WO2022211233A1

WO2022211233A1 - Abstract database management device and method based on virtual account and access control model

Info

Publication number: WO2022211233A1
Application number: PCT/KR2022/000812
Authority: WO
Inventors: 주형준; 문종섭; 김종호; 전승호; 유학제
Original assignee: 고려대학교 산학협력단
Priority date: 2021-04-01
Filing date: 2022-01-17
Publication date: 2022-10-06
Also published as: KR20220136805A; KR102486018B1

Abstract

Disclosed are an abstract database management device and method based on a virtual account and an access control model. The abstract database management method based on a virtual account and an access control model according to an embodiment of the present invention may comprise the steps of: generating, on the basis of actual account information of a target DB, virtual account information that is mapped to the actual account information; receiving a connection request for the target DB from a client terminal; determining whether actual account information mapped to a virtual account included in the connection request is present; and relaying the connection of the client terminal to the target DB on the basis of the actual account information according to the determination result.

Description

Device and method for abstract database management based on virtual account and access control model

The present application relates to an abstract database management apparatus and method based on a virtual account and access control model. For example, we provide a technique for preemptively controlling client access when a client performs an operation that violates the security policy through the security policy of a medical database management system (DBMS) using a virtual account. it's about

The principle of network communication is based on ‘The Basic Reference Model for Open Systems Interconnection’ specified in ISO/IEC 7498-1:1994, and the simplified TCP/IP stack is popularly used. Here, the TCP/IP stack consists of a total of five layers, including the physical, data link, network, transport, and application layers. There is a protocol designed for this purpose, and a software developer has the characteristic of being able to design and implement a protocol for using the function of the corresponding software at the application layer level.

In this regard, a proxy and a firewall are representative methods for monitoring and protecting network communication, and a proxy and a firewall corresponding to each layer of the TCP/IP stack exist. Specifically, a proxy is located between two or more participants with network functions and plays a role of relaying each other's communication. In the client-server communication model using such a proxy, the user (client) communicates with the server through the proxy , the proxy can check the communication contents.

In addition, a firewall is a network device or software that allows the application of an organization's security policy to network communications based on its proxy function. If it causes damage or violates the policy, the session can be forcibly blocked.

In general, a proxy or firewall has a problem in that it is difficult to apply a security policy specific to a specific application or service because it monitors and controls all communication occurring in the organization regardless of the application running on the server.

On the other hand, medical data has been operated in a physically and logically limited environment because it contains sensitive information related to personal privacy, such as patient personal information. Attempts to analyze for secondary purposes such as research are continuing.

In the case of the conventional medical data analysis technique, from a technical point of view, a user has many restrictions on data utilization, such as geographically/physically accessing a database within a medical center or allowing only remote access in a strictly limited network environment. In order to improve this environment and actively utilize medical data, the format of medical data was standardized from mid-2010, and database access tools and analysis programs were actively developed based on this, but these programs are mainly Java Database Connectivity (JDBC). ) or Open Database Connectivity (ODBC) to access the database and read and analyze medical data. The user must know the database information in advance, and the database information can be exposed through an appropriate query, which is undesirable in terms of security.

Accordingly, in order to analyze and utilize medical data, it is required to develop a security measure that is specialized for a medical database and can monitor and control communication between a user and the database.

The technology that is the background of the present application is disclosed in Korean Patent Publication No. 10-0916668.

The present application is to solve the problems of the prior art described above, and between a client and a database management system (DBMS) of the target DB, by utilizing a virtual account that is mapped to the real account of the target DB, the client's access is preemptively It aims to provide an abstract database management device and method based on a virtual account and access control model that supports security policies managed by

However, the technical problems to be achieved by the embodiments of the present application are not limited to the technical problems as described above, and other technical problems may exist.

As a technical means for achieving the above technical problem, the abstract database management method based on a virtual account and access control model according to an embodiment of the present application is a virtual account mapped with the real account information based on the real account information of the target DB. Generating account information, receiving an access request to the target DB from a client terminal, determining whether the real account information mapped to a virtual account included in the access request exists, and the determination result Accordingly, the method may include relaying the access to the target DB of the client terminal based on the actual account information.

In addition, the relaying may include replacing the virtual account with a real account according to the real account information and transferring it to the target DB, receiving identification information for user authentication from the target DB, and the received identification converting information into virtual identification information and transmitting the virtual identification information to the client terminal; receiving a password input request including the virtual account, a virtual password corresponding to the virtual account, and the virtual identification information from the client terminal receiving, when the virtual account and the virtual password included in the password input request correspond to the virtual account information, and the virtual identification information included in the password input request corresponds to the identification information, the real account information and transmitting an authentication request including the identification information to the target DB, receiving an authentication processing result according to the authentication request from the target DB, and transmitting the authentication processing result to the client terminal have.

