and query. The method of claim 23, wherein the database server access data extracted from the database security gateway of the step (5-4), A method of securing a database in a web-based three-tier environment, characterized in that the connection time, access server IP address, user ID, application name, query execution process ID, and query. 24. The method of claim 23, wherein the data matching performed by the database security server of step (5-5) is performed. Web-based three-tier environment characterized in that the web server access data extracted from the web access information collection module and the database server access data extracted from the database security gateway to check whether the matching using the query execution process ID and query. Database security methods. The method of claim 23, wherein the access control to the database server performed by the database security server in the step (5-5) is: When the same user accesses a specific table or a specific column more than a predetermined number of times within a predetermined time, or controls a query or web page not registered in step (5-1) and a table or column to which access is not granted, A method for securing a database in a web-based three-tier environment, characterized by controlling against SQL transformation attacks. (6-1) extracting SQL statements from a web source in a database security server performing a database security service of a web-based 3-tier environment, and storing a list of SQL characters for each web page; (6-2) A web server / web of the user computer or the internal user computer in a packet sniffing device installed and connected by a tap device to a network switch that performs switching of a user computer or an internal user computer requesting an HTTP connection to a web server. Confirming whether an HTTP connection for accessing the database server via the application server is performed; (6-3) extracting web server access data of a user computer or an internal user computer which performs HTTP access for accessing a database server via a web server / web application server in the web access information collection module in the packet sniffing device; Transmitting the extracted web server access data to the database security server; (6-4) extracting query information of a user computer or an internal user computer for accessing the database server from a query sniffing module installed in a web application server, and transmitting the extracted query information to the database security server; (6-5) Database server access data of a user computer or an internal user computer accessing the database server via the web server / web application server in a database security gateway installed between the web server / web application server and the database server. Extracting; (6-6) web server access data extracted from the web access information collection module through step (6-3) in the database security server, query information extracted from the query sniffing module through step (6-4), In step (6-5), data matching of the database server access data extracted by the database security gateway is performed, and access control of the user computer or the internal user computer to the database server is performed based on the data matching result. Making; And (6-7) Web server access data and query information extracted in steps (6-3) and (6-4) in the database security server, and the web server / performed in step (6-6). And continuously storing and managing access control results to the database server via a web application server, and generating a report. 29. The method of claim 28, wherein the web server access data extracted from the web access information collection module of step (6-3), Database security method in a web-based three-tier environment, characterized in that the connection time, access IP address, calling web page, query. 29. The method of claim 28, wherein the query information extracted by the query sniffing module of the step (6-4) is Database security method of a web-based 3-tier environment, characterized in that the connection time, query. 29. The method of claim 28, wherein the database server access data extracted from the database security gateway of the step (6-5), A method of securing a database in a web-based three-tier environment, characterized in that the connection time, access server IP address, user ID, application name, query execution process ID, and query. 29. The method of claim 28, wherein the data matching performed by the database security server of step (6-6) is performed. The web server access data extracted from the web access information collection module, the query information extracted from the query sniffing module, and the database server access data extracted from the database security gateway are used to check whether they match using the access time. Database security method of a web-based three-tier environment, characterized in that. 29. The method of claim 28, wherein the access control to the database server performed by the database security server in the step (6-6) is: When the same user accesses a specific table or a specific column more than a predetermined number of times within a predetermined time, or controls a query or web page not registered in step (6-1) and a table or column to which access rights are not granted, A method for securing a database in a web-based three-tier environment, characterized by controlling against SQL transformation attacks. A computer-readable recording medium having recorded thereon a computer program capable of executing the method of any one of claims 1 to 33. When the HTTP connection for accessing the database server from the user computer or the internal user computer connected through the network network is performed through the web server, the access time, the access IP address, the calling web page, and the query are executed. A web server equipped with a web access information collection module for extracting web server access data including a process ID and a query; Installed between the web server and the database, including the access time, access server IP address, user ID, application name, query execution process ID, query of the user computer or internal user computer accessing the database via the web server. A database security gateway for extracting database connection data; A database server which stores various digital contents and provides predetermined data requested by the user computer or an internal user computer connected via the web server; And Extract SQL statement from web source, save SQL character list per web page, access time received from web access information collection module in web server, access IP address, calling web page, query execution process ID, query Stores and manages the web server access data including the web server access data including the access time, access server IP address, user ID, application name, query execution process ID, and database server access data including the query. Perform a data matching to check whether the data is matched using a query execution process ID and a query among the access data and the database server access data, and based on the data matching result, the database security gateway at the database of the user computer or the internal user computer Connection to server And generating a report based on the web server access data extracted from the web access information collection module and the database server access data extracted from the database security gateway, and the result of access control to the database server via the web server. Database security device in a web-based three-tier environment, characterized in that it comprises a database security server. The method of claim 35, wherein the database security