Database access authority identification certification through standard jdbc extension and the method that embodies utilization details identification

Database access authority identification certification through standard jdbc extension and the method that embodies utilization details identification }

<p>The present invention allows database access by checking whether an authorized information user is in the database connection and querying the information system through the standard JDBC extension that communicates with the database, and records the usage history including the identification information of the information user to prevent information leakage and This is a method for real-name authentication of database access rights to prevent misuse and real-name authentication of usage history.</p>

<p> The present invention is a method for real-name authentication of database access authority through standard JDBC extension and real-name implementation of usage history, and prevents illegal database access that bypasses the integrated authentication (SSO) system in the web application server area responsible for user and information system authority This is to prevent unauthorized access to the database by controlling access rights by verifying the authority of users and information systems in the database communication area (JDBC) during database connection and query containing important (personal) information. It is a method related to real-name authentication of database access rights through standard JDBC extension that can identify responsibility for usage history by including identification information of information users and information systems in the usage history and real-name authentication of usage history.</p><p> In the current 3-tier structure of web-based information system database access authorization authentication method, the middleware web application server (Web Application Server, WAS) creates a certain number of connections in advance to access the database (DataBase, DB). It manages database access using the DB Connection Pool, which is allocated and returned to the information system (web application) when it is needed. So, when a user logs in to the information system (certificate or ID/PW), the WAS application layer checks the user identity with the single sign-on (SSO) system and uses EAM (Extranet Access Management, EAM) or Indirectly manages database access right by configuring the integrated menu by checking whether the authentication data (DB Table) has work authority.</p><p> However, in the database access right authentication, user information (certificate or ID) authenticated in the WAS area is transmitted to the database management system (DBMS) server for essential authority management and information use responsibility at the database level, and the interpretation process (authorization) After verification), the audit log is created in the DBMS and managed in a form that cannot be accessed arbitrarily. However, in most cases, the web-based information system structure installs various web S/Ws including WAS and the DBMS is configured by introducing foreign products. Because the database cannot determine whether legitimate information users and information systems are performing database connection and query activities, SQL injection attacks through user disguise, web service authentication system attacks such as session hijacking, and denial of service that interferes with normal activities Illegal acts such as DoS attacks and Contents Spoofing attacks that take advantage of the credibility of users and websites are on the rise. </p><p> In addition, in the web-based information system with a three-tier structure, the web application server (WAS), not the database, is responsible for the authentication of the database access right of the information user, so information leakage that bypasses the WAS is prevalent. So, the user information (certificate DN or ID) authenticated in the middleware area is transmitted to the database, and through the authorization check process, authorization is not managed in the database for each real user, but depending on the application. the reality of the system.</p><p> 1 is a conceptual diagram for explaining the absence of a database utilization system and an authentication system in a conventional general web-based information system. As shown, the current web-based information system creates a database connection pool in advance through a web application server in order to efficiently utilize the database and reduce overhead that occurs during access. A connection pool does not create a connection when an application needs a connection, but creates a certain number of connections in advance to support data services. The user identity is verified from the SSO) system, and the authority management indirectly authenticates the database access authority by configuring the integrated menu by checking only the information system usage authority through EAM or separate authentication data (DB Table). Therefore, the database management system level essential authority management is impossible, so if the web application area is exposed to illegal acts such as hacking or directly accesses the database through web S/W, the database becomes defenseless.</p><p> 2 is a conceptual diagram for explaining factors hindering the effectiveness of the usage history of the conventional web-based information system. As shown, user information (certificate or ID) authenticated by WAS is delivered to the database management system for minimum authority management and responsibility identification at the database management system level, and through an analysis process, the usage history (Audit Log) is stored in the database management system. Although being created is a basic requirement of database security, the scope of application of the user authentication (SSO) system in the current web environment is limited to the WAS area, and the lack of compatibility between most of the web S/W technical elements (Web S/W such as WAS ~ DBMS) Because user information (certificate or ID) is not even transmitted (interpreted), it is impossible to monitor illegal activities through the database log (Audit Log) and to audit information afterwards. Therefore, with the current database log (Audit Log), even if an illegal act such as hacking occurs in an Internet service, it is impossible to recognize it until the damage caused by information leakage becomes visible.</p><p> In the recent case of hacking the database of 274 institutions (company), including 7 banks in the second financial sector, and leaking 9.7 million personal information, the second financial sector was held for over a year even though customer personal information was exposed to illegal activities such as hacking. The fact that about 274 management agencies and companies, including those, were not even aware of it, and the fact that a hacker requested money or valuables and could be recognized during the fact-finding process of the investigative agency also proves the security vulnerability of the web service.</p><p> 3 is a conceptual diagram for explaining a hacking threat factor of a conventional general web-based information system system. As shown in the figure, even if the web application server (Web Application Server: WAS) and database management system server supporting the web are physically located in the secure area, the information system (web application) running on the WAS has HTML function (Html Script) and internal Because class calls coexist and some of the functions are exposed to the service area (the Internet is external), they are vulnerable to SQL Injection and XSS (Cross Site Scripting) attacks. Most of these vulnerabilities achieve their intended purpose by complexly attacking the user area (PC Browser), and there is a limit to strengthening website security. Even if the database access class is easily bypassed and the database is used without permission, the current network security solutions (FireWall, IDS, IPS) are insufficient. Because the security function (database connection pool control) cannot be satisfied, the database management system is defenseless against security threats. So, in recent years, illegal activities that exploit vulnerabilities are prevalent. In addition, another factor that aggravates the vulnerability is to share a DB access account with unlimited privileges in the database for database access with web S/W (UI Tool, Reporting Tool, etc.) such as WAS, and as shown in FIG. By managing each /W in the environment file, database access is being made indiscriminately. Therefore, DB access accounts that cannot even change passwords are easily exploited even for minor website vulnerabilities, and are used as a means of hacking as a back door with unlimited privileges that does not leave any user traces.</p><p> In order to solve this problem, the SQL function of the JDK, which is inherited by the standard JDBC that communicates with the database of the existing WAS area, is extended to control the database access authority, so that the authority of the user and information system in the communication area is checked during database connection and query. By confirming, it is possible to secure control measures for each real user, and by recording real-named usage details, it is possible to prevent hacking with a pre-monitoring and post-audit system for illegal activities.</p>

