KR101069367B1 - Security system and method of important information by query change - Google Patents

Abstract

The problem to be solved by the present invention is to provide an important information security system and method by changing the query to protect the important information stored in the database and at the same time minimize the load generated during information processing. An important information security system using a query change includes: a packet receiving module receiving a packet from a user and extracting a query within the packet; A policy management module for storing a security string of a DBMS and a replacement string for replacing a string in violation of the security policy; A query word control module for changing a string that violates the security policy from a string in a query word extracted by the packet receiving module into a replacement string based on the information stored in the policy management module; And a packet transmission module for combining the query word changed into the replacement string by the query control module into a packet and transmitting the combined packet to the DBMS. According to the present invention, by extracting a string requesting important information in the query and changing it to a replacement string, it is possible to prevent unauthorized users from accessing important information, thereby significantly improving the security of the database.

Description

Security system and method of important information by query change}

The present invention relates to an important information security system and method by changing a query, and more particularly, to protect important information stored in a database and at the same time, to protect the important information and to minimize the load generated during information processing. It is about a method.

DBMS (Database management system) is a system for organizing and archiving data to effectively use data stored in database. DBMS is based on ① definition of accumulated data structure, ② accumulation of data according to data structure, ③ database language. Data retrieval and update, ④ simultaneous execution control of data processing from multiple users, ⑤ If abnormality occurs during update, revert to the state before update, ⑥ protect information confidentiality.

In such a DBMS, preventing unauthorized users from acquiring important information stored in a database is an important technical problem. In the related art, this problem has been attempted to be solved by using a column encryption technique or a technique for changing important information data of a result value.

The column encryption technology encrypts and stores the columns of the database itself, and in order to search for a specific column, use a special function directly or use View. In other words, in order to use a column encryption technique, first a task of encrypting a column of a database is required, and a task of decrypting it is necessary to query an encrypted column. Since the encryption and decryption operations of the column are performed on the personal terminal or the database, a significant load is generated on the personal terminal and the database, which causes a problem of significantly slowing down the processing speed of the information stored in the database. A critical problem occurred in using the database at the time, and it was difficult to quickly recover the related state.

The technology of changing important information of the result value analyzes the result value searched from the query and the database, and changes the result value of the part corresponding to the important information of the searched result value to substitute characters (0 or *) to be important. Protect your information. This important information data change technique of the result value must analyze both the query and the searched result value, the search result has a significant size has a problem that a lot of load occurs. That is, in general, a query has a size of about 100 bytes, and the result has a size of about 1,500,000 bytes, which is about 15,000 times larger than that of a query, so that a lot of load is generated to analyze a result having such a size. There was this.

In addition, as described above, since the result value has a considerable size, there is a high possibility that the analysis of the result value having important information may fail in the process of analyzing the result value, and thus the result value having important information may not be changed to a substitute character. There was a problem that was very vulnerable to security.

The problem to be solved by the present invention is to provide an important information security system and method by changing the query to protect the important information stored in the database and at the same time minimize the load generated during information processing.

An important information security system using a query change includes: a packet receiving module receiving a packet from a user and extracting a query within the packet; A policy management module for storing a security string of a DBMS and a replacement string for replacing a string in violation of the security policy; A query word control module for changing a string that violates the security policy from a string in a query word extracted by the packet receiving module into a replacement string based on the information stored in the policy management module; And a packet transmission module for combining the query word changed into the replacement string by the query control module into a packet and transmitting the combined packet to the DBMS.

The apparatus may further include a table / column information module which collects table and column information through the DBMS and provides column information of a table in response to a request of the query control module.

The query control module may further include a function of changing all column query characters in the query word extracted by the packet receiving module into column information of a corresponding table based on the information stored in the table / column information module. do.

In addition, the table / column information module, at the same time as the query is extracted from the packet receiving module, collects table and column information through the DBMS, or periodically at a predetermined time through the DBMS before extracting the query from the packet receiving module. Collecting table and column information or collecting table and column information through the DBMS when detecting change of the table or column information.

The method may further include the DBMS that receives a packet from the packet transmission module and provides a user with a result of executing the query using the changed query through the security check in the packet.

Method for securing important information by changing the query, the step of receiving a packet from the user (S100); Extracting a query word in the packet (S200); Extracting a string that violates a security policy from the string in the query (S500); Changing the string extracted in step S500 into a replacement string (S600); Combining the query word changed into the replacement string into a packet (S700); Transmitting the packet combined in step S700 to the DBMS (S800); And providing the user with information corresponding to a character string except for the replacement string among the query words in the packet received in step S800 (S900).

