Database access method and device for preventing user data leakage in container

Abstract

The invention discloses a database access method and device for preventing user data leakage in a container, and the method comprises the steps: a business service sends a connection establishment request to a database service; a database side vehicle service hijack connection establishment request which has the same POD with the business service and is different from the business service in a container contai ner; the database side vehicle service analyzes a database protocol, modifies a user name and a password in the connection establishment request, and forwards the modified connection establishment request to the database service; the database service performs user name and password verification based on the modified connection establishment request, and returns a response after the verification is passed; and the database side vehicle service receives the response of the database service and forwards the response back to the business service, and the business service establishes database connection with the database service. According to the invention, the database side vehicle service is introduced between the business service and the database service, all database connection requests are intercepted, and the business service does not need to know the user name and password of the database when connecting the database, so that the leakage of certificates is avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and specifically provides a database access method and device for preventing user data leakage in a container. Background Art

[0002] In current applications, the security of database connections has always been an important technical challenge. The traditional method is to store the database username and password directly in the application code or configuration file. This method has security risks because business developers may be able to obtain the authentication information of the database connection by viewing the code or configuration file. In addition, even if the configuration information is issued by the configuration platform, once the configuration information is leaked, the database connection may be threatened.

[0003] In the prior art, an encryption method is generally used to store database passwords to increase the security of database connections. However, these methods still have the risk of internal personnel leaking the passwords through printing logs and the like.

[0004] In view of this, the present invention patent is proposed. Summary of the invention

[0005] In view of the above technical problems, the present invention proposes a database access method and device for preventing user data leakage in a container, and provides a safe, efficient and transparent database access technical solution, which can allow services to communicate with the database without exposing database credentials.

[0006] Specifically, the following technical solutions are adopted:

[0007] In a first aspect, the present invention provides a method for accessing a database in a container to prevent user data leakage, comprising:

[0008] The business service sends a connection request to the database service;

[0009] The database sidecar service in the same POD as the business service but in a different container hijacks the connection request;

[0010] The database sidecar service parses the database protocol and modifies the username and password in the connection request, and forwards the modified connection request to the database service;

[0011] The database service verifies the username and password based on the modified connection request and returns a response after the verification passes.

[0012] The database sidecar service receives the response from the database service and forwards it back to the business service, which then establishes a database connection with the database service.

[0013] As an optional implementation of the present invention, in a method for accessing a database in a container to prevent user data leakage of the present invention, the database sidecar service parses the database protocol and modifies the user name and password in the connection request, including:

[0014] The database sidecar service dynamically obtains the database credentials for database connection from the database management and control platform, and the database management and control platform updates and manages the database credentials for database connection with the database service;

[0015] The database sidecar service parses the username and password data in the connection request and modifies them into the database credentials.

[0016] As an optional implementation manner of the present invention, a method for accessing a database in a container to prevent user data leakage of the present invention includes:

[0017] The database sidecar service parses the connection request and obtains the username and password data;

[0018] The database sidecar service dynamically obtains the database credentials for database connection from the database management and control platform;

[0019] The database sidecar service deletes the username and password data in the connection request and fills in the database credentials.

[0020] As an optional implementation manner of the present invention, a method for accessing a database in a container to prevent user data leakage of the present invention includes:

[0021] The database sidecar service parses the connection request and fails to obtain the username and password data;

[0022] The database sidecar service dynamically obtains the database credentials for database connection from the database management and control platform;

[0023] The database sidecar service populates the database credentials directly into the connection request.

[0024] As an optional implementation mode of the present invention, in a method for accessing a database in a container to prevent user data leakage of the present invention, the database management and control platform is responsible for issuing database credentials and establishing a database credential library;

[0025] The database management and control platform monitors the usage status of the database credentials in the database credential library in real time, deletes the used database credentials, and issues and updates new database credentials.

[0026] As an optional implementation manner of the present invention, in a database access method for preventing user data leakage in a container of the present invention, after the business service establishes a database connection with the database service, the method includes:

[0027] The business service submits a data query or processing request;

[0028] The database sidecar service receives the data query or data processing request and forwards it to the database service. The database service performs data query or processing according to the data query or processing request, and returns the data query or processing result to the database sidecar service.

[0029] The database sidecar service forwards the returned data query or processing results to the business service.

[0030] As an optional implementation manner of the present invention, in a database access method for preventing user data leakage in a container of the present invention, after the business service establishes a database connection with the database service, the method includes:

[0031] When the database sidecar service does not receive a data query or processing request submitted by the business service within a preset time period, or the database sidecar service receives a database disconnection request submitted by the business service;

[0032] The database sidecar service then disconnects the data connection between the business service and the database service.