In addition, the virtual account information may be exposed to the user of the client terminal, but direct access to the target DB based on the virtual account information may not be possible.

In addition, the generating may include generating the virtual account information by converting the real account information into a random number processing method to prevent deriving the real account information from the generated virtual account information.

Also, when a preset validity period elapses after the generating step, the mapping of the virtual account information to the real account information may be released.

In addition, the abstract database management method based on a virtual account and access control model according to an embodiment of the present application, after the relaying, receiving a query associated with the target DB from the client terminal, the access request The method may include determining whether or not the user has authority to perform processing on the target DB according to the query of the included virtual account, and selectively performing the processing based on whether the user has the authority.

In addition, the step of determining whether the authority is possessed may include determining whether the user role granted to the virtual account included in the access request among a plurality of user roles preset in connection with the target DB includes the authority. can

In addition, the abstract database management method based on a virtual account and access control model according to an embodiment of the present application includes the steps of receiving a session termination request for the target DB from the client terminal and transmitting the session termination request to the target DB and terminating the session associated with the client terminal.

Also, the target DB may be a DB for storing medical data.

Meanwhile, the apparatus for managing an abstract database based on a virtual account and access control model according to an embodiment of the present application includes a mapping unit that generates virtual account information mapped with the real account information based on real account information of a target DB, a client terminal a client identification unit that receives an access request to the target DB from It may include an access relay unit for relaying the connection to the target DB of the client terminal.

In addition, the access relay unit replaces the virtual account with a real account according to the real account information and transmits it to the target DB, receives identification information for user authentication from the target DB, and converts the received identification information into a virtual Identification information processing unit converting into identification information and transmitting the virtual identification information to the client terminal, receiving a password input request including the virtual account, a virtual password corresponding to the virtual account, and the virtual identification information from the client terminal and a password analysis unit to analyze whether the virtual account and the virtual password included in the password input request correspond to the virtual account information, and whether the virtual identification information included in the password input request corresponds to the identification information and transmitting an authentication request including the real account information and the identification information to the target DB based on the analysis result, receiving an authentication processing result according to the authentication request from the target DB, and receiving the authentication processing result from the target DB It may include an authentication processing unit for transmitting to the client terminal.

Also, the mapping unit may generate the virtual account information by converting the real account information into a random number processing method to prevent deriving the real account information from the generated virtual account information.

Also, the mapping unit may release the mapping of the virtual account information to the real account information when a preset validity period elapses after the virtual account information is generated.

In addition, the apparatus for managing an abstract database based on a virtual account and access control model according to an embodiment of the present application receives a query associated with the target DB from the client terminal, and responds to the query of the virtual account included in the access request. and a query processing unit that determines whether or not the user has authority to perform processing on the target DB, and selectively performs the processing on the basis of whether or not the authority is possessed.

In addition, the virtual account and access control model-based abstract database management apparatus according to an embodiment of the present application receives a session termination request for the target DB from the client terminal, and transmits the session termination request to the target DB, , it may include a session terminating unit for terminating the session associated with the client terminal.

The above-described problem solving means are merely exemplary, and should not be construed as limiting the present application. In addition to the exemplary embodiments described above, additional embodiments may exist in the drawings and detailed description.

According to the above-described problem solving means of the present application, between the client and the database management system (DBMS) of the target DB, by using a virtual account that is mapped to the real account of the target DB, the security to preemptively manage the access of the client It is possible to provide an abstract database management device and method based on a virtual account and access control model supporting policy.

According to the above-described problem solving means of the present application, it is possible to easily apply a security policy specific to an application related to medical data.

According to the above-described problem solving means of the present application, even if a malicious attacker accesses a target DB such as a medical database through a network, it is possible to effectively prevent the attacker from using the function of the target DB because the attacker has only a virtual account in which the real account is replaced. have.

According to the above-described problem solving means of the present application, the target DB-related processing is selectively performed according to the query written by the client through a virtual account and role-based access control (RBAC), or data in the target DB is selectively performed. By providing an efficient way to control the client.

According to the above-described problem solving means of the present application, it is possible to provide a strict security policy for the client by unmapping the virtual account exposed to the user with the real account according to the expiration of the validity period.

However, the effects obtainable herein are not limited to the above-described effects, and other effects may exist.

