A method and device for allocating accounts to applications

Abstract

The present invention provides a method and device for allocating accounts to applications, which belongs to big data. The method includes: determining a configuration template according to application information; sending the configuration template to a computing engine, parsing and calculating to obtain an account index; obtaining account information through a database storage location authorization manager according to the account index; wherein the database storage location authorization manager is used for generating and storing accounts; establishing a connection with a database according to the account information, and responding the account index to the application. The present invention can improve the security in the database development process.

Description

Technical Field

[0001] The present invention relates to the technical field of computer data processing, and in particular to a method and device for allocating accounts to applications. Background Art

[0002] This section is intended to provide a background or context to embodiments of the invention that are recited in the claims. No description herein is admitted to be prior art by inclusion in this section.

[0003] During the software development process, the DBA usually assigns you a fixed account and password, and then the RD uses these accounts and passwords to connect to the database for development. This will lead to several security risks:

[0004] Developers who know these accounts and passwords can operate the database at will;

[0005] Account numbers and passwords have the potential for transmission. If they are used illegally, the consequences are unimaginable.

[0006] The account and password are in plain text and not encrypted;

[0007] Multiple applications share the same account and password, which makes it impossible to conduct statistics and measurements; even if problems arise, it is difficult to track and hold accountable.

[0008] Therefore, how to provide a new solution that can solve the above technical problems is a technical problem that needs to be solved urgently in this field. Summary of the invention

[0009] An embodiment of the present invention provides a method for allocating accounts to applications, which can improve the security during database development. The method includes:

[0010] Determine the configuration template based on the application information;

[0011] Send the configuration template to the computing engine, parse and calculate to obtain the account index;

[0012] According to the account index, the account information is obtained through the database storage location authorization manager; wherein the database storage location authorization manager is used for generating and storing the account;

[0013] Establish a connection with the database based on the account information and respond the account index to the application.

[0014] When implementing a method for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, determining a configuration template according to application information includes:

[0015] According to the application information, fill in the configuration domain threshold in accordance with the configuration template format. After the configuration domain threshold is filled, perform base64 conversion to determine the configuration template.

[0016] When implementing a method for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, filling a configuration domain threshold includes:

[0017] According to the application information, obtain the application English ID, encryption salt string and account index as the application identification ID;

[0018] According to the English identifier, the encrypted salt string and the account index, the first signature value is determined by MD5 calculation as the tamper-proof calculation identifier;

[0019] Fill in the configuration domain threshold with the application English ID, encryption salt string, account index, and first signature value.

[0020] When implementing a method for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, a configuration template is sent to a computing engine, and an account index is obtained by parsing and computing, including:

[0021] Send the configuration template to the computing engine, perform base64 decryption, and parse and calculate the account index.

[0022] When implementing a method for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, obtaining account information through a database storage location authorization manager according to an account index includes:

[0023] Use the computing engine to parse the configuration template again to obtain the application English ID, encryption salt string, account index, and the value of the first signature value;

[0024] Add the values ​​of the application English identifier, the encrypted salt string, and the account index and perform MD5 calculation to determine the second signature value;

[0025] Comparing the first signature value with the second signature value through a computing engine;

[0026] If the first signature value is equal to the second signature value, determine whether the value of the account index is empty;

[0027] When the value of the account index is not empty, determine whether the account index is expired;

[0028] If the account index is not expired, the calculation engine uses the account index to obtain the account information from the database storage location authorization manager.

[0029] When specifically implementing a method for assigning an account to an application provided by an embodiment of the present invention, in one embodiment, when comparing the first signature value with the second signature value, if the first signature value is not equal to the second signature value, it is determined that the application request information has been tampered with, and security interception is implemented.

[0030] When implementing a method for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, when determining whether the value of the account index is empty, when the value of the account index is empty, new database account information and a new index account and an expiration policy are allocated;

[0031] The new database account information, the new index account, and the expiration policy are generated and stored in the database storage location authorization manager.

