KR20080098304A - Method for management of database access control and protection of database access account - Google Patents

Abstract

A method for managing database access control and a method for protecting database access account are provided to control access right to the database by the software use right. A database account information(41) of the object database at the repository domain of data authority management system is managed. An application software(30) supplies magnetic discrimination information to the repository domain of data authority management system. The data authority management system gives an authority to access the database, and produces an alternative mean(54) to the application software for authenticating whether the accessing permission is given or not. The application software can access the database by receiving the database account information.

Description

Method for management of database access control and protection of database access account}

The present invention relates to DB security for protecting the DB account and authorization management for database access authentication that security management is essential in database operation.

The present invention relates to a rights management system for database access authentication and a method for protecting a database account. A target database (Database, DB) for protecting an application S / W DB account has an application S / W DB account information with a data rights management system. The application S / W that wants to entrust the repository to the repository, and provides the information to identify itself to the repository of the data authority management system, and the alternative means (adapter) to check the data authorization of the target DB Issue the to the application software. In this way, the application S / W first accesses the data rights management system through an alternative means (adapter) to access the target DB, and then accesses the target DB through the validation of the alternative means (adapter) issued by the data rights management system. By receiving the application S / W DB account information that is information, the target DB can be accessed. As such, the application S / W can refer to the application S / W DB account information only through an alternative means (adapter) to control access to information outside the purpose of any unauthorized application S / W and at the same time in the data rights management system. The information audit log can be recorded by accessing the target DB through the process of verifying the authority, enabling information auditing of all application S / Ws accessing the target DB, and changing the password information of the target DB from time to time. It is about the authority management system and DB account protection method for database access authentication that can be greatly strengthened.

In general, a database is a set of information that is integrated and managed for the purpose of being shared and used by several people.

To build a database, create a volume to store information in a database base management system (DBMS), and create DB account information that applications S / Ws can access and use the created volume. DB account information is generally composed of ID and password like e-mail registration method. It is the only means of access to database and is essential for application S / W to utilize database.

Since password of DB account is the core of DB security, to protect from outside and insiders, most public institutions and private organizations require periodic change by authorized person in data security policy. There is no reality.

1 is a conceptual diagram for explaining the concept of the application S / W DB account information in the database utilization structure of the application S / W. As shown in FIG. 1, the application S / W requires a DB account to utilize the database and can be classified into an administrator account and an application S / W DB account. The administrator account is a single account used to manage the database. Managed by DB manager, user can be identified. However, the application S / W DB account is a group account in which a plurality of application S / Ws are accounts for utilizing database information and user identification is impossible. This application S / W DB account acts as a path for each application S / W to access the database and has unlimited authority in the corresponding work database.

2 is a conceptual diagram illustrating a situation in which various conventional application software individually manages DB account information to utilize a database.

As shown in the example of FIG. 2, the application S / W DB account for which security management is essential in database operation is shown to show the fact that it is exposed to a security threat in a defenseless state. As in the example, various current application S / Ws that utilize data are stored individually for themselves as application group S / W DB accounts (ID / Password), and DB account management is managed by S / W vendors and developers. As it is managed directly, it is continuously and repeatedly exposed in the application S / W maintenance process. Application S / W DB account information exposure as mentioned above represents a security threat of business information, and there is no management system at the enterprise or demand organization level to prevent exposure. To compare the current management system, it is a security management system where the door is left open and the thief does not want to be robbed.

Also, in terms of data security, password of DB account should be changed periodically, but most application S / W stores and manages DB account information in a separate and non-standard way. Even if the user wants to change the password, it can cause service interruption such as information system and inter-organizational information linkage.

3A and 3B and 3C are conceptual views for explaining a vulnerability of the conventional database utilization structure.

As shown in FIG. 3A, whether or not to secure data integrity of a logical database that logically operates several tasks in one physical database management system (DBMS) is a matter of security management of an application S / W DB account (ID / Password). As shown in FIG. 3A, the WAS (WEB Application Server, WAS), which is a common application S / W, and the DB Tool for database management and operation are all stored together to manage individual work accounts, thereby deepening the DB account exposure. . In addition, if the DB administrator is different for each task, there is a problem of sharing and using a single account, the administrator account, so it is easy to access information out of purpose in the database maintenance process.

