Data controllable sharing-oriented circulation security database agent system and method

Abstract

The invention provides a circulation security database agent system and method oriented to data controllable sharing, and relates to the technical field of database security control, the system comprises a database agent module, a database engine, a database client, an external authorization module, a rewriting rule module and a configuration storage module, and the database agent module analyzes the access request, rewrites the uplink message according to the rewriting rule and the configuration information, and transmits the uplink message to the database engine. And the rewriting rule module realizes specific rewriting of the strategy according to the user information of the original SQL message and the database information. And the external authorization control module is used for writing the authorization information into the configuration storage module so as to trigger authorization verification of the database agent. Aiming at four types of agent management and control strategies, the available time of a database, the number of query times, the number of rows of data returned by each query and the total size of query contents are specifically controlled.

Description

Technical Field

[0001] The present invention relates to the technical field of database security control, and in particular to a circulation security database proxy system and method oriented to controllable data sharing. Background Art

[0002] With the increasing growth of data and the increasing prominence of data value, databases, as the main data storage method, play a vital role in data circulation and transactions. The circulation and use of data and even transaction realization have received unprecedented attention. As the main data storage method, how to perform security control at the circulation level at the database level is crucial.

[0003] One of the existing access control methods for databases is to use a bastion host to record internal operation and maintenance, and password filling is to first pre-set the password to the bastion host, and then automatically fill in the password through the bastion host's capabilities to avoid the user needing to know the database key. Another method is to rewrite the database's upstream and downstream traffic messages through database proxy technology. For example, a request from an external client first reaches the database proxy, obtains the SQL message on the proxy side, and then rewrites the SQL message. The proxy transmits the rewritten SQL message to the actual database engine, and the database engine performs SQL parsing and processing, and transmits the returned downstream traffic back to the proxy. The proxy restores the downstream traffic structure again, rewrites it as appropriate, and returns the rewritten downstream traffic to the actual client. Since the downstream traffic contains more content and may involve a large amount of actual data, the time required to rewrite the downstream traffic is usually much longer than that of the upstream traffic.

[0004] For password filling technologies such as bastion hosts, such solutions can usually only be used in internal operation and maintenance scenarios. When facing circulation scenarios, since the data actually circulates across institutions, it is usually impossible to perform screen recording monitoring or real-time traffic interception. For database proxy solutions, since the circulation of data elements is an emerging business trend, the industry's existing major proxy rewrites are mainly for desensitizing purposes, etc., and cannot cope with circulation transaction scenarios.

[0005] There are many security risks in the current database when facing shared circulation and data transactions. The traditional access control method cannot meet the security control needs in the data circulation process. There is an urgent need for an efficient database proxy method to achieve fine control of the database while ensuring data security. Summary of the invention

[0006] In view of this, the purpose of the present invention is to provide a data-controllable and shared secure database proxy system and method, which realizes secure control of database access by rewriting upstream traffic. The system includes a database engine, a database proxy, a rewriting rule module, an external authorization control tool, and a configuration storage module. The core is to provide four types of proxy management and control strategies, including controlling the database available time, the number of queries, the number of data rows returned by each query, and the total size of the query content, which are used to manage the access requests of the database external service module and ensure the security and controllability of data during the circulation process.

[0007] The present invention is implemented by the following technical solutions:

[0008] In a first aspect, the present invention provides a data controllable sharing oriented circulation security database proxy system, the system comprising:

[0009] Database proxy module: used to receive all access requests and parse the current user information; and rewrite the upstream SQL message according to the configured rewriting rules and access policies to enhance security and controllability, and also used to return the rewritten SQL message to the database external service module;

[0010] Database engine: used to receive and process SQL messages transmitted by the database proxy module, and transmit the processing results back to the database proxy module.

