医学院校教师备课系统的信息安全性研究  

Research on Information Security of Medical College Teachers'Lesson Preparation System

作　　者：韩婷[1] 董默[1] 宋欣[1] 刘畅[1] HAN Ting;DONG Mo;SONG Xin;LIU Chang(Mudanjiang Medical University,Mudanjiang Heilongjiang 157011,China)

机构地区：[1]牡丹江医学院,黑龙江牡丹江157011

出　　处：《信息安全与通信保密》2021年第6期76-81,共6页Information Security and Communications Privacy

基　　金：基于QT的医学院校教师备课系统的设计与应用研究(No.2018-KYYWFMY-0092);基于Moodle和Phonegap的移动学习客户端的设计与应用研究(No.2017-KYYWF-0632)。

摘　　要：医学院教师备课系统对信息安全要求较高,其中存储了大量的敏感数据。由于数据具有严谨性,因此要求其不容随意被修改或删除。基于此,研究如何提高医学院校教师备课系统信息安全系数,给出数据加密存储、数据访问权限控制、数据备份以及数据库日志使用等信息安全存储有效措施。重点针对目前威胁MySQL数据库安全的SQL注入攻击,详细分析基于模式匹配的SQL注入防御模型的静态和动态两个阶段的基本处理过程,并给出针对整型参数的SQL注入攻击相应的防御方法。Medical school teachers'lesson preparation system is one of the applications with high requirements for information security,in which a large number of sensitive data are stored,and the rigor of the data also makes it impossible to modify or delete at will.In this paper,how to improve the information security of Medical College Teachers'lesson preparation system is explored,and some effective measures such as data encryption storage,data access control,data backup,and database log usage are given.This paper focuses on the current SQL injection attacks that threaten the security of MySQL database,analyzes in detail the basic processing process of the static and dynamic phases of the SQL injection defense model based on pattern matching,and gives the corresponding defense methods for SQL injection attacks against integer parameters.

关 键 词：医学院校 备课系统 数据库 注入攻击 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]