1 is a schematic configuration diagram of a database management system based on a virtual account and access control model according to an embodiment of the present application.

2 is a conceptual diagram illustrating a mapping between real account information and virtual account information.

3 is a diagram exemplarily illustrating an interface for creating/registering real account information and virtual account information mapped thereto.

4 is a conceptual diagram for explaining an access control model for selectively performing target DB processing according to a query.

5 is a diagram illustrating a query type according to a user role and corresponding authority based on an access control model.

6 is a diagram exemplarily showing an interface that provides an integrated security policy associated with a database management system based on a virtual account and an access control model according to an embodiment of the present application.

7 is a schematic configuration diagram of an abstract database management apparatus based on a virtual account and access control model according to an embodiment of the present application.

8 is a detailed configuration diagram of an access relay unit of an abstract database management apparatus based on a virtual account and access control model according to an embodiment of the present application.

9 is an operation flowchart of an abstract database management method based on a virtual account and access control model according to an embodiment of the present application.

10 is a detailed operation flowchart of a process of relaying access to a target DB of a client terminal based on virtual account information and real account information.

Hereinafter, embodiments of the present application will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art to which the present application pertains can easily implement them. However, the present application may be implemented in several different forms and is not limited to the embodiments described herein. And in order to clearly explain the present application in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

Throughout this specification, when a part is said to be “connected” to another part, it is not only “directly connected” but also “electrically connected” or “indirectly connected” with another element interposed therebetween. "Including cases where

Throughout this specification, when it is said that a member is positioned "on", "on", "on", "under", "under", or "under" another member, this means that a member is located on the other member. It includes not only the case where they are in contact, but also the case where another member exists between two members.

Throughout this specification, when a part "includes" a component, it means that other components may be further included, rather than excluding other components, unless otherwise stated.

The present application relates to an abstract database management apparatus and method based on a virtual account and access control model.

1, the virtual account and access control model-based database management system 10 according to an embodiment of the present application, the virtual account and access control model-based abstract database management apparatus 100 according to an embodiment of the present application (hereinafter referred to as 'abstract database management apparatus 100'), the client terminal 200 and the target DB 300 may be included.

The abstract database management apparatus 100, the client terminal 200, and the target DB 300 may communicate with each other through a network (not shown). A network (not shown) refers to a connection structure capable of exchanging information between each node, such as terminals and servers, and an example of such a network (not shown) includes a 3rd Generation Partnership Project (3GPP) network, LTE (Long Term Evolution) network, 5G network, WIMAX (World Interoperability for Microwave Access) network, Internet, LAN (Local Area Network), Wireless LAN (Wireless Local Area Network), WAN (Wide Area Network), PAN ( Personal Area Network), wifi network, Bluetooth (Bluetooth) network, satellite broadcasting network, analog broadcasting network, DMB (Digital Multimedia Broadcasting) network, and the like are included, but are not limited thereto. Also, for example, the network (not shown) may refer to a distributed research network based on a Common Data Model (CDM) utilizing a plurality of databases including the target DB 300 .

The client terminal 200 is, for example, a smart phone, a smart pad, a tablet PC, and the like and a PCS (Personal Communication System), GSM (Global System for Mobile communication), PDC (Personal Digital Cellular), PHS ( Personal Handyphone System), PDA (Personal Digital Assistant), IMT (International Mobile Telecommunication)-2000, CDMA (Code Division Multiple Access)-2000, W-CDMA (W-Code Division Multiple Access), Wibro (Wireless Broadband Internet) terminals The same may be any type of wireless communication device.

In addition, in the description of the embodiment of the present application, the target DB 300 is a database that the user of the client terminal 200 wants to access, and the client terminal 200 does not directly connect to the target DB 300 , but in the present application. It is possible to access the target DB 300 through the relay of the disclosed abstract database management device 100 .

According to an embodiment of the present application, the target DB 300 may be a DB for storing medical data, but is not limited thereto, and according to the embodiment of the present application, the target DB 300 is a financial institution, administrative institution, education It may refer broadly to various databases for storing information related to the relevant institution or corporation in connection with various institutions or corporations, such as institutions. Hereinafter, for convenience of explanation, the target DB 300 is provided for various medical institutions such as university hospitals, hospitals and public health centers, and various medical data (patient information, surgery/procedure information, medicine data, clinical data, image data) in the medical institution. etc.) to be described as a medical database provided to store / manage the embodiment of the present application. For example, the target DB 300 , which is a medical database, may be linked to a Common Data Model (CDM) in which terms/structures are standardized for domestic or international joint research in the medical field.