[0011] Database client: used to send access requests and access the database;

[0012] External authorization module: used to write authorization information into the database external service module, and also used to trigger the external interface exposed by the rewrite rule module in the database external service module to write authorization information into the configuration storage module;

[0013] Rewrite rule module: defines access policies and rewrite rules, and is used to trigger the external interface exposed by the rewrite rule module in the database external service module when the authorization information is written into the database external service module;

[0014] Configuration storage module: stores the configuration information of the database external service module, including access policies, rewrite rules and authorization information.

[0015] As a further solution of the present invention, the database proxy module, together with the database engine and the rewrite rule module, constitutes a database external service module. In the database external service module, the database proxy module receives all transmitted access requests, parses the current user from the access request traffic, and the rewrite rule module completes the rewriting of the uplink message according to the authorization information and configuration information, and transmits the rewritten SQL message back to the database proxy module; then the database proxy module uses the rewritten SQL message to access the database engine, the database engine transmits the downlink traffic to the database proxy module, and the database proxy module transmits the downlink traffic to the database client that actually accesses the database.

[0016] As a further solution of the present invention, when the rewriting rule module rewrites the uplink message, it is used to rewrite the original SQL message according to the configuration information and the authorization information, and perform SQL rewriting according to the rewriting strategy.

[0017] As a further solution of the present invention, the rewriting strategy includes controlling the database available time, the number of queries, the number of query rows and the total size of the query content.

[0018] As a further solution of the present invention, the external authorization module is also used to write the authorization information into the configuration storage module to trigger the authorization verification and flow control of the database proxy for use by the database proxy module.

[0019] As a further solution of the present invention, the authorization information managed by the external authorization module includes validity period, remaining query times, query row number limit, and total query content size.

[0020] The secure database proxy system for data controllable sharing of the present invention can achieve effective control of database access in data sharing and circulation scenarios, and implements a variety of control strategies by rewriting upstream traffic, including controlling database available time, number of queries, number of query rows, total size of query content, etc. By parsing, rewriting and authorizing access requests, it effectively guarantees the security and controllability of data during the circulation process, and is suitable for scenarios with high data security requirements, such as finance, medical care and other fields.

[0021] In a second aspect, the present invention further provides a data controllable sharing oriented flow security database proxy method, the method comprising the following steps:

[0022] Step 1. Receive access request: receive access request from database external service module through database proxy module;

[0023] Step 2. Parsing user information: Parsing the user information in the access request through the database proxy module to determine the source and authority of the access request;

[0024] Step 3. Apply access policy: Verify the user's access rights through the database proxy module according to the pre-defined access policy to ensure that the user has the right to perform the requested operation;

[0025] Step 4. Execute rewriting rules: The database proxy module rewrites the SQL message in the request according to the configured rewriting rules to enhance security and controllability;

[0026] Step 5. Transmit the rewritten request: The rewritten SQL message is transmitted back to the database external service module for further processing and transmission to the database engine;

[0027] Step 6. The database engine processes the request: the database engine receives the rewritten SQL message and executes the corresponding database operation;

[0028] Step 7. Return processing results: The processing results are transmitted back to the database proxy module through the database engine;

[0029] Step 8. Transmit the result to the client: The processing result is transmitted to the database client that actually accesses the database through the database proxy module, completing the entire access request processing process.

[0030] As a further solution of the present invention, before the database proxy module rewrites the SQL message in the request according to the configured rewriting rules, it also includes receiving a database client request, parsing the request traffic, and sending a request to the rewriting rule module to obtain the rewriting rules.

[0031] Through the above steps, the data controllable and shared circulation security database proxy method of the present invention ensures the security and controllability in the database access process, including user authority verification, SQL message rewriting and access policy application, thereby realizing the data controllable and shared circulation security database proxy; the method is not limited by the database engine type, and is applicable to mainstream relational databases (such as MySQL, PostgreSQL) and some non-relational databases (such as MongoDB), providing a simple and intuitive control method for database owners, while effectively preventing the occurrence of data theft, and effectively improving data security and circulation efficiency.

[0032] The present invention also includes a computer device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the flow-safe database proxy method for controllable data sharing.

[0033] The present invention also includes a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the flow security database proxy method for controllable data sharing.