[0033] As an optional implementation manner of the present invention, in a database access method for preventing user data leakage in a container of the present invention, the database credential becomes invalid after the business service and the database service disconnect the current database connection.

[0034] In a second aspect, the present invention provides a database access device for preventing user data leakage in a container, comprising:

[0035] Business service module;

[0036] The database sidecar service module is deployed in the same POD as the business service module but in a different container;

[0037] And database service module:

[0038] The business service module sends a connection establishment request to the database service module;

[0039] The database sidecar service module hijacks the connection request, parses the database protocol and modifies the user name and password in the connection request, and forwards the modified connection request to the database service module;

[0040] The database service module verifies the user name and password based on the modified connection request, and returns a response after the verification passes;

[0041] The database sidecar service module receives the response from the database service module and forwards it back to the business service module. The business service module establishes a database connection with the database service module.

[0042] In a third aspect, the present invention provides a computer-readable recording medium storing a computer-executable program, wherein when the computer-executable program is executed, the database access method for preventing user data leakage in a container is implemented.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] The present invention provides a method for accessing a database in a container to prevent user data leakage. By introducing a database sidecar service between the business service and the database service, all database connection requests are intercepted to ensure that the business service does not need to know the database user name and password when connecting to the database, thereby avoiding the leakage of credentials. The database sidecar service can interact with the database management and control platform to dynamically obtain the latest database credentials without restarting or reconfiguring the service, thereby improving the flexibility and automation of the system. Business R&D cannot directly obtain the user name and password information of the database connection, thereby improving the security of the database connection.

[0045] The present invention provides a method for accessing a database in a container to prevent user data leakage, provides a method for accessing a database without exposing database credentials, and maintains the flexibility and transparency of the system, and has the following technical effects:

[0046] First, since the present invention uses a database sidecar service to hijack database connection requests and replace the username and password therein, the service itself does not need to store these credentials. This directly solves the problem of credentials leaking in the configuration file, improves the security of database access, and reduces the risk of credentials leaking.

[0047] Second, the database sidecar service can dynamically obtain credentials from the database management platform, which means that the update of credentials does not require service intervention. This enables dynamic management of database credentials and improves the flexibility and automation of the system.

[0048] 3. Since the database sidecar service transparently forwards requests between the business service and the database service, the business service does not need to know about the change of credentials, nor does it need to modify the existing logic. The transparency and compatibility of the business service are maintained, and the security mechanism can be integrated without modifying the existing business service.

[0049] Fourth, by controlling database access through the database sidecar service, more fine-grained security policies can be implemented, such as access control, encrypted transmission, etc. The security of the system is enhanced, and the protection of the database is improved through fine-grained access control and security policies.

[0050] 5. Since business services do not directly handle database credentials, sensitive information will not be exposed even in log records. This reduces the risk of internal R&D leaking sensitive information through logs and improves the overall security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 An encryption flow chart of a method for accessing a database in a container to prevent user data leakage according to a first embodiment of the present invention;

[0052] Figure 2 A schematic structural diagram of an electronic device according to a second embodiment of the present invention;

[0053] Figure 3 A schematic diagram of a computer-readable recording medium according to a second embodiment of the present invention. DETAILED DESCRIPTION

[0054] To make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be described clearly and completely in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them.

[0055] Therefore, the following detailed description of the embodiments of the present invention is not intended to limit the scope of the invention claimed for protection, but merely represents some embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features and technical solutions in the embodiments may be combined with each other.

[0057] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0058] In the description of the present invention, it should be noted that the orientation or positional relationship indicated by the terms "upper", "lower", etc. is based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship in which the invention product is usually placed when in use, or the orientation or positional relationship commonly understood by those skilled in the art. Such terms are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0059] Embodiment 1

[0060] See also Figure 1 As shown, a method for accessing a database in a container to prevent user data leakage in this embodiment includes:

[0061] The business service sends a connection request to the database service;

[0062] The database sidecar service in the same POD as the business service but in a different container hijacks the connection request;

[0063] The database sidecar service parses the database protocol and modifies the username and password in the connection request, and forwards the modified connection request to the database service;

[0064] The database service verifies the username and password based on the modified connection request and returns a response after the verification passes.

[0065] The database sidecar service receives the response from the database service and forwards it back to the business service, which then establishes a database connection with the database service.