On the other hand, in the description of the embodiment of the present application, the abstract database management apparatus 100 transmits and receives various types of information (data) to and from the target DB 300 or requests processing corresponding to a client's query and receives the processing result is It may mean specifically a process performed with respect to a database management system (DBMS) of the target DB 300 .

In addition, referring to Figure 1, the abstract database management apparatus 100 is provided to integrally relay a plurality of client terminals (200a, ..., 200n) and a plurality of target DBs (300a, ..., 300n) it could be In other words, the abstract database management apparatus 100 may relay the connection/processing of at least one client terminal 200 of the plurality of client terminals 200a, ..., 200n to the target DB 300, etc., Furthermore, the connection/processing of at least one target DB 300 among a plurality of target DBs 300a, ..., 300n of the specific client terminal 200 may be relayed.

Referring to FIG. 2 , the abstract database management apparatus 100 may generate virtual account information mapped with the real account information of the target DB 300 based on the real account information of the target DB 300 .

Also, referring to FIG. 2 , the abstract database management apparatus 100 may determine (define) a user role for the mapped virtual account information based on the real account information of the target DB 300 . For example, the virtual account information may be determined to correspond to a user role previously assigned to the real account information mapped with the corresponding virtual account information.

In other words, the mapped virtual account information and the real account information may share a user role related to a query in the target DB 300 and processing corresponding to the query. However, the present invention is not limited thereto, and according to an embodiment of the present application, if necessary, a user role granted to virtual account information and a user role given to real account information may be determined to be different from each other.

Meanwhile, mapping of virtual account information to real account information may be performed in a one-to-one or one-to-many relationship if necessary. For example, referring to FIG. 2 , virtual account information for two different virtual accounts, a first virtual account (Fake 1) and a second virtual account (Fake 2), is the same real account, a first real account (Real 1). ) may be generated from actual account information.

Also, according to an embodiment of the present application, the abstract database management apparatus 100 may map virtual account information to real account information of each of a plurality of target DBs 300a, ..., 300n. For example, the abstract database management apparatus 100 may individually map a plurality of virtual account information corresponding to real account information of each of a plurality of target DBs 300a, ..., 300n. As another example, the abstract database management apparatus 100 integrates a single virtual account information corresponding to the real account information of at least two target DBs 300 among a plurality of target DBs 300a, ..., 300n. it could be

Referring to FIG. 3 , the abstract database management device 100 provides an account registration interface for creating/registering real account information of the target DB 300 and virtual account information mapped to the corresponding real account information for a user (administrator). can do.

More specifically, the user (administrator) through the real account registration area (A in FIG. 3) of the account registration interface provided by the abstract database management device 100 provides a real account (Real User), a real account password (Real Password), The real account information of the target DB 300 including the real database, real host, and real port is directly entered through user input or received from the DBMS of the target DB 300. can register.

In addition, the user (administrator) through the virtual account registration area (B of FIG. 3) of the account registration interface provided by the abstract database management device 100 is a virtual account (Fake User), virtual account password (Fake Password), virtual database Virtual account information including (Fake Database), a virtual host (Fake Host), and a virtual port (Fake Port) may be generated by replacing the real account information.

The virtual account information disclosed herein is exposed to the user of the client terminal 200, but direct access to the target DB 300 based on the exposed virtual account information may be generated by substitution from the real account information.

In this regard, according to an embodiment of the present application, the abstract database management apparatus 100 prevents deriving the mapped real account information from the virtual account information provided (exposed) to the user of the client terminal 200 to prevent real account information. may be converted to a random number processing method to generate virtual account information, but is not limited thereto.

Meanwhile, according to an exemplary embodiment of the present disclosure, when a preset validity period elapses after the virtual account information is generated, the mapping of the virtual account information to the real account information may be released. In other words, the abstract database management apparatus 100 is effective corresponding to the virtual account information so that the virtual account information can be used in the access process to the target DB 300 only during a preset validity period after the virtual account information is generated by being replaced from the real account information. You can set the period.

According to an embodiment of the present application, the abstract database management apparatus 100 determines the validity period associated with the virtual account information that is created based on the type of user role previously given to the real account information used to generate the virtual account information. It may be setting For example, referring to FIG. 2 , the 'Role_admin' user role including various processing rights for the target DB 300 is relatively substituted from real account information (eg, Real 2 in FIG. 2 ). The validity period for the generated virtual account information is replaced from real account information (eg, Real 1 in FIG. 2 ) to which the 'Role_guest' user role including relatively limited processing rights for the target DB 300 is granted. It may be set longer than the validity period for the generated virtual account information. However, the present invention is not limited thereto, and the validity period for each virtual account may be individually set for each virtual account based on a user (administrator) input authorized to the abstract database management apparatus 100 according to an embodiment of the present application.