[0034] Compared with the prior art, the data controllable and shared secure database proxy system and method provided by the present invention has the following beneficial effects:

[0035] 1. Data security is achieved: Through the database proxy system, strict control and security monitoring of database access are achieved to effectively prevent unauthorized data access and theft; by using rewriting rules and external authorization control, permission verification and access control are achieved during data flow to ensure the security of data sharing.

[0036] 2. Achieved process optimization and efficiency improvement: The database proxy system of the present invention controls parameters such as the number of query rows and the total size of query content during data flow by rewriting rules, thereby optimizing data flow efficiency; it has real-time monitoring and traffic adjustment functions, enabling the system to dynamically adapt to different data access requirements and improve system response speed and resource utilization.

[0037] 3. Flexible expansion and applicability: The modular design and scalable architecture make the database proxy system flexible and scalable, and the security control strategies and rewriting rules can be customized according to different scenarios and needs; cross-platform compatibility and multi-database engine support make the system more widely applicable and can cover a variety of data sharing and circulation scenarios.

[0038] 4. Real-time monitoring and security auditing: The database proxy system of the present invention has a real-time monitoring function, which can promptly detect abnormal access behaviors and security threats, and improve the system's ability to perceive security incidents; through security auditing, database access logs and security incidents are recorded to provide necessary data support for security management and compliance review. Users can flexibly manage authorization information and access rights through external authorization control tools, which improves the user's controllability and transparency of the data sharing process; flexible adjustment and adaptive optimization of security control strategies ensure the smoothness and stability of user data access and improve user experience.

[0039] Based on the above beneficial effects, the circulation security database proxy system and method for controllable data sharing of the present invention will effectively improve data security, circulation efficiency and user experience, and provide reliable security protection and management means for data sharing scenarios.

[0040] These and other aspects of the present invention will be more clearly understood in the following description of the embodiments. It should be understood that the above general description and the following detailed description are only exemplary and explanatory and cannot limit the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the following briefly introduces the drawings required for use in the exemplary embodiments or related technical descriptions. The drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation to the present invention. In the drawings:

[0042] Figure 1 The present invention is a structural block diagram of a secure database proxy system for data controllable sharing according to an embodiment of the present invention.

[0043] Figure 2 The present invention is a flowchart of a secure database proxy method for controllable data sharing according to an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0045] In some of the processes described in the specification and claims of the present invention and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0046] The following will be combined with the drawings in the exemplary embodiments of the present invention to clearly and completely describe the technical solutions in the exemplary embodiments of the present invention. Obviously, the exemplary embodiments described are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0047] In view of the many security risks that current databases have when facing shared circulation and data transactions, traditional access control methods cannot meet the security control requirements in the data circulation process. The present invention provides a circulation security database proxy system and method for controllable data sharing, which realizes security control of database access by rewriting upstream traffic. The system includes a database engine, a database proxy, a rewrite rule module and an external authorization control tool, as well as a configuration storage module. The core of the system is to provide four types of proxy management and control strategies, including controlling the database available time, the number of queries, the number of data rows returned for each query, and the total size of the query content, which are used to manage the access requests of the database external service module and ensure the security and controllability of data during the circulation process.

[0048] The technical solution of the present invention is further described below in conjunction with specific embodiments:

[0049] See also Figure 1 As shown, Figure 1 A structural block diagram of a data controllable and shared circulation security database proxy system provided by the present invention. A data controllable and shared circulation security database proxy system provided in one embodiment of the present invention includes a database proxy module, a database engine, a database client, an external authorization module, a rewrite rule module and a configuration storage module.

[0050] The database proxy module is used to receive all access requests and parse out the current user information; and according to the configured rewrite rules and access policies, rewrite the upstream SQL message to enhance security and controllability, and also to transmit the rewritten SQL message back to the database external service module. The database engine is used to receive and process the SQL message transmitted by the database proxy module, and transmit the processing result back to the database proxy module. The database client is used to send access requests and access the database; the external authorization module is used to write the authorization information into the database external service module, and is also used to trigger the external interface exposed by the rewrite rule module in the database external service module, and write the authorization information into the configuration storage module; the rewrite rule module defines the access strategy and rewrite rules, which are used to trigger the external interface exposed by the rewrite rule module in the database external service module when writing the authorization information into the database external service module; the configuration storage module stores the configuration information of the database external service module, including the access strategy, rewrite rules and authorization information.