[0032] When specifically implementing a method for allocating accounts to applications provided by an embodiment of the present invention, in one embodiment, when determining whether an account index is expired, if the account index is expired, the expiration policy is modified, the expiration time is reset, and the newly set expiration time is generated and stored in a database storage location authorization manager.

[0033] When implementing a method for allocating accounts to applications provided by an embodiment of the present invention, in one embodiment, it further includes: after responding the account index to the application, the application uses the account index to render and back up local template files.

[0034] An embodiment of the present invention further provides a device for allocating accounts to applications, comprising:

[0035] A configuration template determination module, used to determine a configuration template according to application information;

[0036] The account index calculation module is used to send the configuration template to the calculation engine, parse and calculate to obtain the account index;

[0037] An account information acquisition module is used to acquire account information through a database storage location authorization manager according to an account index; wherein the database storage location authorization manager is used to generate and store accounts;

[0038] The database connection module is used to establish a connection with the database based on the account information and respond the account index to the application.

[0039] When implementing a device for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, a configuration template determination module is specifically used to:

[0040] According to the application information, fill in the configuration domain threshold in accordance with the configuration template format. After the configuration domain threshold is filled, perform base64 conversion to determine the configuration template.

[0041] When implementing a device for allocating accounts to applications provided by an embodiment of the present invention, in one embodiment, the configuration template determination module is further used to:

[0042] According to the application information, obtain the application English ID, encryption salt string and account index as the application identification ID;

[0043] According to the English identifier, the encrypted salt string and the account index, the first signature value is determined by MD5 calculation as the tamper-proof calculation identifier;

[0044] Fill in the configuration domain threshold with the application English ID, encryption salt string, account index, and first signature value.

[0045] When implementing a device for allocating accounts to applications provided by an embodiment of the present invention, in one embodiment, the account index calculation module is specifically used to:

[0046] Send the configuration template to the computing engine, perform base64 decryption, and parse and calculate the account index.

[0047] When implementing a device for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, the account information acquisition module is specifically used to:

[0048] Use the computing engine to parse the configuration template again to obtain the application English ID, encryption salt string, account index, and the value of the first signature value;

[0049] Add the values ​​of the application English identifier, the encrypted salt string, and the account index and perform MD5 calculation to determine the second signature value;

[0050] Comparing the first signature value with the second signature value through a computing engine;

[0051] If the first signature value is equal to the second signature value, determine whether the value of the account index is empty;

[0052] When the value of the account index is not empty, determine whether the account index is expired;

[0053] If the account index is not expired, the calculation engine uses the account index to obtain the account information from the database storage location authorization manager.

[0054] When a device for assigning an account to an application provided by an embodiment of the present invention is specifically implemented, in one embodiment, the account information acquisition module is also used to: when comparing the first signature value with the second signature value, if the first signature value is not equal to the second signature value, it is determined that the application request information has been tampered with, and security interception is implemented.

[0055] When implementing a device for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, the account information acquisition module is further used to: when determining whether the value of the account index is empty, when the value of the account index is empty, allocate new database account information and a new index account and an expiration policy;

[0056] The new database account information, the new index account, and the expiration policy are generated and stored in the database storage location authorization manager.

[0057] When implementing a device for allocating accounts to applications provided by an embodiment of the present invention, in one embodiment, the account information acquisition module is also used to: when determining whether an account index is expired, if the account index is expired, modify the expiration policy, reset the expiration time, and generate and store the newly set expiration time in the database storage location authorization manager.

[0058] When implementing a device for allocating accounts to applications provided by an embodiment of the present invention, in one embodiment, the database connection module is further used to: after responding the account index to the application, the application uses the account index to render and back up local template files.

[0059] An embodiment of the present invention further provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned method of allocating accounts to applications when executing the computer program.

[0060] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for executing the above method for allocating accounts to applications.