[0066] The present embodiment provides a method for accessing a database in a container to prevent user data leakage. By introducing a database sidecar service between the business service and the database service, all database connection requests are intercepted to ensure that the business service does not need to know the database user name and password when connecting to the database, thereby avoiding the leakage of credentials. The database sidecar service can interact with the database management and control platform to dynamically obtain the latest database credentials without restarting or reconfiguring the service, thereby improving the flexibility and automation of the system. Business R&D cannot directly obtain the user name and password information of the database connection, thereby improving the security of the database connection.

[0067] The database sidecar service of this embodiment refers to an intermediate node that is designated to hijack the connection link, fill in the username and password in the database message, and forward the database connection request when the service in the container accesses the database.

[0068] The container of this embodiment is a lightweight, portable, self-sufficient software packaging technology that allows software to run in an isolated environment without relying on the language stack or environment configuration of the underlying operating system.

[0069] As an optional implementation of this embodiment, in a database access method for preventing user data leakage in a container of this embodiment, the database sidecar service parses the database protocol and modifies the user name and password in the connection request, including:

[0070] The database sidecar service dynamically obtains the database credentials for database connection from the database management and control platform, and the database management and control platform updates and manages the database credentials for database connection with the database service;

[0071] The database sidecar service parses the username and password data in the connection request and modifies them into the database credentials.

[0072] This embodiment is issued by the data management and control platform, and there is no need to update the database credentials manually or through the configuration platform. The present invention can realize dynamic replacement of credentials, which improves the degree of automation and flexibility. Business development can realize the security reinforcement of database access without modifying the code, realizes the non-intrusiveness of business logic, simplifies the process of user password management, and ensures the security and reliability of database connection.

[0073] As a specific implementation of this embodiment, a database access method for preventing user data leakage in a container of this embodiment includes:

[0074] The database sidecar service parses the connection request and obtains the username and password data;

[0075] The database sidecar service dynamically obtains the database credentials for database connection from the database management and control platform;

[0076] The database sidecar service deletes the username and password data in the connection request and fills in the database credentials.

[0077] In this embodiment, in the case where the database sidecar service parses the connection request containing username and password data, the username and password data in the connection request is deleted, and the database credentials for database connection dynamically obtained by the database management and control platform are filled in. The database connection is performed through the database credentials to avoid leakage of the username and password data of the connection request user.

[0078] As another specific implementation of this embodiment, a database access method for preventing user data leakage in a container of this embodiment includes:

[0079] The database sidecar service parses the connection request and fails to obtain the username and password data;

[0080] The database sidecar service dynamically obtains the database credentials for database connection from the database management and control platform;

[0081] The database sidecar service populates the database credentials directly into the connection request.

[0082] In this embodiment, in the case where the database sidecar service parses the connection request without the user name and password data, the database credentials for database connection dynamically obtained by the database management platform are directly filled in, and the database connection is performed through the database credentials. In this way, this embodiment realizes a unified processing method for database connection requests using user name and password data and database connection requests not using user name and password data.

[0083] In a method for accessing a database in a container to prevent user data leakage in this embodiment, the database management and control platform is responsible for issuing database credentials and establishing a database credential library;

[0084] The database management and control platform monitors the usage status of the database credentials in the database credential library in real time, deletes the used database credentials, and issues and updates new database credentials.

[0085] Furthermore, in a method for accessing a database in a container to prevent user data leakage in this embodiment, after the business service establishes a database connection with the database service, the method further includes:

[0086] The business service submits a data query or processing request;

[0087] The database sidecar service receives the data query or data processing request and forwards it to the database service. The database service performs data query or processing according to the data query or processing request, and returns the data query or processing result to the database sidecar service.

[0088] The database sidecar service forwards the returned data query or processing results to the business service.

[0089] In this embodiment, a database access method for preventing user data leakage in a container is provided. The data connection between the business service and the database service is realized through the database sidecar service, and transparent forwarding between the two after the data connection. Transparent forwarding refers to the process of forwarding data packets by intermediate nodes in network communication without the perception of the communicating parties, thereby realizing seamless transmission of data packets.

[0090] In a method for accessing a database in a container to prevent leakage of user data in this embodiment, after the business service establishes a database connection with the database service, the following steps are included:

[0091] When the database sidecar service does not receive a data query or processing request submitted by the business service within a preset time period, or the database sidecar service receives a database disconnection request submitted by the business service;

[0092] The database sidecar service then disconnects the data connection between the business service and the database service.