[0051] In this embodiment, the database proxy module, together with the database engine and the rewrite rule module, constitutes a database external service module. In the database external service module, the database proxy module receives all transmitted access requests, parses the current user from the access request traffic, and the rewrite rule module completes the rewriting of the uplink message according to the authorization information and configuration information, and transmits the rewritten SQL message back to the database proxy module; then the database proxy module uses the rewritten SQL message to access the database engine, and the database engine transmits the downlink traffic to the database proxy module, and the database proxy module transmits the downlink traffic to the database client that actually accesses the database.

[0052] Among them, the database engine is an engine provided by the official database, that is, a standard database module, including but not limited to Mysql, Postgres, Mongo or domestic Renmin University of China Jincang, Damang; the database proxy module is implemented using high-performance programming languages ​​such as C / C++, and is used for message parsing and forwarding; the core capability of the database proxy module is to parse key content from the request traffic of the database client according to the communication message rules provided by the database engine, such as the account name of the user currently accessing the database, the name of the database accessed, the actual SQL requested, etc.; at the same time, it is responsible for forwarding the above information to the rewrite rule module, and the rewrite rule module determines how to modify the SQL message; it is also responsible for making actual requests to the database engine and making actual responses to the database client.

[0053] Among them, the configuration storage module is implemented with a lightweight and efficient key-value database, including but not limited to Redis, etcd, ti kv, and can also be implemented based on a traditional relational database; it is mainly used to store real-time information of external authorization distribution, such as the remaining authorization query content size.

[0054] In this embodiment, the database client mainly includes two categories, one is database management and development tools such as navi cat, and the other is the code for making database calls in the business code (such as the database-related jdk driver used by java); no matter which category it is, the original request will eventually be transmitted to the port where the database proxy is located in the form of an SQL message.

[0055] The external authorization module is also used to write the authorization information into the configuration storage module, triggering the authorization verification and flow control of the database proxy for use by the database proxy module. The authorization information managed by the external authorization module includes validity period, remaining query times, query row limit, and total query content size.

[0056] In this embodiment, when the rewriting rule module rewrites the uplink message, it is used to rewrite the original SQL message according to the configuration information and authorization information, and perform SQL rewriting according to the rewriting strategy. The rewriting strategy includes controlling the database available time, query times, query rows, and total query content size.

[0057] In the data controllable sharing oriented circulation security database proxy system of the present invention, when the control database can be used, the authorization information in the configuration storage includes a validity period field, and the configuration storage regularly checks whether a certain authorization has expired, and deletes the authorization if it expires. When the database proxy requests rewriting, if it is found that the authorization does not exist, the proxy module is directly informed not to return the downstream traffic, so as to achieve the effect of truncation. When the control database is queried, the configuration storage includes a remaining valid query field, and each time a SELECT request is made, the remaining valid query is deducted from the corresponding authorization once; when the remaining valid query value drops to 0, the proxy module is informed not to return the downstream traffic, so as to achieve the effect of truncation. Each time the control database is queried, the configuration storage includes the upper limit of the number of rows for each query, which is a fixed value. When the original SELECT type SQL message is transmitted, the original SELECT statement is rewritten by using the "support subquery" capability and row restriction capability that almost all database engines have. Exemplarily, the original SQL is: SELECT*FROM test. The rewritten SQL is: SELECT FROM(SELECT*FROM test)l imi t 10. At this time, no matter how many data the original SQL wants to query, the upper limit of the single query row will be limited to 10; for different types of databases, the SQL rewriting methods are different. For example, Oracle will use SELECT FROM (SELECT * FROM test) WHERE ROWNUM <= 10.