As shown in FIG. 3B, application S / Ws of a JAVA environment can easily access information out of purpose. Middleware such as WAS (WEB Application Server) is software that allows applications to exchange data with each other through middleware without directly connecting to a database. WAS uses the DB Connection Pool to connect to the database. The DB Connection Pool connects to the database in advance to reduce the overhead created when connecting to the database, and allocates a connection when a connection request to the database comes in. It is made of returning structure. Application S / W of JAVA environment using DB connection pool can access database easily by using DB connection pool of middleware (WAS) regardless of granting access to database even if DB account information is not recognized. This makes it possible to neutralize data rights policies. Also, if the application software such as middleware (WAS) is different from the development company in terms of DBMS, the current user rights policy and DBMS that cannot recognize the application software and do not have a linkage system with middleware and DB for managing application usage rights It is not possible to manage effective data information audit log information only by the data rights policy of the dimension.

As illustrated in FIG. 3C, information audit log information at the DB level is essential for monitoring and proving illegal activities such as information leakage, misuse, misuse, and forgery, etc. of external and internal intruders. Since individual IDs are not recognized, only application S / W DB accounts, which are collective accounts, are not aware of who actually does what.

In order to solve this problem, technology for DB account information protection and database access control of application S / W is required, but there are none. As technology for database information security, access control (IDS On Database) and Although there are data security technologies such as database field encryption, database security threats such as DB account protection and any application software control and management technology are lacking.

As such, external database security technologies such as access control and data field encryption have become mainstream in the database security market, but security threats caused by application S / W database utilization structures cannot be solved.

Accordingly, the present invention has been proposed to solve the conventional problems as described above, the object of the present invention is to protect the DB account information that is essential in operating the database and the right to access the database according to the authority of various application software using the database It is to provide the authority management system and DB account protection method for database access authentication so that it can be controlled.

Authorization management system and DB account protection method for database access authentication according to an embodiment of the present invention for achieving the above object,

A first step of consigning and managing DB account information of a target DB to protect DB account information in a repository area of a data rights management system; After the first step, the application S / W that wants to utilize the target DB includes: a second step of providing self-identifying information to the repository of the data rights management system; After the second step, the data authority management system grants DB account information authority to access the target DB with the self-identification information provided by the application S / W, and authorizes data authority to authenticate whether the target DB has the data authority. A third step of issuing an alternative means (adapter) to the application S / W to access the management system; After the third step, the application S / W first accesses the data rights management system through the replacement means (adapter) issued by the data rights management system, and then checks the validity of the replacement means. A fifth step of recording the information audit log information of all the application S / Ws connected to the data authority management system after the fourth step and the fourth step to access the target DB by receiving the account information; Performance is characterized by its technical construction.

Hereinafter, an embodiment according to the technical concept of the present invention, a method for establishing a data rights management system for DB access information protection and application S / W database access authentication will be described with reference to the accompanying drawings. In the following description of the present invention, detailed descriptions of well-known functions or configurations will be omitted if it is determined that the detailed description of the present invention may unnecessarily obscure the subject matter of the present invention. In addition, terms to be described below are terms defined in consideration of functions in the present invention, which may vary according to intention or precedent of a user or an operator, and thus, the meaning of each term should be interpreted based on the contents throughout the present specification. will be.

4 is a conceptual diagram of a method for establishing a data rights management system for DB account information protection and application S / W database access authentication according to an embodiment of the present invention.

As shown therein, the application S / W that wants to utilize the target DB 40 provides information to identify itself in the repository area of the data rights management system 50, and is issued by the data rights management system. Database access means (10 to 30) for accessing the information of the replacement means to the target DB (40) through the replacement means (adapter) 54; Data authority management system area 50 for entrusting and managing DB account information of the target DB 40 and issuing an alternative means (adapter) to access the target DB 40 from the database access means 10 to 30. )and; When connected with the data rights management system area 50 receives DB account information, the database access means (10 to 30) is connected to the repository of the data rights management system using the alternate means (adapter) 54 It is characterized in that it comprises a; target DB (40) to receive the DB account information that is the access authority information of the target DB (40) to utilize the information.

Therefore, the database access means 10 to 30 that entrusts the DB account information 41 of the target DB 40 to the repository 51 area of the data authority management system 50 and utilizes the target DB 40 self. The identification information may be provided to the repository 51 of the data rights management system 50, and the DB 51 may refer to the DB account information 41 of the target DB in the repository 51 by confirming whether the self-identification information is authorized. Alternative means (adapters) for issuing; A method of receiving the DB account information 41 of the target DB 40 from the data rights management system 50 through an alternative means (adapter) 54 communicating with the data rights management system 50; And a method of allowing or disallowing access to the target DB 40 through an alternative means (adapter) 54 communicating with the data rights management system area.