In addition, according to an embodiment of the present application, the virtual account information may be stored in the in-memory of the client terminal 200 or the abstract database management apparatus 100 . In this regard, the in-memory database performs a function in which information is maintained only in the memory of the device and not in the disk of the device, and when a program using the in-memory database ends, all information in the in-memory database is automatically deleted.

Therefore, in the abstract database management apparatus 100 disclosed herein, virtual account information for relaying the one-time connection to the target DB 300 of the client terminal 200 exists only in the memory space of the program, so that other programs access it. It can be implemented to efficiently manage virtual accounts by making it impossible to inquire information. As such, there is no need to leave the virtual account information in the device (eg, the client terminal 200, etc.) in a form that is permanently stored such as a file as data used temporarily.

For reference, for the user of the client terminal 200 in the present application, as well as specific contents of real account information corresponding to the virtual account information, the virtual account used by the user of the client terminal 200 to access the target DB 300 . The fact that the information is about a virtual account substituted from the real account information of the target DB 300 may not be recognized. In other words, the existence of the abstract database management apparatus 100 itself may not be recognized by the user of the client terminal 200 .

The abstract database management apparatus 100 may receive a request for access to the target DB 300 from the client terminal 200 . Specifically, in the connection request (Startup Message) transmitted from the client terminal 200 to the abstract database management apparatus 100 , a virtual account (ID) and a scheme of a virtual database accessed by the user of the client terminal 200 (Fake Database) (Scheme) information may be included.

Also, the abstract database management apparatus 100 may determine whether real account information mapped to a virtual account included in the access request exists.

As a result of the determination, the abstract database management apparatus 100 may cancel communication with the client terminal 200 when it is determined that the mapping real account information does not exist in the virtual account included in the access request.

Conversely, if it is determined that the real account information mapped to the virtual account included in the access request exists as a result of the determination of the abstract database management apparatus 100 , the abstract database management apparatus 100 provides the real account information mapped to the virtual account Based on the , access to the target DB 300 of the client terminal 200 may be relayed.

Hereinafter, a process (authentication sequence) in which the abstract database management apparatus 100 relays the connection to the target DB 300 of the client terminal 200 will be described in detail.

First, the abstract database management apparatus 100 may replace a virtual account (Fake User) included in an access request with a real account (Real User) according to real account information and deliver it to the target DB.

Also, the abstract database management apparatus 100 may receive identification information (real salt) for user authentication from the target DB 300 . For example, the identification information for user authentication may include a 4-byte salt, which is an encryption value for confirming (identifying) the user of the client terminal 200 .

In addition, the abstract database management apparatus 100 converts the identification information (real salt) received from the target DB (300) into virtual identification information (fake salt), and converts the converted virtual identification information (fake salt) to the client terminal ( 200) can be transmitted.

In addition, the abstract database management device 100, a virtual account (fake user) from the client terminal 200, a password input request including a virtual password (fake password) and virtual identification information (fake salt) corresponding to the virtual account (fake salt) ( password message). That is, the user of the client terminal 200 calculates a hash value (eg, MD5, SHA, etc.) using a virtual account (fake user, ID), a virtual password (fake password), and virtual identification information (fake salt). It can be delivered to the abstract database management device 100 .

In addition, the abstract database management device 100, the virtual account (fake user) and the virtual password (fake password) included in the password input request (password message) corresponds to the virtual account information, the password input request (password message) If the included virtual identification information (fake salt) corresponds to the identification information (real salt), an authentication request (password message) including the real account information mapped to the virtual account and the identification information (real salt) is sent to the target DB 300 ) can be transmitted.

Also, the abstract database management apparatus 100 receives an authentication processing result (authenticationOk) according to an authentication request (password message) from the target DB 300 , and transmits the received authentication processing result (authenticationOk) to the client terminal 200 . can

When the client terminal 200 completes the connection relay process (authentication sequence) for the target DB 300 through the above-described process, the user of the client terminal 200 can manage the abstract database of the target DB 300 ( 100 ) As a state in which login is normally successful under the relay of

The abstract database management apparatus 100 may receive a query associated with the target DB 300 from the client terminal 200 .