[0061] The embodiment of the present invention provides a method and device for allocating accounts to applications, including: determining a configuration template based on application information; sending the configuration template to a computing engine, parsing and calculating to obtain an account index; obtaining account information through a database storage location authorization manager based on the account index; wherein the database storage location authorization manager is used to generate and store accounts; establishing a connection with a database based on the account information, and responding the account index to the application. The embodiment of the present invention provides a solution for dynamically generating accounts for applications through a configuration template + rule rendering method, in which even RD does not know the online user name and password of his own application, effectively preventing internal members from threatening DB security. Each application has its own user and password, and the database account password can be changed regularly to ensure the security of the database account without requiring the application to make any changes, limiting the number of connections and operation permissions of a single user, and improving the security of the database development process. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0063] Figure 1 The figure is a schematic diagram of a method for allocating accounts to applications according to an embodiment of the present invention.

[0064] Figure 2 The present invention is a schematic diagram of a method for allocating accounts to applications according to an embodiment of the present invention.

[0065] Figure 3 The present invention is a flowchart of a method for allocating accounts to applications according to an embodiment of the present invention.

[0066] Figure 4 This is a schematic diagram before base64 conversion of a method for allocating accounts to applications according to an embodiment of the present invention.

[0067] Figure 5 This is a schematic diagram after base64 conversion of a method for allocating accounts to applications according to an embodiment of the present invention.

[0068] Figure 6 A schematic diagram of a computer device for executing a method for allocating accounts to applications according to the present invention.

[0069] Figure 7 The present invention is a schematic diagram of a device for allocating accounts to applications according to an embodiment of the present invention. DETAILED DESCRIPTION

[0070] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0071] The present invention belongs to big data technology. Figure 1 FIG. 1 is a schematic diagram of a method for allocating accounts to applications according to an embodiment of the present invention. Figure 1 As shown, an embodiment of the present invention provides a method for allocating accounts to applications, which can improve the security of the database development process. The method includes:

[0072] Step 101: Determine a configuration template according to application information;

[0073] Step 102: Send the configuration template to the calculation engine, parse and calculate to obtain the account index;

[0074] Step 103: According to the account index, the account information is obtained through the database storage location authorization manager; wherein the database storage location authorization manager is used for generating and storing the account;

[0075] Step 104: Establish a connection with the database based on the account information, and respond to the application with the account index.

[0076] A method for allocating accounts to applications provided by an embodiment of the present invention includes: determining a configuration template based on application information; sending the configuration template to a computing engine, parsing and calculating to obtain an account index; obtaining account information through a database storage location authorization manager based on the account index; wherein the database storage location authorization manager is used to generate and store accounts; establishing a connection with a database based on the account information, and responding the account index to the application. An embodiment of the present invention provides a solution for dynamically generating accounts for applications through a configuration template + rule rendering method, in which even RDs do not know the online user names and passwords of their own applications, effectively preventing internal members from threatening DB security. Each application has its own user and password, and the database account password can be changed regularly to ensure database account security without requiring the application to make any modifications, limiting the number of connections and operation permissions of a single user, and improving the security of the database development process.

[0077] In the embodiment of the present invention, the professional vocabulary designed is as follows:

[0078] RD: Abbreviation for Research & Develop, translated into Chinese as software engineer;

[0079] DB: The abbreviation of DataBase, translated into Chinese as database;

[0080] DBA: Abbreviation for Database Administrator, translated into Chinese as database administrator;

[0081] MD5: an irreversible encryption algorithm;

[0082] JSON: JavaScript Object Notation is a lightweight data exchange format. It is easy to read and understand, and also easy for machines to parse and generate.