[0093] Furthermore, the database credential described in this embodiment becomes invalid after the business service and the database service disconnect the current database connection.

[0094] See also Figure 1 As shown, a database access method for preventing user data leakage in a container of this embodiment is described in detail in a specific example scheme:

[0095] 1. The business service sends a connection request to the database service's IP and port 3306.

[0096] 2. The kernel IP address hijacks the request with the destination 3306 and forwards it to the database sidecar service in the same Pod but with a different controller.

[0097] 3. The database sidecar service receives the connection request.

[0098] 4. The database sidecar service parses the database protocol and modifies the username and password in the connection request; initially, they are not directly filled in.

[0099] 5. The database sidecar service forwards the connection request to the database service.

[0100] 6. The database service accepts and verifies the username and password and returns a response.

[0101] 7. The database sidecar service receives the response and forwards it back to the business service.

[0102] 8. After the business service is successfully connected, start submitting queries or processing statements.

[0103] 9. The kernel IP address hijacks the request with the destination 3306 and forwards it to the database sidecar service in the same Pod but with a different controller.

[0104] 10. The database sidecar service subsequently transparently forwards business service database requests.

[0105] 11. Until the database connection is disconnected.

[0106] Among them, IPtab le is a tool for configuring IPv4 data packet filtering rules under the Linux operating system, which can be used to manage firewall rules, network address translation, etc.

[0107] Port 3306 is the default TCP / IP connection port for the MySQL database system, used for communication between the client and the MySQL database server. This is the port number officially assigned to MySQL for data exchange via the TCP / IP protocol, used to perform SQL queries, data updates, data backups, and other operations.

[0108] In addition, the database management and control platform is responsible for managing and controlling all operations on the database, including user authentication, permission management, etc., and issuing usernames and passwords to the database sidecar service to connect to the database service.

[0109] In summary, the database access method for preventing user data leakage in a container of this embodiment provides a database access method that does not expose database credentials while maintaining the flexibility and transparency of the system, and has the following technical effects:

[0110] First, since the present invention uses a database sidecar service to hijack database connection requests and replace the username and password therein, the service itself does not need to store these credentials. This directly solves the problem of credentials leaking in the configuration file, improves the security of database access, and reduces the risk of credentials leaking.

[0111] Second, the database sidecar service can dynamically obtain credentials from the database management platform, which means that the update of credentials does not require service intervention. This enables dynamic management of database credentials and improves the flexibility and automation of the system.

[0112] 3. Since the database sidecar service transparently forwards requests between the business service and the database service, the business service does not need to know about the change of credentials, nor does it need to modify the existing logic. The transparency and compatibility of the business service are maintained, and the security mechanism can be integrated without modifying the existing business service.

[0113] Fourth, by controlling database access through the database sidecar service, more fine-grained security policies can be implemented, such as access control, encrypted transmission, etc. The security of the system is enhanced, and the protection of the database is improved through fine-grained access control and security policies.

[0114] 5. Since business services do not directly handle database credentials, sensitive information will not be exposed even in log records. This reduces the risk of internal R&D leaking sensitive information through logs and improves the overall security of the system.

[0115] This embodiment also provides a database access device for preventing user data leakage in a container, including:

[0116] Business service module;

[0117] The database sidecar service module is deployed in the same POD as the business service module but in a different container;

[0118] And database service module:

[0119] The business service module sends a connection establishment request to the database service module;

[0120] The database sidecar service module hijacks the connection request, parses the database protocol and modifies the user name and password in the connection request, and forwards the modified connection request to the database service module;

[0121] The database service module verifies the user name and password based on the modified connection request, and returns a response after the verification passes;

[0122] The database sidecar service module receives the response from the database service module and forwards it back to the business service module. The business service module establishes a database connection with the database service module.

[0123] The present embodiment is a database access device for preventing user data leakage in a container. By introducing a database sidecar service module between the business service module and the database service module, all database connection requests are intercepted to ensure that the business service module does not need to know the database user name and password when connecting to the database, thereby avoiding the leakage of credentials. The database sidecar service module can interact with the database management and control platform to dynamically obtain the latest database credentials without restarting or reconfiguring the service, thereby improving the flexibility and automation of the system. Business R&D cannot directly obtain the username and password information of the database connection, thereby improving the security of the database connection.