<solutionproblem><p> Accordingly, the present invention has been proposed to solve the problems of the prior art, and an object of the present invention is to make real-name database access right through the standard JDBC extension used for communication with a database in a web-based information system, and to take responsibility for authentication and usage history. It is intended to provide a method for implementing identification.</p><p> In order to achieve the above object, according to an embodiment of the present invention, a database access right real-name authentication and usage history real-name construction method through standard JDBC extension in a web-based information system environment is,</p><p> Information with access rights of legacy DB User identification information (certificate DN and ID), identification information of the information system used for login (class ID), DB access authority information (DB access account and password), information on whether or not to record usage history A first step of building a separate repository; a second step of accessing the repository to verify the authority of the user and the information system before starting the information system service including important (personal) information after the first step; After the second step, if the user and information system are authenticated in the repository, the authentication token is stored in the web application server memory area, including user and information system identification information, usage history record or not, and user session information issued to the user in the web application server area. a third step of issuing; User session information and information authenticated by the web application server through the method used for connection and query by extending the SQL function of the JDK inherited by the standard JDBC that is set in the web application server area for communication with the legacy DB after the third step. When the system identification information (class ID) is obtained and delivered, it is a system that authenticates database access by collating the identification information of the information system with the user session information included in the authentication token of the web application server area in the database communication area (JDBC). Step 4; After the fourth step, the fifth step of creating a usage history by recording the identification information of the information user and the information system included in the authentication token for the connection and query result values in the repository; .</p></solutionproblem><meansproblemsolution><p> Hereinafter, an embodiment according to the technical idea of the present invention as described above, a construction method related to real-name authentication of database access rights using standard JDBC and real-name implementation of usage history will be described with reference to the drawings. In the following description of the present invention, if it is determined that a detailed description of a related well-known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. And the terms to be described later are terms defined in consideration of functions in the present invention, which may vary depending on the intention or precedent of the user or operator, and accordingly, the meaning of each term should be interpreted based on the contents throughout this specification. will be.</p><p> 5 is a conceptual diagram for explaining the implementation of real-name authentication of database access rights and real-name use history through standard JDBC extension in an Internet service environment according to an embodiment of the present invention.</p><p>As shown in this figure, the identification information (class ID) of the information system 21 including the identification information (certificate DN or ID) of the information user 10 and important (personal) information and the DB access authority, which is the legacy DB access information Information (DB access account and password) and usage history are recorded in a separate repository to manage access rights of the legacy DB 40. The web application server 20 accesses the repository 30 at startup to obtain DB access right information to provide general information services, and to the repository 30 when the user uses an information system containing important (personal) information content. connect The repository 30 checks whether the user 10 and the information system 21 are authorized, and then, if the user is an authorized user, the user session information issued by the web application server to the authentication token 31 that can access the legacy DB 40 , user and information system identification information, and whether or not usage history is recorded in the web application server memory area and authenticated by the web application server through the method used for connecting and querying important (personal) information of the legacy DB. When user session information and information system identification information (class ID) are obtained and delivered, the database access authority is controlled by comparing the user session information and information system identification information included in the authentication token 31 in the database communication area 32 do. In addition, it is a method of generating usage details in the repository by including user and information system identification information included in the authentication token 31 in the data query result value.</p></meansproblemsolution><effectiveness><p> As described above, the implementation method for real-name authentication of database access rights and identification of responsibility for usage history through the standard JDBC extension that communicates with the database in the web-based information system according to the present invention is suitable for information services including personal information and important information By re-verifying whether it is an information user and information system, it is possible to prevent access to the database by inappropriate information users and information systems that bypass the integrated authentication (SSO) system in the web application server area, and user and information system identification information is included in the usage history By doing so, it is possible to clarify the history of use, so it is possible to clarify who is responsible for the history of use.</p><p>Although the above description has been limited to the preferred embodiment of the present invention, the present invention is not limited thereto, and various changes, modifications and equivalents may be used. Therefore, the present invention can be applied by appropriately modifying the above embodiments, and it will be natural that these applications also fall within the scope of the present invention based on the technical idea described in the following claims.</p></effectiveness>