[0083] Key: md5 index string of account and password. The corresponding account and password information can be found through Key;

[0084] Database instance: A collection of background processes and database files. For example, a SQL Server server is an instance;

[0085] Application: A physically existing software system;

[0086] MD5 encryption algorithm: a widely used cryptographic hash function with strong complexity and irreversibility, which can generate a 128-bit (16-byte) hash value and is widely used in the field of encryption protection of ordinary data. The present invention is mainly used for account password index encryption;

[0087] Base64: Base64 is one of the most common encoding methods for transmitting 8-bit bytecodes on the Internet. Base64 is a method for representing binary data based on 64 printable characters. The present invention mainly uses it to store application template files locally to avoid displaying information in plain text.

[0088] Figure 2 FIG. 1 is an architecture diagram of a method for allocating accounts to applications according to an embodiment of the present invention. Figure 2 As shown, the present application provides a method for dynamically allocating database users to applications by configuring templates + rule rendering. The main process includes:

[0089] Provide configuration templates, and each application configures the content of the templates as required. The content configuration is used to identify the application and as a calculation factor for the account and password. The engine parses the application configuration template and dynamically generates the account and password according to certain rules. It stores them in the result set storage area and generates an MD5 string response to the requesting application by encrypting the index of the account and password through MD5. The database storage location authorization manager (DB-AccountManager) is used to provide the result set storage function and the account generation function.

[0090] Figure 3 FIG. 1 is a flow chart of a method for allocating accounts to applications according to an embodiment of the present invention. Figure 3 As shown, when a method for allocating an account to an application provided by an embodiment of the present invention is specifically implemented, in one embodiment, it may include:

[0091] Determine the configuration template based on the application information;

[0092] Send the configuration template to the computing engine, parse and calculate to obtain the account index;

[0093] According to the account index, the account information is obtained through the database storage location authorization manager (DB-AccountManager); wherein the database storage location authorization manager is used for generating and storing accounts;

[0094] Establish a connection with the database based on the account information and respond the account index to the application.

[0095] When implementing a method for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, determining a configuration template according to application information includes:

[0096] According to the application information, fill in the configuration domain threshold in accordance with the configuration template format. After the configuration domain threshold is filled, perform base64 conversion to determine the configuration template.

[0097] The application fills in the corresponding domain values ​​according to the configuration template format, converts the content into base64 and saves it in a txt file, and sends the configuration template to the computing engine; Figure 4 Before base64 conversion, Figure 5 After base64 conversion.

[0098] When implementing a method for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, filling a configuration domain threshold includes:

[0099] According to the application information, obtain the application English ID, encryption salt string and account index as the application identification ID;

[0100] According to the English identifier, the encrypted salt string and the account index, the first signature value sign is determined by MD5 calculation as the tamper-proof calculation identifier;

[0101] Fill in the configuration domain threshold with the application English ID, encryption salt string, account index, and first signature value sign.

[0102] In the embodiment, the configuration template: the rendering template is a json format file, which contains several configuration fields, as follows:

[0103]

[0104] The combination of appName+key+salt is used as the identification of the application, the first signature value sign is used for anti-tampering calculation, and the template generation is sent to the rule engine.

[0105] When implementing a method for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, a configuration template is sent to a computing engine, and an account index is obtained by parsing and computing, including:

[0106] Send the configuration template to the computing engine, perform base64 decryption, and parse and calculate the account index.

[0107] In the embodiment, the computing engine is used to parse the configuration template json content, calculate the key, and find the corresponding database corresponding account information from the result set storage area.

[0108] Result set storage area: HashMap is used to store the key-value of database user information. The result set storage area is maintained by the DBA.

[0109] The calculation engine exists in the form of an SDK, and the application is embedded in the SDK. The SDK is responsible for connecting the application client and the database storage location authorization manager. After obtaining the database account information from the database storage location authorization manager according to the rendering template, it is responsible for establishing a connection with the database.

[0110] Database storage location authorization manager: The DBA maintains and generates an API to obtain database account information for the calculation engine to call. The result set storage area can be in the form of a table in the DB itself, which is shown in Table 1 below:

[0111] Table 1

[0112]

[0113]

[0114] Configuration template: exists in the form of a txt file and is used to interact with the computing engine.