server, The same user accesses a specific table or a specific column more than a predetermined number of times, accesses an unregistered query or web page, an unauthorized table or column, or accesses a user or internal user's computer against an SQL transformation attack. And controlling access control to the database server via the web server. When an HTTP connection for accessing a database server via a web server / web application server is performed from a user computer or an internal user computer installed in a web server through a network communication network, the access time of the corresponding user computer or internal user computer, Web access information gathering module that extracts web server access data including access IP address, calling web page, query, and query including access time and query of user computer or internal user computer installed in web application server to access database server. A web server / web application server equipped with a query sniffing module for extracting information; An access time, access server IP address, user ID, application name of the user computer or internal user computer installed between the web server / web application server and the database and accessing the database via the web server / web application server; A database security gateway that extracts a database execution data including a query execution process ID and a query; A database server storing various digital contents and providing predetermined data requested by the user computer or an internal user computer connected via the web server / web application server; And Web server access data including extracting SQL statements from a web source, storing a list of SQL characters per web page, and access time, access IP address, calling web page, and query received from the web access information collection module in the web server. And connection information received from the query sniffing module in the web application server, query information including a query, connection time received from the database security gateway, access server IP address, user ID, application name, query execution process ID, and query. Store and manage the database server access data including, and perform data matching to check whether the web server access data, the query information, the access time and the query among the database server access data and whether the match, and data matching Database security gateway based on performance Control access control of the user computer or the internal user computer to the database server, web server access data extracted from the web access information collection module, query information extracted from the query sniffing module, and the database security gateway. And a database security server for generating a report based on a database server connection data extracted from the database and a result of access control to the database server via the web server / web application server. Database security device. The method of claim 37, wherein the database security server, The same user accesses a specific table or a specific column more than a predetermined number of times, accesses an unregistered query or web page, an unauthorized table or column, or accesses a user or internal user's computer against an SQL transformation attack. And controlling access control to the database server via the web server / web application server. It is installed in front of the web server, and when the HTTP connection for accessing the database server via the web server is performed from the user computer or the internal user computer connected through the network communication network, the access time and the IP address of the user computer or the internal user computer. A web access monitoring gateway having a web access information collection module for extracting web server access data including a calling web page, a query execution process ID, and a query; Installed between the web server and the database, including access time, access server IP address, user ID, application name, query execution process ID, query of the user computer or internal user computer accessing the database via the web server. A database security gateway for extracting database connection data; A database server which stores various digital contents and provides predetermined data requested by the user computer or an internal user computer connected via the web server; And Extract SQL statement from web source, save SQL character list per web page, access time received from web access information collection module in web access monitoring gateway, access IP address, calling web page, query execution process ID, Stores and manages web server access data including queries, access time received from the database security gateway, access server IP address, user ID, application name, query execution process ID, and database server access data including queries. Perform a data matching to check whether the data is matched using a query execution process ID and a query among the access data and the database server access data, and based on the data matching result, the database security gateway at the database of the user computer or the internal user computer Controlling access control to the server, and controlling web server access data extracted from the web access information collection module and database server access data extracted from the database security gateway, and access control results to the database server via the web server. Database security device in a web-based three-tier environment, characterized in that it comprises a database security server for generating a report based on. 40. The method of claim 39, wherein the database security server, The same user accesses a specific table or a specific column more than a predetermined number of times, accesses an unregistered query or web page, an unauthorized table or column, or accesses a user or internal user's computer against an SQL transformation attack. And controlling access control to the database server via the web server. If the HTTP server for accessing the database server via the web server / web application server is established from the user computer connected to the web server / web application server or the user computer connected through the network, the user computer or internal user. A web access monitoring gateway having a web access information collecting module for extracting web server access data including access time of the computer, access IP address, calling web page, query execution process ID, and query; A web server / web application server installed in a web application server and including a query sniffing module configured to extract query information including a query time and a connection time of a user computer or an internal user computer for accessing a database server through the web access monitoring gateway; An access time, access server IP address, user ID, application name of the user computer or internal user computer installed between the web server / web application server and the database and accessing the database via the web server / web application server; A database security gateway that extracts a database execution data including a query execution process ID and a query; A database server storing various digital contents and providing predetermined data requested by the user computer or an internal user computer connected via the web server / web application server; And A web server that extracts SQL statements from a web source, stores a list of SQL characters for each web page, and includes access time, access IP address, calling web page, and query received from the web access information collection module in the web access monitoring gateway. Access data, access information received