[0058] When controlling the total size of the database that can be queried, before the database proxy forwards the downstream traffic to the client, it counts the number of characters in the traffic and deducts the remaining available size from the configuration storage. If the remaining available size is less than 0, the downstream traffic is not returned, achieving the effect of truncation.

[0059] The secure database proxy system for data controllable sharing of the present invention can achieve effective control of database access in data sharing and circulation scenarios, and implements a variety of control strategies by rewriting upstream traffic, including controlling database available time, number of queries, number of query rows, total size of query content, etc. By parsing, rewriting and authorizing access requests, it effectively guarantees the security and controllability of data during the circulation process, and is suitable for scenarios with high data security requirements, such as finance, medical care and other fields.

[0060] See also Figure 2 As shown, Figure 2 A flow chart of a data controllable and shared secure database proxy method provided by the present invention. A data controllable and shared secure database proxy method provided in one embodiment of the present invention comprises the following steps:

[0061] Step S10. Receiving an access request: receiving an access request from a database external service module through a database proxy module;

[0062] Step S20. Parsing user information: Parsing user information in the access request through the database proxy module to determine the source and authority of the access request;

[0063] Step S30. Apply access policy: Verify the user's access rights through the database proxy module according to the pre-defined access policy to ensure that the user has the right to perform the requested operation;

[0064] Step S40. Execute rewriting rules: the database proxy module rewrites the SQL message in the request according to the configured rewriting rules to enhance security and controllability;

[0065] Step S50. Transmitting the rewritten request: The rewritten SQL message is transmitted back to the database external service module for further processing and transmission to the database engine;

[0066] Step S60. The database engine processes the request: the database engine receives the rewritten SQL message and executes the corresponding database operation;

[0067] Step S70. Returning the processing result: transmitting the processing result back to the database proxy module through the database engine;

[0068] Step S80: Transmitting the result to the client: The processing result is transmitted to the database client that actually accesses the database through the database proxy module, completing the entire access request processing process.

[0069] Among them, before the database proxy module rewrites the SQL message in the request according to the configured rewriting rules, it also includes receiving the database client request, parsing the request traffic, and sending a request to the rewriting rule module to obtain the rewriting rules.

[0070] Through the above steps, the data controllable and shared circulation security database proxy method of the present invention ensures the security and controllability in the database access process, including user authority verification, SQL message rewriting and access policy application, thereby realizing the data controllable and shared circulation security database proxy; the method is not limited by the database engine type, and is applicable to mainstream relational databases (such as MySQL, PostgreSQL) and some non-relational databases (such as MongoDB), providing a simple and intuitive control method for database owners, while effectively preventing the occurrence of data theft, and effectively improving data security and circulation efficiency.

[0071] The present invention provides a secure database proxy system and method for data controllable sharing. For data in the form of a database, in the scenario of shared circulation and even data trading, some new database proxy strategies are defined, and an efficient proxy solution that only requires rewriting of upstream traffic is provided. The proxy strategy proposed in this application is simple and easy to understand, easy for database owners to understand, and easy to price the database for use; at the same time, this application is only based on some basic characteristics of the database, so it is not limited by the database engine category and has a wide range of applicability.

[0072] It should be understood that, although described in a certain order, these steps are not necessarily performed in sequence in the above order. Unless there is clear explanation in this article, the execution of these steps does not have strict order restriction, and these steps can be performed in other orders. Moreover, a part of the steps of the present embodiment may include a plurality of steps or a plurality of stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a part of the steps or stages in other steps or other steps.

[0073] In one embodiment, a computer device is also provided in an embodiment of the present invention, comprising at least one processor and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the steps of the method for circulating secure database agent for controllable data sharing.

[0074] In one embodiment, the present invention further provides a computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to execute the steps of the flow-safe database proxy method for controllable data sharing.

[0075] A person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be realized by instructing the relevant hardware through a computer program represented by computer instructions, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory.