[0115] When implementing a method for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, obtaining account information through a database storage location authorization manager according to an account index includes:

[0116] Use the computing engine to parse the configuration template again to obtain the application English ID, encryption salt string, account index, and the value of the first signature value;

[0117] Add the values ​​of the application English identifier, the encryption salt string, and the account index and perform MD5 calculation to determine the second signature value sign1;

[0118] Compare the first signature value sign with the second signature value sign1 through the computing engine;

[0119] If the first signature value sign is equal to the second signature value sign1, determine whether the value of the account index is empty;

[0120] When the value of the account index is not empty, determine whether the account index is expired;

[0121] If the account index is not expired, the calculation engine uses the account index to obtain the account information from the database storage location authorization manager.

[0122] In the embodiment, after the computing engine base64 decrypts, the values ​​of appName, salt, the first signature value sign, and key are respectively parsed according to the decrypted values, and the values ​​of appName, salt, and key are added and then MD5 is performed to obtain the second signature value sign1, that is, sign1 = MD5 (value (appName) + value (salt) + value (key));

[0123] The computing engine determines that sign1 == sign. If they are not equal, it means that the application request information has been tampered with; if they are equal, continue to 4);

[0124] The calculation engine determines that key==””, that is, if it is an empty string, it needs to allocate new data account information, new key and expiration policy; if it is not empty, it determines whether the key is expired. If not, the calculation engine obtains the account information from the database storage location authorization manager according to the key;

[0125] Otherwise, the calculation engine generates and stores the key, account information, and expiration policy through the database storage location authorization manager. The key calculation method is:

[0126] key=MD5(value(appName)+value(salt));

[0127] The computing engine establishes a connection with the data based on the obtained account information and responds the key to the application;

[0128] After the application obtains the key, it renders and backs up the local template file.

[0129] When specifically implementing a method for assigning an account to an application provided by an embodiment of the present invention, in one embodiment, when comparing the first signature value sign with the second signature value sign1, if the first signature value sign is not equal to the second signature value sign1, it is determined that the application request information has been tampered with, and security interception is implemented.

[0130] When implementing a method for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, when determining whether the value of the account index is empty, when the value of the account index is empty, new database account information and a new index account and an expiration policy are allocated;

[0131] The new database account information, the new index account, and the expiration policy are generated and stored in the database storage location authorization manager.

[0132] When specifically implementing a method for allocating accounts to applications provided by an embodiment of the present invention, in one embodiment, when determining whether an account index is expired, if the account index is expired, the expiration policy is modified, the expiration time is reset, and the newly set expiration time is generated and stored in a database storage location authorization manager.

[0133] When implementing a method for allocating accounts to applications provided by an embodiment of the present invention, in one embodiment, it also includes: after responding the account index to the application, the application uses the account index to render and back up the local template file; the above rendering refers to configuring and filling the local template file.

[0134] The key points of the embodiments of the present invention are:

[0135] Provides a tamper-proof protection method during information transmission;

[0136] Database account information can be dynamically allocated based on application granularity;

[0137] Prevent database account information from being transmitted in plain text;

[0138] Design ideas of calculation engine and configuration template;

[0139] The interaction logic between the calculation engine and configuration template;

[0140] It provides a solution to dynamically generate accounts for applications by configuring templates + rule rendering.

[0141] The protection point of the embodiment of the present invention lies in: a solution for dynamically generating accounts for applications by configuring templates + rule rendering; the design concept and interaction logic of the two devices of the computing engine and the configuration template in the invention.

[0142] The benefits of the present invention are:

[0143] Even the RD does not know the online username and password of his or her application, which effectively prevents internal members from threatening the DB security.

[0144] Each application has its own user and password

[0145] Once a dangerous operation is discovered, the user who initiated it can be quickly located based on the database log, and then the application can be located, and the project leader can be contacted immediately for intervention.

[0146] We can limit the flow, disable and other operations for this user without affecting other applications.