In addition, extracting the entire column query characters in the query extracted in step S200 (S300); The method may further include changing the entire column query character to column information of a corresponding table when a string that violates a security policy exists in the entire column query character (S400).

In addition, the step S700 is characterized in that to combine the query to change to a replacement string in consideration of the entire length of the packet.

According to the present invention, by extracting a string requesting important information in the query and changing it to a replacement string, it is possible to prevent unauthorized users from accessing important information, thereby significantly improving the security of the database.

In addition, when protecting the important information stored in the database, only the string requesting the important information is extracted and replaced with the replacement string. Therefore, compared to the technology for protecting the important information by encrypting the column of the conventional table or changing the important information data among the result values. In addition, it is possible to significantly reduce the hatching generated during information processing.

Figure 1 is a block diagram showing an embodiment of a critical information security system through the inventor query change.
2 is a flowchart illustrating an embodiment of a method for securing important information through a query change.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

1 is a block diagram illustrating an embodiment of a system for protecting important information by changing a query word, the packet receiving module 10 receiving a packet from a user 100 and extracting a query word from the packet; A policy management module 20 for storing a security policy of the DBMS 60 and a replacement string for substituting a string in violation of the security policy; A query control module 30 for changing a string that violates the security policy from a string in a query word extracted by the packet receiving module 10 into a replacement string based on the information stored in the policy management module 20; And a packet transmission module 40 for combining the query word changed into the replacement string by the query control module 30 to the packet and transmitting the combined packet to the DBMS 60.

The packet receiving module 10 receives a packet from the user 100 and extracts a query within the received packet. The user 100 is connected to the packet receiving module 10 through a communication terminal such as a PC, PDA, tablet PC, and transmits the packet to the packet receiving module 10 by wire or wirelessly, the packet receiving module 10 is The query extracted in the packet received from the user 100 is transmitted to the query control module 30.

The policy management module 20 stores a replacement string to replace a string that violates a security policy and a security policy of a database management system (DBMS). The security policy sets the range of information allowed to the user. For example, set the security policy to allow all information to be granted to user A, set the security policy to prevent all information from being granted to user B, and Security policy can be set to allow the information except for important information such as social security number and contact information.

The string that violates the security policy refers to a string that requests unauthorized information from the user 100 among the strings included in the query transmitted to the packet receiving module 10 by the user 100. For example, when the user C transmits the following query to the packet receiving module 10,

'select no, jumin, name from member where rownum <10'

Because user C is not allowed for social security number information, 'jumin' is a string that violates security policy.

As described above, the replacement string to replace the string that violates the security policy is stored in the policy management module 20, and the replacement string prevents the user from providing important information that is not permitted by the user. For example, an alternative string to replace jumin, a string for social security number information, with '?' You can save the AS jumin. That is, the replacement string '?' Instead of jumin When AS jumin is sent to the DBMS 60, the DBMS 60 returns a result value according to the social security number request. To be provided to the user.

In addition, the replacement string to replace the string that violates the security policy and security policy stored in the policy management module 20 may be set by the DBMS administrator.

The query control module 30 changes the string that violates the security policy from the string in the query word extracted by the packet receiving module 10 into a replacement string based on the information stored in the policy management module 20. That is, the query control module 30 checks the security policy information according to the accessed user through the policy management module 20, and based on the checked security policy, the query control module 30 checks a string that violates the security policy among the query words transmitted by the user. Extract.

Thereafter, the query control module 30 detects the replacement string corresponding to the string that violates the security policy through the policy management module 20, and changes the string that violates the security policy into the replacement string.

In addition, when the query in the packet received from the user 100 does not contain a string that violates the security policy, the query control module 30 immediately transmits the packet to the packet transmitter 40.

The packet transmission module 40 combines the query word changed by the query control module 30 into the replacement string into a packet, and transmits the combined packet to the DBMS 60. That is, the packet transmission module 40 receives the query word changed to the replacement string from the query control module 30 and combines the packet changed to the replacement string instead of the existing query word. In this case, the length of the query word changed to the replacement string and the length of the entire packet are combined.

In addition, when there is no string that violates the security policy in the packet received from the user 100, the packet transmission module 40 receives information that there is no violation of the security policy from the query control module 30, the packet The transmission module 40 transmits the existing packet to the DBMS 60 without change.

In addition, the critical information security system by changing the query, the table / column information module that collects table and column information through the DBMS 60 and provides column information of the table in response to a request of the query control module 30 ( It characterized in that it further comprises 50).

In addition, the query control module 30 changes the entire column query character in the query word extracted by the packet receiving module 10 into column information of a corresponding table based on the information stored in the table / column information module 50. It further comprises a function.