In addition, the abstract database management apparatus 100 processes the target DB 300 according to the query of the virtual account (in other words, the virtual account used in the authentication sequence for access to the target DB 300) included in the access request. You can determine whether you have the authority to perform

Specifically, the abstract database management apparatus 100 determines whether the user role granted to the virtual account included in the access request among a plurality of user roles preset in connection with the target DB 300 includes the authority according to the received query. can be judged

Referring to FIG. 4 , the abstract database management apparatus 100 assigns a user role to each account through the above-described RBAC access model, and the processing that the user can perform for the target DB 300 and the processing. A right associated with the type of a corresponding query may be set based on a user role granted for each account.

As such, the abstract database management device 100 disclosed herein defines the rights for each user role, utilizes the virtual account information, and interlocks the user roles and rights of the real account information to manage the user roles and rights of the virtual account information. By making the decision, it is possible to eliminate the hassle of newly granting a corresponding user authority whenever a user newly accesses the target DB 300 .

More specifically, referring to FIG. 4 , among the plurality of user roles, 'System admin' has all of the system file editing rights, network access rights, user file editing rights, and /foo /bar file reading rights, whereas , among the plurality of user roles, the 'student' may selectively have only the network access right and the /foo /bar file read right. However, the present invention is not limited thereto, and various user roles and corresponding rights may be defined according to an embodiment of the present application. On the other hand, according to an embodiment of the present application, the user role is implemented to be customizable by a user (administrator) according to the type of the target DB 300 , and the administrator role (role_admin) and the guest role (role_guest) are basically configurable options may be provided as

5 is a diagram illustrating query types according to user roles and corresponding privileges based on an access control model.

Referring to FIG. 5 , the query type that can be provided by the user may be set differently according to the authority determined based on the user role, and as such a query type, a table/view associated with the data structure in the target DB 300 . Various query types related to permissions such as create/modify/delete/search/change for /index/parameter, etc. can be considered. In other words, the query type (type) may be variously determined according to the purpose of the software platform to which the abstract database management apparatus 100 is applied.

More specifically, for example, in relation to the processing of the target DB 300 through the account corresponding to the guest role (role_guest), creation/deletion/update of the table through the corresponding account (virtual account) is impossible, but the selection of the table The permission may be determined to enable /insert, but is not limited thereto.

In addition, the abstract database management apparatus 100 selectively performs processing on the target DB 300 corresponding to the received query based on whether the virtual account has authority, and returns the processing result for the target DB 300 to the client. may be returned to the terminal 200 .

Also, the abstract database management apparatus 100 may receive a session termination request for the target DB 300 from the client terminal 200 . Also, the abstract database management apparatus 100 may transmit a session termination request to the target DB 300 and terminate the session to the target DB 300 associated with the client terminal 200 .

In other words, the user of the client terminal 200 performs one or more queries (SQL queries) through one session, and after executing all queries (SQL queries), makes a session termination request to the abstract database management device 100 ( terminate message).

Referring to FIG. 6 , the abstract database management device 100 provides real account information (B of FIG. 6 ), virtual account information (C of FIG. 6 ), and user roles for each account through the integrated security policy management interface shown in FIG. 6 . A list of policy information including (A of FIG. 6 ) and authority (D of FIG. 6 ) may be displayed to the user (administrator). In particular, in relation to the list of policy information, the user (administrator) of the abstract database management device 100 determines the type of query (SQL query) that can be used according to the real account and role mapped to the virtual account through the security policy integrated management interface. can be viewed.

Referring to FIG. 7 , the abstract database management apparatus 100 may include a mapping unit 110 , a client identification unit 120 , a connection relay unit 130 , a query processing unit 140 , and a session termination unit 150 . can

The mapping unit 110 may generate virtual account information mapped with the real account information based on the real account information of the target DB 300 .

The client identification unit 120 may receive an access request for the target DB 300 from the client terminal 200 and determine whether real account information mapped to a virtual account included in the access request exists.

The access relay unit 130 may relay the access to the target DB of the client terminal 200 based on the actual account information according to the determination result.

Referring to FIG. 8 , the access relay unit 130 may include an identification information processing unit 131 , an encryption analysis unit 132 , and an authentication processing unit 133 .

The identification information processing unit 131 may replace the virtual account included in the access request with a real account according to the mapped real account information and deliver it to the target DB 300 . Also, the identification information processing unit 131 may receive identification information for user authentication from the target DB 300 , convert the received identification information into virtual identification information, and transmit the received identification information to the client terminal 200 .