[0147] We can change the database account password regularly to ensure the security of the database account without requiring the application to make any changes (after the DBA initiates the replacement, it can render the template and restart the application serially).

[0148] Limit the number of connections and operation permissions of a single user

[0149] Different applications require different permissions, following the principle of "minimum permissions"

[0150] Avoid malicious operations (or internal misoperations) that may cause the number of connections to explode and affect the availability of the DB instance.

[0151] The following briefly describes a method for allocating accounts to applications provided by an embodiment of the present invention in conjunction with a specific scenario:

[0152] 1) The application fills in the corresponding domain values ​​according to the configuration template format, converts the content into base64 and saves it in a txt file, and sends the configuration template to the calculation engine;

[0153] 2) After the computing engine decrypts the base64, it parses the values ​​of appName, salt, sign, and key according to the decrypted values, adds the values ​​of appName, salt, and key, and performs MD5 to obtain sign1, that is, sign1 = MD5 (value (appName) + value (salt) + value (key));

[0154] 3) The computing engine determines that sign1 == sign. If they are not equal, it means that the application request information has been tampered with; if they are equal, continue to 4);

[0155] 4) The computing engine determines that key == "", that is, if it is an empty string, it needs to allocate new data account information, new key, and expiration policy; if it is not empty, it determines whether the key is expired, and if not, proceeds to 6);

[0156] Otherwise, proceed to step 5). The key is calculated as follows:

[0157] key=MD5(value(appName)+value(salt));

[0158] 5) The computing engine generates and stores the key, account information, and expiration policy through the database storage location authorization manager;

[0159] 6) The computing engine obtains the account information from the authorization manager at the database storage location according to the key;

[0160] 7) The computing engine establishes a connection with the data based on the obtained account information and responds the key to the application;

[0161] 8) After the application obtains the key, it renders and backs up the local template file.

[0162] Figure 6 A schematic diagram of a computer device for executing a method for allocating accounts to applications implemented by the present invention, such as Figure 6 As shown, an embodiment of the present invention further provides a computer device 600, including a memory 610, a processor 620, and a computer program 630 stored in the memory and executable on the processor, wherein the processor implements the above-mentioned method of assigning an account to an application when executing the computer program.

[0163] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for executing the above method of allocating accounts to applications.

[0164] The present invention also provides a device for allocating accounts to applications, as described in the following embodiments. Since the principle of solving the problem by the device is similar to that of a method for allocating accounts to applications, the implementation of the device can refer to the implementation of a method for allocating accounts to applications, and the repeated parts will not be repeated.

[0165] Figure 7 FIG. 1 is a schematic diagram of a device for allocating accounts to applications according to an embodiment of the present invention. Figure 7 As shown, the embodiment of the present invention also provides a device for allocating accounts to applications, which may include:

[0166] Configuration template determination module 701, used to determine the configuration template according to the application information;

[0167] An account index calculation module 702 is used to send the configuration template to the calculation engine, and parse and calculate to obtain the account index;

[0168] The account information acquisition module 703 is used to acquire the account information through the database storage location authorization manager according to the account index; wherein the database storage location authorization manager is used to generate and store the account;

[0169] The database connection module 704 is used to establish a connection with the database according to the account information and respond the account index to the application.

[0170] When implementing a device for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, a configuration template determination module is specifically used to:

[0171] According to the application information, fill in the configuration domain threshold in accordance with the configuration template format. After the configuration domain threshold is filled, perform base64 conversion to determine the configuration template.

[0172] When implementing a device for allocating accounts to applications provided by an embodiment of the present invention, in one embodiment, the configuration template determination module is further used to:

[0173] According to the application information, obtain the application English ID, encryption salt string and account index as the application identification ID;

[0174] According to the English identifier, the encrypted salt string and the account index, the first signature value is determined by MD5 calculation as the tamper-proof calculation identifier;

[0175] Fill in the configuration domain threshold with the application English ID, encryption salt string, account index, and first signature value.