The full column query character is a string including one or more column information, which corresponds to a preset protocol between the user 100 and the DBMS 60. For example, '*', which is a whole column query character, can be set to include column information of 'no, jumin, name'.

As described above, the column information of the table corresponding to the entire column query character is stored in the table / column information module 50, and the table / column information module 50 collects the table and column information through the DBMS 60. . At this time, the table / column information module 50 collects table and column information through the DBMS 60 at the same time as the query is extracted from the packet receiving module 10 or before extracting the query from the packet receiving module 10. The DBMS 60 collects table and column information periodically at regular time intervals, or collects table and column information through the DBMS 60 when detecting changes in the table or column information.

The query control module 30 analyzes whether a string violating a security policy exists in the entire column query character based on the information of the table / column information module 50 when the entire column query character is included in the query word. If there is a string that violates the security policy, the entire column query character is changed to the column information of the corresponding table.

For example, if the following query is included in the packet received from the user 100,

'select * from member where rownum <10'

'*' In the query word is the entire column query character, and according to the table / column information module 50, '*' represents column information 'no, jumin, name', and the string violates the security policy in the column information. Is changed to '*' as column information 'no, jumin, name', and when there is no string in violation of the security policy in the column information, the entire column query character is changed to the corresponding column information. I never do that.

If a string violating the security policy exists in the column information corresponding to the entire column query character, the entire column query character is changed to the corresponding table column information as follows.

'select no, jumin, name from member where rownum <10'

If the user's social security number information is not allowed, jumin is set to '?' Change to as jumin and change to the following query.

'select no,'? ' as jumin, name from member where rownum <10 '

In addition, the critical information security system by changing the query, the DBMS 60 that receives the packet from the packet transmission module 40 and provides the user 100 with information based on a character string except for the replacement string among the query words in the packet. It is characterized by including.

That is, when the DBMS 60 receives the packet including the replacement string from the packet transmission module 40, the DBMS 60 searches for the information according to the string except for the replacement string and provides the information to the user 100, and the replacement string is not included. When the packet is received, the information according to all character strings is searched and provided to the user 100.

For example, when the DBMS 60 receives a packet including the following query word from the packet transmission module 40,

'select no,'? ' as jumin, name. from member where rownum <10 '

The DBMS 60 searches for the information except the social security number information and provides it to the user 100 as follows.

NO JUMIN NAME 4 ? Gyehwarin 5 ? Kochi Prefecture 6 ? Kwon Bin Woo 7 ? Golden violet 8 ? Gun Ho Kim 9 ? Dabin Kim 10 ? Dohyun Kim 11 ? Doyeon Kim 12 ? Danbi Kim

In the above description, an embodiment of an important information security system through a query change of the present inventor has been described in detail. Hereinafter, an embodiment of a method for securing important information by changing the query word of the present invention will be described in detail.

In addition, hereinafter, the user 100 transmits a packet including the query word 'select * from member where rownum <10' to the packet receiving module 10, and the security policy according to the user 100 indicates that social security number information is included. Assume that it is not allowed. In addition, it is assumed that '*' is an entire column query character, and column information corresponding to the entire column query character is 'no, jumin, name'.

FIG. 2 is a flowchart illustrating an embodiment of a method for securing important information through a query change, and the method for securing important information through a query change includes: receiving a packet from a user (S100); Extracting a query word in the packet (S200); Extracting a string that violates a security policy from the string in the query (S500); Changing the string extracted in step S500 into a replacement string (S600); Combining the query word changed into the replacement string into a packet (S700); Transmitting the packet combined in step S700 to the DBMS (S800); And providing the user with information corresponding to a character string except for the replacement string among the query words in the packet received in step S800 (S900).

In addition, the sensitive information security method by changing the query, the step of extracting the entire column query characters in the query extracted in step S200 (S300); And changing the entire column lookup character to column information of a corresponding table (S400).

In step S100, a packet is received from the user 100, and the packet receiving module 10 receives the packet. At this time, the user 100 and the packet receiving module 10 transmits the packet via wired or wireless.

The step S200 is a step of extracting a query in a packet received from the user 100, and extracts a query on the packet receiving module 10. Since the packet includes the query word 'select * from member where rownum <10', 'select * from member where rownum <10' is extracted in step S200.

The step S300 is a step of analyzing whether the entire column query character is included in the query word extracted by the packet receiving module 10 and analyzed on the query control module 30. The query word 'select * from member where rownum <10' contains '*', so the entire column query character is included. If the query does not include the entire column query character, the next step is to analyze whether the query contains a string that violates the security policy.