[0076] Non-volatile memory may include read-only memory, magnetic tape, floppy disk, flash memory or optical storage, etc. Volatile memory may include random access memory or external cache memory. As an illustration and not limitation, RAM may be in various forms, such as static random access memory or dynamic random access memory, etc.

[0077] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A data-controllable and shared secure database proxy system, characterized in that: The system includes: Database proxy module: used to receive all access requests and parse the current user information; rewrite the upstream SQL message according to the configured rewriting rules and access policies, and also used to return the rewritten SQL message to the database external service module; Database engine: used to receive and process SQL messages transmitted by the database proxy module, and transmit the processing results back to the database proxy module; Database client: used to send access requests and access the database; External authorization module: used to write authorization information into the database external service module, and also used to trigger the external interface exposed by the rewrite rule module in the database external service module to write authorization information into the configuration storage module; Rewrite rule module: defines access policies and rewrite rules, and is used to trigger the external interface exposed by the rewrite rule module in the database external service module when the authorization information is written into the database external service module; Configuration storage module: stores the configuration information of the database external service module, including access policies, rewrite rules and authorization information.

2. The data controllable and shared secure database proxy system according to claim 1, characterized in that: The database proxy module, together with the database engine and the rewriting rule module, constitutes a database external service module. In the database external service module, the database proxy module receives all transmitted access requests, parses the current user from the access request traffic, and the rewriting rule module completes the rewriting of the uplink message according to the authorization information and configuration information, and transmits the rewritten SQL message back to the database proxy module; The database proxy module then uses the rewritten SQL message to access the database engine, the database engine transmits the downstream traffic to the database proxy module, and the database proxy module transmits the downstream traffic to the database client that actually accesses the database.

3. The data controllable and shared secure database proxy system according to claim 2, characterized in that: When the rewriting rule module performs uplink message rewriting, it is used to rewrite the original SQL message according to the configuration information and the authorization information, and perform SQL rewriting according to the rewriting strategy.

4. The data controllable and shared circulation secure database proxy system according to claim 3, characterized in that: The rewrite strategy includes controlling the database available time, query times, query rows, and total query content size.

5. The data controllable and shared secure database proxy system according to claim 4, characterized in that: The external authorization module is also used to write the authorization information into the configuration storage module, triggering the authorization verification and flow control of the database proxy for use by the database proxy module.

6. The data controllable and shared secure database proxy system according to claim 5, characterized in that: The authorization information managed by the external authorization module includes validity period, remaining query times, query row number limit, and total query content size.

7. A data transfer security database proxy method for controllable data sharing, characterized in that: The proxy method is executed based on the data controllable sharing-oriented circulation security database proxy system described in any one of claims 1 to 6, and the circulation security database proxy method includes the following steps: Step 1). Receive access request: receive access request from database external service module through database proxy module; Step 2). Parse user information: Parse the user information in the access request through the database proxy module to determine the source and authority of the access request; Step 3). Apply access policy: Verify the user's access rights through the database proxy module according to the pre-defined access policy to ensure that the user has the right to perform the requested operation; Step 4). Execute rewriting rules: The database proxy module rewrites the SQL message in the request according to the configured rewriting rules; Step 5). Transmit the rewritten request: The rewritten SQL message is transmitted back to the database external service module; Step 6). The database engine processes the request: the database engine receives the rewritten SQL message and executes the corresponding database operation; Step 7). Return processing results: transmit the processing results back to the database proxy module through the database engine; Step 8). Transmit the results to the client: The processing results are transmitted to the database client that actually accesses the database through the database proxy module.

8. The data controllable and shared secure database proxy method according to claim 7, characterized in that: Before the database proxy module rewrites the SQL message in the request according to the configured rewriting rules, it also includes receiving the database client request, parsing the request traffic, and sending a request to the rewriting rule module to obtain the rewriting rules.

9. A computer device comprising: At least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the flow-safe database proxy method for controllable data sharing as described in any one of claims 7-8.

10. A computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to execute the secure database proxy method for controllable data sharing according to any one of claims 7 to 8.

Images