<p> In the current 3-tier structure of web-based information system database access authority authentication method, the middleware web application server (Web Application Server, WAS) creates a certain number of connections in advance to access the database (DataBase, DB). It manages database (DB) access by using the DB Connection Pool, which is allocated and returned to the information system (web application) when it is needed. So, when a user logs in to the information system (certificate or ID/PW), the WAS application layer checks the user identity with the single sign-on (SSO) system and uses EAM (Extranet Access Management, EAM) or Indirectly manages database access right by configuring the integrated menu by checking whether the authentication data (DB Table) has work authority.</p><p>However, in the database access right authentication, user information (certificate or ID) authenticated in the WAS area is transmitted to the database management system (DBMS) server for essential authority management and information use responsibility at the database level, and the interpretation process (authorization) After verification), the audit log is created in the DBMS and managed in a form that cannot be accessed arbitrarily. However, in most cases, the web-based information system structure installs various web S/Ws including WAS and the DBMS is configured by introducing foreign products. Because the database cannot determine whether legitimate information users and information systems are performing database connection and query activities, SQL injection attacks through user disguise, web service authentication system attacks such as session hijacking, and denial of service that interferes with normal activities Illegal acts such as DoS attacks and Contents Spoofing attacks that take advantage of the credibility of users and websites are on the rise.</p>