Step S400 analyzes whether a string violating the security policy exists in the entire column query character extracted from the query (S410), and if the string violates the security policy, the column of the table corresponding to the entire column query character. Change to information (S420). '*', Which is the whole column query character, indicates 'no, name, jumin', which is the column information, and 'jumin' corresponds to a string that violates security rules. Change to 'no, name, jumin'. At this time, if there is no string that violates the security policy in the whole column query character, and goes to the next step S500.

The step S500 is a step of analyzing whether a string violating the security policy is included in the query word, and analyzed on the query control module 30 based on the information stored in the policy management module 20. Since the social security number information is not allowed to the user 100, 'jumin' in the query corresponds to a string that violates the security policy. If the query does not contain a string that violates the security policy, the packet is transmitted to the DBMS 60 in the next step.

The step S600 is a step of changing a string that violates the security policy into a replacement string, and changes it on the query control module 30 based on the information stored in the policy management module 20. Substitution string corresponding to 'jumin', a string that violates security policy is '?' as jumin ', so the following query can be obtained by changing the string that violates the security policy into the corresponding replacement string.

'select no,'? ' as jumin, name from member where rownum <10 '

The step S700 is a step of combining the query word changed into the replacement string into the packet, and combines it on the packet transmission module 40. The query that is changed to the replacement string is' select no, '?' as jumin, name from member where rownum <10 ', so combine it into a packet. In this case, it is preferable to combine the query word changed into the replacement string in consideration of the total length of the packet.

In step S800, the packet is transmitted to the DBMS 60, and the packet transmission module 40 transmits the packet to the DBMS 60. Based on the assumptions above, the query 'select no,'? ' as jumin, name from member where rownum <10 'to the DBMS (60).

The step S900 is a step of retrieving the information according to the packet to the user 100, the DBMS 60 retrieves the information according to the packet and provides it to the user 100. The query included in the packet is' select no, '?' as jumin, name from member where rownum <10 ', thus providing information to the user 100 according to no, name. That is, the DBMS 60 provides the following information to the user 100.

NO JUMIN NAME 4 ? Gyehwarin 5 ? Kochi Prefecture 6 ? Kwon Bin Woo 7 ? Golden violet 8 ? Gun Ho Kim 9 ? Dabin Kim 10 ? Dohyun Kim 11 ? Doyeon Kim 12 ? Danbi Kim

As described above, although an embodiment of the present invention has been described, the technical concept of the present invention is not limited to the above-described embodiment, and the important information security system and method may be implemented by changing various queries within the scope not departing from the technical idea of the present invention. Can be.

10... Packet receiving module
20... Policy Management Module
30... Query Control Module
40 ... Packet transmission module
50... Table / Column Information Module
60 ... DBMS
100... user

Claims (8)

A packet receiving module for receiving a packet from a user and extracting a query within the packet;
A policy management module for storing a security string of a DBMS and a replacement string for replacing a string in violation of the security policy;
A query word control module for changing a string that violates the security policy from a string in a query word extracted by the packet receiving module into a replacement string based on the information stored in the policy management module; And
And a packet transmission module for combining the query word changed by the query control module into a replacement string into a packet and transmitting the combined packet to a DBMS. The method of claim 1,
And a table / column information module which collects table and column information through the DBMS and provides column information of the table in response to a request of the query control module. The method of claim 2, wherein the query control module,
Important information security by changing the query characterized in that it further comprises the function of changing the entire column query characters in the query extracted from the packet receiving module based on the information stored in the table / column information module to the column information of the corresponding table. system. The method of claim 2, wherein the table / column information module,
The query is extracted from the packet receiving module and at the same time collects table and column information through the DBMS,
Collect the table and column information through the DBMS before extracting the query in the packet receiving module,
Important information security system through a query change, characterized in that to collect table and column information through the DBMS when changing the table or column information. The method according to any one of claims 1 to 4,
Receiving a packet from the packet transmission module, and further comprising the DBMS for providing a user with information according to a character string except for the replacement string of the query in the packet further comprising a query information change system. Receiving a packet from a user (S100);
Extracting a query word in the packet (S200);
Extracting a string that violates a security policy from the string in the query (S500);
Changing the string extracted in step S500 into a replacement string (S600);
Combining the query word changed into the replacement string into a packet (S700);
Transmitting the packet combined in step S700 to the DBMS (S800); And
And providing information based on a character string excluding the replacement string among the query words received in step S800 to the user (S900). The method of claim 6,
Extracting an entire column query character in the query word extracted in step S200 (S300);
In the case where there is a string that violates a security policy in the entire column query character, the step of changing the entire column query character to column information of a corresponding table (S400) further includes important information through the query change. Security method. The method of claim 6 or 7, wherein the step S700,
Method for securing important information by changing the query, characterized in that to combine the query to change to a replacement string in consideration of the total length of the packet.

Images