from the query sniffing module in the web application server, query information including a query, access time received from the database security gateway, access server IP address, user ID, application name, query execution process ID Storing and managing database server access data including queries, performing data matching to check whether the web server access data, the query information, access time and query among the database server access data are matched, and The database based on the result of data matching Controlling access control of the user computer or internal user computer from the security gateway to the database server, web server access data extracted from the web access information collection module, query information extracted from the query sniffing module, and the database; Web-based three-tier, comprising a database security server for generating a report based on the database server connection data extracted from the security gateway, and the result of the access control to the database server via the web server / web application server Database security for your environment. The method of claim 41, wherein the database security server, The same user accesses a specific table or a specific column more than a predetermined number of times, accesses an unregistered query or web page, an unauthorized table or column, or accesses a user or internal user's computer against an SQL transformation attack. And controlling access control to the database server via the web server / web application server. HTTP connection for a database server via a web server from the user computer or an internal user computer, connected and installed by a tap device to a network switch that performs switching of a user computer or an internal user computer requesting an HTTP connection to a web server. When the connection is established, the web connection extracts the web server connection data including the connection time, the connection IP address, the calling web page, the query execution process ID, and the query of the user computer or the internal user computer through the mirrored packet from the network switch. A packet sniffing device having an information collecting module; Installed between the web server and the database, including access time, access server IP address, user ID, application name, query execution process ID, query of the user computer or internal user computer accessing the database via the web server. A database security gateway for extracting database connection data; A database server which stores various digital contents and provides predetermined data requested by the user computer or an internal user computer connected via the web server; And Extract SQL statement in web source, save SQL character list per web page, access time received from web access information collection module in packet sniffing device, access IP address, calling web page, query execution process ID, query Web server access data, including the access time and access time received from the database security gateway, access server IP address, user ID, application name, query execution process ID, database server access data including the query is stored, managed, the web server access Perform a data matching to confirm whether the data is matched using a query execution process ID and a query among data and the database server access data, and based on the data matching result, the database server of the user computer or the internal user computer at the database security gateway. in Controlling access control of the server, based on the web server access data extracted from the web access information collection module and the database server access data extracted from the database security gateway, and the result of access control to the database server via the web server. Database security device in a web-based three-tier environment, characterized in that it comprises a database security server for generating a report. The method of claim 43, wherein the database security server, The same user accesses a specific table or a specific column more than a predetermined number of times, accesses an unregistered query or web page, an unauthorized table or column, or accesses a user or internal user's computer against an SQL transformation attack. And controlling access control to the database server via the web server. Connected and installed by a tap device to a network switch that performs switching of a user computer or an internal user computer requesting an HTTP connection to a web server / web application server, and connects the web server / web application server from the user computer or the internal user computer. When the HTTP connection for accessing the database server is performed, the web including the access time, the access IP address, the calling web page, the query execution process ID, and the query of the user computer or the internal user computer through the packet mirrored from the network switch. A packet sniffing device having a web access information collecting module for extracting server access data; A web server / web application server installed in a web application server and having a query sniffing module configured to extract query information including a connection time and a query of a user computer or an internal user computer for accessing a database server through the network switch; An access time, access server IP address, user ID, application name of the user computer or internal user computer installed between the web server / web application server and the database and accessing the database via the web server / web application server; A database security gateway that extracts a database execution data including a query execution process ID and a query; A database server storing various digital contents and providing predetermined data requested by the user computer or an internal user computer connected via the web server / web application server; And Extract the SQL statement from the web source, save the SQL character list for each web page, and access the web server including the access time, access IP address, calling web page, and query received from the web access information collection module in the packet sniffing device. Data, access time received from the query sniffing module in the web application server, query information including a query, access time received from the database security gateway, access server IP address, user ID, application name, query execution process ID, Store and manage database server access data including a query, perform data matching to check whether the web server access data, the query information, access time and query among the database server access data are matched, and the data Database security based on matching performance Control access control of the user computer or internal user computer from the gateway to the database server, web server access data extracted from the web access information collection module, query information extracted from the query sniffing module, and the database security Web-based three-tier environment comprising a database security server for generating a report based on the database server access data extracted from the gateway and the result of the access control to the database server via the web server / web application server. Database security device. 46. The method of claim 45, wherein the database security server, The same user accesses a specific table or a specific column more than a predetermined number of times, accesses an unregistered query or web page, an unauthorized table or column, or accesses a user or internal user's computer against an SQL transformation attack. And controlling access control to the database server via the web server / web application server.

Images