The data authority management system 50 manages the DB account information of the target DB 40, the identification information of the application S / W, and the information for issuing an alternative means (adapter), and the information audit log approaching the target DB 40. A repository 51 for storing data; A management unit 52 for managing DB account password change of the target DB 40 and having a management tool for monitoring an audit log; The database access means (10 to 30); characterized in that comprises a.

The self-identification information of the database access means (10 to 30), the electronic signature DN information of the person in charge of the application S / W startup and management, IP, CPU NO, MAC address, application of the system installed the application S / W It is characterized in that it comprises one or more information from the version of the software, license information. Self-identification information of the database access means (10 ~ 30) is required for issuing an alternative means (adapter) as the basic data for the application S / W authentication in the data rights management system.

The database access means (10 to 30), characterized in that it comprises one or more of the application 10, the middleware 20, DB Tool or Reporting Tool, the application S / W (30) including the EAI solution.

The replacement means (adapter) 54 is a communication means between the repository 51 of the data authority management system and the application S / W, and the self-identification information of the application S / W 10 to 30 is applied to the application S / W startup and the like. The data authority management system including the digital signature certificate DN of the person in charge of management and one or more information among the IP, CPU NO, MAC address and version, and license information of the system where the application S / W (10 to 30) is installed ( If provided to the repository of 50), the data authority management system 50 checks the validity of the alternative means issued by the self-identification information provided by the first application S / W, and then the DB account information of the target DB 40 ( 41) for reference.

5 is a flowchart illustrating an application S / W authentication number issuing procedure and a management method according to an embodiment of the present invention.

Therefore, in order for the application S / W to receive the access authority authentication of the target DB 40, the application S / W representative can identify his digital signature certificate information and the application S / W, that is, the application S / W is installed. By providing IP, version, license information of target system and target DB information to be used by offline or e-mail to the relevant DB manager, the application S / W makes a request for issuing an alternative means (adapter). Registers the information provided through the data rights management system management unit 52 in the repository of the data rights management system and issues an application S / W alternative means (adapter). (ST2, ST3) Request the approval from the general manager in order to access the repository of the management system. (ST4) The general manager of the data authority management system issues information on application S / W alternatives (adapter) and digital signature DN information of the application S / W manager. Store access information Register in one authentication realm and approve application S / W to access the repository of data authority management system. (ST5, ST6) Once the approval is completed, the relevant DB manager sends the application S / W developer to offline or E-mail. (ST7) The application S / W can communicate with the data rights management system in the data connection area so that it can first access the data rights management system to obtain DB account information for database access. Any alternative means (adapters) issued must be included in the connection with the data rights management system.

6 is a flowchart showing an example of a method of accessing the target DB 40 through the application S / W authentication in the data rights management system in the DB account information protection and application S / W database access authentication method according to an embodiment of the present invention. .

As shown in the figure, when the person in charge starts the application S / W to connect the application S / W to the target DB 40, the alternate means (adapter) issued by the data authority management system through the electronic signature of the person in charge issuing information. Is encrypted with the digital signature information of the application S / W officer and transmitted to the alternate means (adapter) (ST11, ST12), the adapter is delivered to the server communication area of the repository (ST13). (ST14) Verify the validity of issuance and authorization by extracting the decrypted alternative means issued information and the DN information of the digital signature certificate. (ST15) When the validation is verified, con_key is issued from the repository. In this case, the con_key is issued, and the application S / W is authorized to access the repository. The alternative means of the client (adapter) is to connect to the repository with con_key (ST17, ST18) .If the con_key matches, the authority (ID / Password) to access the repository in the authorization authentication area is transferred to the server communication area. Make a connection (ST19 to ST21). The application S / W can receive repository access information that can request DB account information of the target DB 40 from the repository. (ST22) At this time, the application S / W that has accessed the target DB in the repository area of the data rights management system. W After self-identification information is recorded for information auditing, the DB account information of the target DB can be transferred to an alternative means (adapter) and connected to the target DB. (ST23, ST24) At this time, the application S / W can request an arbitrary query. In case of DB Tool and Reporting Tool, it is possible to control whether DDL is included in Query statement in DDL control information for Query statement requested by application software (ST26, ST28). In addition, the Query statement requested by the application S / W is stored in the repository as an information audit log so that the security manager can monitor it. (ST29) Therefore, when there is no abnormality in the DDL control information, the Query information is sent to the target DB. (ST30)

As described above, the method of establishing a data rights management system for DB account information protection and application S / W authentication according to the present invention can control any application S / W, and all access and management accounts of the database are all applications. It can be concealed from software, developers, and insiders.