[0176] When implementing a device for allocating accounts to applications provided by an embodiment of the present invention, in one embodiment, the account index calculation module is specifically used to:

[0177] Send the configuration template to the computing engine, perform base64 decryption, and parse and calculate the account index.

[0178] When implementing a device for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, the account information acquisition module is specifically used to:

[0179] Use the computing engine to parse the configuration template again to obtain the application English ID, encryption salt string, account index, and the value of the first signature value;

[0180] Add the values ​​of the application English identifier, the encrypted salt string, and the account index and perform MD5 calculation to determine the second signature value;

[0181] Comparing the first signature value with the second signature value through a computing engine;

[0182] If the first signature value is equal to the second signature value, determine whether the value of the account index is empty;

[0183] When the value of the account index is not empty, determine whether the account index is expired;

[0184] If the account index is not expired, the calculation engine uses the account index to obtain the account information from the database storage location authorization manager.

[0185] When a device for assigning an account to an application provided by an embodiment of the present invention is specifically implemented, in one embodiment, the account information acquisition module is also used to: when comparing the first signature value with the second signature value, if the first signature value is not equal to the second signature value, it is determined that the application request information has been tampered with, and security interception is implemented.

[0186] When implementing a device for allocating an account to an application provided by an embodiment of the present invention, in one embodiment, the account information acquisition module is further used to: when determining whether the value of the account index is empty, when the value of the account index is empty, allocate new database account information and a new index account and an expiration policy;

[0187] The new database account information, the new index account, and the expiration policy are generated and stored in the database storage location authorization manager.

[0188] When implementing a device for allocating accounts to applications provided by an embodiment of the present invention, in one embodiment, the account information acquisition module is also used to: when determining whether an account index is expired, if the account index is expired, modify the expiration policy, reset the expiration time, and generate and store the newly set expiration time in the database storage location authorization manager.

[0189] When implementing a device for allocating accounts to applications provided by an embodiment of the present invention, in one embodiment, the database connection module is further used to: after responding the account index to the application, the application uses the account index to render and back up local template files.

[0190] In summary, the embodiment of the present invention provides a method and device for allocating accounts to applications, including: determining a configuration template based on application information; sending the configuration template to a computing engine, parsing and calculating to obtain an account index; obtaining account information through a database storage location authorization manager based on the account index; establishing a connection with a database based on the account information, and responding the account index to the application. The embodiment of the present invention provides a solution for dynamically generating accounts for applications through a configuration template + rule rendering method. Even RDs do not know the online username and password of their own applications, which effectively prevents internal members from posing a threat to DB security. Each application has its own user and password, and the database account password can be changed regularly to ensure the security of the database account without requiring the application to make any changes. The number of connections and operation permissions of a single user are limited, which improves the security of the database development process.

[0191] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0192] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0193] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0194] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0195] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for allocating accounts to applications, characterized in that: include: Determine the configuration template based on the application information; Send the configuration template to the computing engine, parse and calculate to obtain the account index; According to the account index, the account information is obtained through the database storage location authorization manager; wherein the database storage location authorization manager is used for generating and storing the account; Establish a connection with the database based on the account information and respond the account index to the application; Determine the configuration template, including: According to the application information, fill in the configuration domain threshold according to the configuration template format. After the configuration domain threshold is filled, perform base64 conversion to determine the configuration template. Populate the configuration domain thresholds, including: According to the application information, obtain the application English ID, encryption salt string and account index as the application identification ID; According to the English identifier, the encrypted salt string and the account index, the first signature value is determined by MD5 calculation as the tamper-proof calculation identifier; Fill the application English ID, encryption salt string, account index and first signature value into the configuration domain threshold; According to the account index, the account information is obtained through the database storage location authorization manager, including: Use the computing engine to parse the configuration template again to obtain the application English ID, encryption salt string, account index, and the value of the first signature value; Add the values ​​of the application English identifier, the encrypted salt string, and the account index and perform MD5 calculation to determine the second signature value; Comparing the first signature value with the second signature value through a computing engine; If the first signature value is equal to the second signature value, determine whether the value of the account index is empty; When the value of the account index is not empty, determine whether the account index is expired; If the account index is not expired, the calculation engine uses the account index to obtain the account information from the database storage location authorization manager.