[0124] As an optional implementation of this embodiment, a database access device for preventing user data leakage in a container of this embodiment includes a data management and control platform:

[0125] The database sidecar service parses the database protocol and modifies the username and password in the connection request, including:

[0126] The database sidecar service dynamically obtains the database credentials for database connection from the database management and control platform, and the database management and control platform updates and manages the database credentials for database connection with the database service;

[0127] The database sidecar service parses the username and password data in the connection request and modifies them into the database credentials.

[0128] This embodiment is issued by the data management and control platform, and there is no need to update the database credentials manually or through the configuration platform. The present invention can realize dynamic replacement of credentials, which improves the degree of automation and flexibility. Business development can realize the security reinforcement of database access without modifying the code, realizes the non-intrusiveness of business logic, simplifies the process of user password management, and ensures the security and reliability of database connection.

[0129] Furthermore, in a database access device for preventing user data leakage in a container of this embodiment, after the business service module establishes a database connection with the database service module:

[0130] The business service module submits a data query or processing request;

[0131] The database sidecar service module receives the data query or data processing request and forwards it to the database service module. The database service module performs data query or processing according to the data query or processing request, and returns the data query or processing result to the database sidecar service module.

[0132] The database sidecar service module forwards the returned data query or processing results to the business service module.

[0133] A database access device for preventing user data leakage in a container in this embodiment realizes data connection between a business service module and a database service module through a database sidecar service module, and transparent forwarding between the two after the data connection. Transparent forwarding refers to the process of forwarding data packets by intermediate nodes in network communication without the perception of the communicating parties, thereby realizing seamless transmission of data packets.

[0134] In this embodiment, a database access device for preventing user data leakage in a container includes: after the business service module establishes a database connection with the database service module, the following steps are performed:

[0135] When the database sidecar service module does not receive a data query or processing request submitted by the business service module within a preset time period, or the database sidecar service module receives a database disconnection request submitted by the business service module;

[0136] The database sidecar service module then disconnects the data connection between the business service module and the database service module.

[0137] Furthermore, the database credential described in this embodiment becomes invalid after the business service module and the database service module disconnect the current database connection.

[0138] Embodiment 2

[0139] The following describes an electronic device embodiment of the present invention, which can be regarded as a specific physical implementation of the method and device embodiments of the present invention. The details described in the electronic device embodiment of the present invention should be regarded as a supplement to the above method or device embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above method or device embodiments.

[0140] Figure 2It is a structural schematic diagram of an electronic device according to an embodiment of the present invention, the electronic device includes a processor and a memory, the memory is used to store a computer executable program, when the computer program is executed by the processor, the processor executes a database access method for preventing user data leakage in a container according to the first embodiment.

[0141] like Figure 2 As shown, the electronic device is presented in the form of a general computing device. The processor may be one or more and work in coordination. The present invention does not exclude distributed processing, that is, the processor may be dispersed in different physical devices. The electronic device of the present invention is not limited to a single entity, but may also be the sum of multiple physical devices.

[0142] The memory stores a computer executable program, which is usually a machine-readable code. The computer-readable program can be executed by the processor to enable the electronic device to perform the method of the present invention, or at least part of the steps in the method.

[0143] The memory includes a volatile memory, such as a random access memory unit (RAM) and / or a cache memory unit, and may also be a non-volatile memory, such as a read-only memory unit (ROM).

[0144] Optionally, in this embodiment, the electronic device further includes an I / O interface, which is used for the electronic device to exchange data with an external device. The I / O interface can represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures.

[0145] It should be understood that Figure 2 The electronic device shown is only an example of the present invention, and the electronic device of the present invention may also include elements or components not shown in the above examples. For example, some electronic devices also include display units such as display screens, and some electronic devices also include human-computer interaction elements such as buttons, keyboards, etc. As long as the electronic device can execute the computer-readable program in the memory to implement the method of the present invention or at least part of the steps of the method, it can be considered as an electronic device covered by the present invention.

[0146] Figure 3 Schematic diagram of a computer readable recording medium according to an embodiment of the present invention. Figure 3As shown, a computer executable program is stored in a computer-readable recording medium, and when the computer executable program is executed, a database access method for preventing user data leakage in a container of the first embodiment of the present invention is implemented. The computer-readable recording medium may include a data signal propagated in a baseband or as part of a carrier, which carries a readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable recording medium may also be any readable medium other than a readable recording medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, device, or device. The program code contained on the readable recording medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0147] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0148] Through the above description of the implementation mode, it is easy for those skilled in the art to understand that the present invention can be implemented by hardware capable of executing a specific computer program, such as the system of the present invention, and the electronic processing unit, server, client, mobile phone, control unit, processor, etc. contained in the system. The present invention can also be implemented by computer software that executes the method of the present invention, such as control software executed by a microprocessor, an electronic control unit, a client, a server, etc. However, it should be noted that the computer software that executes the method of the present invention is not limited to being executed by one or a specific hardware entity, and it can also be implemented in a distributed manner by unspecified specific hardware. For computer software, the software product can be stored in a computer-readable recording medium (which can be a CD-ROM, a USB flash drive, a mobile disk, etc.), and can also be distributed and stored on the network, as long as it enables the electronic device to execute the method according to the present invention.