In addition, the password of the administrative account (Database Administrator, DBA) including the application S / W DB account has the advantage that can be managed at any time without being affected by the application S / W.

Furthermore, application S / Ws for efficient use and management of database can be controlled to be used only for products that have been previously authorized and certified, and information audit logs can be managed.

Although the above is limited to the preferred embodiment of the present invention, the present invention is not limited thereto, and various changes, modifications, and equivalents may be used. Therefore, the present invention can be applied by appropriately modifying the above embodiments, it will be natural that such applications also fall within the scope of the present invention based on the technical idea described in the claims.

Middleware such as WAS (WEB Application Server) is software that allows applications to exchange data with each other through middleware without directly connecting to a database. WAS uses the DB Connection Pool to connect to the database. The DB Connection Pool connects to the database in advance to reduce the overhead created when connecting to the database, and allocates a connection when a connection request to the database comes in. It is made of returning structure. Application S / W of JAVA environment using DB connection pool can access database easily by using DB connection pool of middleware (WAS) regardless of granting access to database even if DB account information is not recognized. This makes it possible to neutralize data rights policies. Also, if the application software such as middleware (WAS) is different from the development company in terms of DBMS, the current user rights policy and DBMS that cannot recognize the application software and do not have a linkage system with middleware and DB for managing application usage rights It is not possible to manage effective data information audit log information only by the data rights policy of the dimension.

In order to monitor and prove illegal acts such as information leakage, misuse, misuse, forgery, and forgery of external and internal intruders, information audit log information at the DB level is essential. Since only the application S / W DB account, which is a group account, is not recognized, it does not recognize who is actually doing what.

1 is a conceptual diagram illustrating a concept of application S / W DB account information in a database application structure of a conventional application S / W.

2 is a conceptual diagram showing that the application S / W DB account information is individually managed to utilize the database in the conventional application S / W.

3A, 3B, and 3C are conceptual views illustrating a vulnerability of a conventional database utilization structure.

4 is a conceptual diagram of a method for establishing a data rights management system for DB account information protection and application S / W authentication according to an embodiment of the present invention.

5 is a flowchart illustrating a procedure for issuing and managing alternative means to an application S / W according to an embodiment of the present invention.

6 is a flowchart showing an example of DB account information protection and application S / W control through application S / W authentication in a data rights management system in the DB account information protection and application S / W authentication method according to an embodiment of the present invention. .

<Explanation of symbols for main parts of the drawings>

10: application

20: Middleware (WAS, Tp Monitor, etc.)

30: Application S / W (EAI Solution, DB Tool, Reporting Tool, etc.)

40: Target DB

41: DB account information

50: Authorization authentication area

51: repository

52: management

53: provide self-identification information

54: alternative means (adapter)

Claims (3)

A first step of consigning and managing DB account information of the target DB in the repository area of the data rights management system; An application S / W which intends to utilize the target DB after the first step comprises: providing a self-identification information to a repository area of a data rights management system; After the second step, the data authority management system grants DB account information authority to access the target DB with the self-identification information provided by the application S / W, and authorizes data authority to authenticate whether the target DB has the data authority. A third step of issuing an alternative means (adapter) to the application S / W to access the management system; After the third step, after the third step, the application S / W first accesses the data right management system through the replacement means (adapter) issued by the data right management system, and then checks the validity of the alternative means. A fourth step of accessing the target DB by receiving the DB account information which is the access information of the; And a fifth step of recording Audit Log information accessing the data rights management system in the repository area after the fourth step. The data rights for DB account information protection and database access authentication of the application S / W. How to build a management system. The method according to claim 1, In the second step, the magnetic identification information of the application S / W, From the certificate DN information of the application S / W manager responsible for starting and managing the application S / W and the IP, CPU NO, MAC address of the system where the application S / W is installed, the version of the application S / W, license information, and creation date. Method of establishing a data rights management system for DB account information protection and application S / W database access authentication, characterized in that it comprises one or more information. The method according to claim 1, The alternative means (adapter) issued by the data rights management system in the third step, Providing self-identification information of the application S / W to the data rights management system to refer to the account information of the protected DB and allowing the data rights management system to refer to the account information of the target DB after checking the authority. Method of establishing a data rights management system for DB account information protection and database access authentication of application S / W.

Images