The password analysis unit 132 may receive a password input request including a virtual account, a virtual password corresponding to the virtual account, and virtual identification information from the client terminal 200 . In addition, the password analysis unit 132 analyzes whether the virtual account and the virtual password included in the password input request correspond to (match) the virtual account information, and whether the virtual identification information included in the password input request corresponds to the identification information. can

The authentication processing unit 133 may transmit an authentication request including real account information and identification information to the target DB 300 based on the analysis result of the password analysis unit 132 . Also, the authentication processing unit 133 may receive the authentication processing result according to the authentication request from the target DB 300 and transmit it to the client terminal 200 .

Whether the query processing unit 140 receives a query associated with the target DB 300 from the client terminal 200 and has authority to process the target DB 300 according to the query of the virtual account included in the access request can be judged Also, the query processing unit 140 may selectively perform processing on the target DB 300 according to the received query based on the determined authority.

The session termination unit 150 may receive a session termination request for the target DB 300 from the client terminal 200 , transmit it to the target DB 300 , and terminate the session associated with the client terminal 200 .

Referring to FIG. 9 , in step S11 , the mapping unit 110 may generate virtual account information mapped with the real account information based on the real account information of the target DB 300 .

Next, in step S12 , the client identification unit 120 may receive an access request (startup message; fake user, fake database) for the target DB 300 from the client terminal 200 .

Next, in step S13 , the client identification unit 120 may determine whether real account information mapped to a virtual account included in the access request exists.

Next, in step S14 , the access relay unit 130 may relay the connection to the target DB of the client terminal 200 based on the actual account information according to the determination result of step S13 .

Next, in step S15 , the query processing unit 140 may receive a query associated with the target DB 300 from the client terminal 200 .

Next, in step S16, the query processing unit 140 may determine whether or not the authority to process the target DB 300 according to the query of the virtual account included in the access request.

Specifically, in step S16, the query processing unit 140 determines whether the user role granted to the virtual account included in the access request among a plurality of user roles preset in connection with the target DB 300 includes the corresponding authority. can

Next, in step S17 , the query processing unit 140 may selectively perform processing on the target DB 300 according to the query based on whether or not the authority is determined in step S16 .

Next, in step S18 , the session termination unit 150 may receive a session termination request for the target DB 300 from the client terminal 200 .

Next, in step S19 , the session termination unit 150 may transmit the received session termination request to the target DB 300 and terminate the session associated with the client terminal 200 .

The process of relaying the connection to the target DB of the client terminal based on the virtual account information and the real account information shown in FIG. 10 may be performed by the abstract database management apparatus 100 described above. Accordingly, even if omitted below, the description of the abstract database management apparatus 100 may be equally applied to the description of FIG. 10 .

Referring to FIG. 10 , in step S141 , the identification information processing unit 131 may replace a virtual account with a real account according to real account information and deliver it to the target DB 300 (startup message; real user, real database).

Next, in step S142, the identification information processing unit 131 receives identification information (real salt) for user authentication from the target DB 300 .

Next, in step S143, the identification information processing unit 131 may convert the received identification information (real salt) into virtual identification information (fake salt).

Next, in step S144 , the identification information processing unit 131 may transmit the converted virtual identification information (fake salt) to the client terminal 200 .

Next, in step S145, the identification information processing unit 131 inputs a password including a virtual account (fake user), a virtual password corresponding to the virtual account, and virtual identification information (fake salt) from the client terminal 200 . You may receive a password message.

Next, in step S146, the password analysis unit 132 determines that the virtual account and virtual password included in the password input request (password message) correspond to (match) the virtual account information, and the virtual account included in the password input request (password message) When the identification information corresponds to the identification information, an authentication request (password message) including real account information and identification information (real salt) may be transmitted to the target DB 300 .

Next, in step S147 , the authentication processing unit 133 may receive an authentication processing result (authenticationOk) according to the authentication request from the target DB 300 .

Next, in step S148 , the authentication processing unit 133 may transmit the received authentication processing result (authenticationOk) to the client terminal 200 .

In the above description, steps S141 to S148 may be further divided into additional steps or combined into fewer steps, according to an embodiment of the present application. In addition, some steps may be omitted if necessary, and the order between the steps may be changed.

The abstract database management method based on the virtual account and access control model according to an embodiment of the present application may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the present invention, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

In addition, the above-described abstract database management method based on the virtual account and access control model may be implemented in the form of a computer program or application executed by a computer stored in a recording medium.

The foregoing description of the present application is for illustration, and those of ordinary skill in the art to which the present application pertains will understand that it can be easily modified into other specific forms without changing the technical spirit or essential features of the present application. Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive. For example, each component described as a single type may be implemented in a distributed manner, and likewise components described as distributed may also be implemented in a combined form.