2. The method according to claim 1, characterized in that Send the configuration template to the computing engine, parse and calculate to obtain the account index, including: Send the configuration template to the computing engine for base64 decryption and parsing to calculate the account index.

3. The method according to claim 1, characterized in that When comparing the first signature value with the second signature value, if the first signature value is not equal to the second signature value, it is determined that the application request information has been tampered with, and security interception is implemented.

4. The method according to claim 1, characterized in that When determining whether the value of the account index is empty, if the value of the account index is empty, new database account information, new index account, and expiration policy are allocated; The new database account information, the new index account, and the expiration policy are generated and stored in the database storage location authorization manager.

5. The method according to claim 1, characterized in that When determining whether the account index is expired, if the account index is expired, the expiration policy is modified, the expiration time is reset, and the newly set expiration time is generated and stored in the database storage location authorization manager.

6. The method according to claim 1, characterized in that Also includes: After the account index is responded to the application, the application uses the account index to render and back up local template files.

7. A device for allocating accounts to applications, characterized in that: include: A configuration template determination module, used to determine a configuration template according to application information; The account index calculation module is used to send the configuration template to the calculation engine, parse and calculate to obtain the account index; An account information acquisition module is used to acquire account information through a database storage location authorization manager according to an account index; wherein the database storage location authorization manager is used to generate and store accounts; The database connection module is used to establish a connection with the database based on the account information and respond the account index to the application; The configuration template determines the module, which is specifically used for: According to the application information, fill in the configuration domain threshold according to the configuration template format. After the configuration domain threshold is filled, perform base64 conversion to determine the configuration template. The configuration template determines the module, which is also used to: According to the application information, obtain the application English ID, encryption salt string and account index as the application identification ID; According to the English identifier, the encrypted salt string and the account index, the first signature value is determined by MD5 calculation as the tamper-proof calculation identifier; Fill the application English ID, encryption salt string, account index and first signature value into the configuration domain threshold; The account information acquisition module is specifically used for: Use the computing engine to parse the configuration template again to obtain the application English ID, encryption salt string, account index, and the value of the first signature value; Add the values ​​of the application English identifier, the encrypted salt string, and the account index and perform MD5 calculation to determine the second signature value; Comparing the first signature value with the second signature value through a computing engine; If the first signature value is equal to the second signature value, determine whether the value of the account index is empty; When the value of the account index is not empty, determine whether the account index is expired; If the account index is not expired, the calculation engine uses the account index to obtain the account information from the database storage location authorization manager.

8. The device according to claim 7, characterized in that Account index calculation module, specifically used for: Send the configuration template to the computing engine, perform base64 decryption, and parse and calculate the account index.

9. The device according to claim 7, characterized in that The account information acquisition module is also used to: when comparing the first signature value with the second signature value, if the first signature value is not equal to the second signature value, determine that the application request information has been tampered with and implement security interception.

10. The device according to claim 7, characterized in that The account information acquisition module is also used to: when determining whether the value of the account index is empty, if the value of the account index is empty, allocate new database account information and a new index account and expiration policy; The new database account information, the new index account, and the expiration policy are generated and stored in the database storage location authorization manager.

11. The device according to claim 7, characterized in that The account information acquisition module is also used to: when determining whether the account index is expired, if the account index is expired, modify the expiration policy, reset the expiration time, and generate and store the newly set expiration time in the database storage location authorization manager.

12. The device according to claim 7, characterized in that The database connection module is also used to: after responding the account index to the application, the application uses the account index to render and back up the local template file.

13. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 6.

Images