[0149] The above embodiments are only used to illustrate the present invention and are not intended to limit the technical solutions described in the present invention. Although the present invention has been described in detail with reference to the above embodiments, the present invention is not limited to the above specific implementation methods. Therefore, any modification or equivalent replacement of the present invention; and all technical solutions and improvements thereof that do not depart from the spirit and scope of the invention are included in the scope of the claims of the present invention.

Claims

1. A method for accessing a database in a container to prevent leakage of user data, characterized in that: include: The business service sends a connection request to the database service; The database sidecar service in the same POD as the business service but in a different container hijacks the connection request; The database sidecar service parses the database protocol and modifies the username and password in the connection request, and forwards the modified connection request to the database service; The database service verifies the username and password based on the modified connection request and returns a response after the verification passes. The database sidecar service receives the response from the database service and forwards it back to the business service, which then establishes a database connection with the database service.

2. A method for accessing a database in a container to prevent user data leakage according to claim 1, characterized in that: The database sidecar service parses the database protocol and modifies the username and password in the connection request, including: The database sidecar service dynamically obtains the database credentials for database connection from the database management and control platform, and the database management and control platform updates and manages the database credentials for database connection with the database service; The database sidecar service parses the username and password data in the connection request and modifies them into the database credentials.

3. A method for accessing a database in a container to prevent user data leakage according to claim 2, characterized in that: include: The database sidecar service parses the connection request and obtains the username and password data; The database sidecar service dynamically obtains the database credentials for database connection from the database management and control platform; The database sidecar service deletes the username and password data in the connection request and fills in the database credentials.

4. A method for accessing a database in a container to prevent user data leakage according to claim 2, characterized in that: include: The database sidecar service parses the connection request and fails to obtain the username and password data; The database sidecar service dynamically obtains the database credentials for database connection from the database management and control platform; The database sidecar service populates the database credentials directly into the connection request.

5. The method for accessing a database in a container to prevent user data leakage according to claim 2, characterized in that: The database management and control platform is responsible for issuing database credentials and establishing a database credential library; The database management and control platform monitors the usage status of the database credentials in the database credential library in real time, deletes the used database credentials, and issues and updates new database credentials.

6. A method for accessing a database in a container to prevent user data leakage according to claim 2, characterized in that: After the business service establishes a database connection with the database service, the following steps are included: The business service submits a data query or processing request; The database sidecar service receives the data query or data processing request and forwards it to the database service. The database service performs data query or processing according to the data query or processing request, and returns the data query or processing result to the database sidecar service. The database sidecar service forwards the returned data query or processing results to the business service.

7. A method for accessing a database in a container to prevent user data leakage according to claim 6, characterized in that: After the business service establishes a database connection with the database service, the following steps are included: When the database sidecar service does not receive a data query or processing request submitted by the business service within a preset time period, or the database sidecar service receives a database disconnection request submitted by the business service; The database sidecar service then disconnects the data connection between the business service and the database service.

8. A method for accessing a database in a container to prevent user data leakage according to claim 7, characterized in that: The database credential becomes invalid after the business service and the database service disconnect the current database connection.

9. A database access device for preventing user data leakage in a container, characterized in that: include: Business service module; The database sidecar service module is deployed in the same POD as the business service module but in a different container; And database service module: The business service module sends a connection establishment request to the database service module; The database sidecar service module hijacks the connection request, parses the database protocol and modifies the user name and password in the connection request, and forwards the modified connection request to the database service module; The database service module verifies the user name and password based on the modified connection request, and returns a response after the verification passes; The database sidecar service module receives the response from the database service module and forwards it back to the business service module. The business service module establishes a database connection with the database service module.

10. A computer-readable recording medium storing a computer-executable program, characterized in that: When the computer executable program is executed, a method for accessing a database in a container to prevent leakage of user data is implemented as described in any one of claims 1 to 8.

Images