The scope of the present application is indicated by the following claims rather than the above detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalent concepts should be construed as being included in the scope of the present application.

Claims

In the abstract database management method based on virtual account and access control model,

generating virtual account information mapped with the real account information based on the real account information of a target DB;

receiving a request for access to the target DB from a client terminal;

determining whether the real account information mapped to the virtual account included in the access request exists; and

relaying the access to the target DB of the client terminal based on the actual account information according to the determination result;

Which includes, an abstract database management method.
According to claim 1,

The relaying step is

replacing the virtual account with a real account according to the real account information and transferring the virtual account to the target DB;

receiving identification information for user authentication from the target DB;

converting the received identification information into virtual identification information and transmitting the virtual identification information to the client terminal;

receiving a password input request including the virtual account, a virtual password corresponding to the virtual account, and the virtual identification information from the client terminal;

When the virtual account and the virtual password included in the password input request correspond to the virtual account information, and the virtual identification information included in the password input request corresponds to the identification information, the real account information and the identification information transmitting an authentication request comprising a to the target DB; and

receiving an authentication processing result according to the authentication request from the target DB, and transmitting the authentication processing result to the client terminal;

Which includes, an abstract database management method.
According to claim 1,

The virtual account information is exposed to the user of the client terminal, and direct access to the target DB based on the virtual account information is impossible, the abstract database management method.
4. The method of claim 3,

The generating step is

The method of generating the virtual account information by converting the real account information into a random number processing method so as to prevent deriving the real account information from the generated virtual account information.
4. The method of claim 3,

After the generating step,

When a preset validity period elapses, the mapping of the virtual account information to the real account information is released.
According to claim 1,

After the relaying step,

receiving a query associated with the target DB from the client terminal;

determining whether or not the user has authority to process the target DB according to the query of the virtual account included in the access request; and

selectively performing the processing based on whether the authority is held;

Which further comprises, an abstract database management method.
7. The method of claim 6,

The step of determining whether the right is possessed is,

The abstract database management method of determining whether the user role granted to the virtual account included in the access request among a plurality of user roles preset in connection with the target DB includes the authority.
7. The method of claim 6,

receiving a session termination request for the target DB from the client terminal; and

transmitting the session termination request to the target DB and terminating the session associated with the client terminal;

Which further comprises, an abstract database management method.
According to claim 1,

The target DB is an abstract database management method, characterized in that the DB for storing medical data.
In an abstract database management device based on virtual account and access control model,

a mapping unit generating virtual account information mapped with the real account information based on the real account information of the target DB;

a client identification unit for receiving an access request to the target DB from a client terminal and determining whether the real account information mapped to a virtual account included in the access request exists; and

an access relay unit that relays the access to the target DB of the client terminal based on the real account information according to the determination result;

Containing, an abstract database management device.
11. The method of claim 10,

The connection relay unit,

The virtual account is replaced with a real account according to the real account information and delivered to the target DB, receives identification information for user authentication from the target DB, converts the received identification information into virtual identification information, and an identification information processing unit for transmitting virtual identification information to the client terminal;

Receive a password input request including the virtual account, a virtual password corresponding to the virtual account, and the virtual identification information from the client terminal, and the virtual account and the virtual password included in the password input request are the virtual account information a password analysis unit corresponding to and analyzing whether the virtual identification information included in the password input request corresponds to the identification information; and

Transmitting an authentication request including the real account information and the identification information to the target DB based on the analysis result, receiving an authentication processing result according to the authentication request from the target DB, and receiving the authentication processing result from the client an authentication processing unit that transmits to the terminal;

Which includes, an abstract database management device.
11. The method of claim 10,

The virtual account information is exposed to the user of the client terminal, characterized in that direct access to the target DB based on the virtual account information is impossible,

The mapping unit,

The apparatus for generating the virtual account information by converting the real account information into a random number processing method so as to prevent deriving the real account information from the generated virtual account information.
13. The method of claim 12,

The mapping unit,

When a preset validity period elapses after the virtual account information is generated, the mapping of the virtual account information to the real account information is released.
11. The method of claim 10,

Receives a query related to the target DB from the client terminal, determines whether or not the user has authority to perform processing on the target DB according to the query of the virtual account included in the access request, and based on whether the authority has a query processing unit that selectively performs the processing by

Which will further include an abstract database management device.
15. The method of claim 14,

a session termination unit for receiving a session termination request for the target DB from the client terminal, transmitting the session termination request to the target DB, and terminating a session associated with the client terminal;

Which will further include an abstract database management device.