A method, device and electronic device for enhancing application data security based on database drive

Abstract

The embodiments of the present invention disclose a method, device and electronic device for enhancing the security of application data based on database drive. The method includes modifying the original database drive, configuring a pseudo account and password in the enhanced database driver and presetting different modes, presetting the security policies of regularly modifying passwords and triggering different modes in the identity enhancement control system, and implementing the regular password modification and changing the pseudo account to a real account by the identity enhancement control system, and synchronizing it to the enhanced database driver. When different modes of the enhanced database driver are triggered, the enhanced database driver will adopt different strategies to restrict the release of data. Through the above-mentioned methods, the embodiments of the present invention can enhance the authentication of the database built into the application system, and at the same time, when there is suspicious behavior in the operation of each application, timely and effective control is carried out to protect data security.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of data security, and in particular to a method, device and electronic device for enhancing application data security based on database drive. Background Art

[0002] Applications are at the boundaries of enterprises, but their importance to enterprises is self-evident. Applications contain important information such as built-in database accounts and passwords. Once hackers break into the application, important information such as built-in database accounts and passwords in the application will be leaked. With the information obtained, hackers can further pose a greater threat to the database, gain higher permissions, and bring greater losses to the enterprise.

[0003] Currently, the common approach to this threat is to directly configure encrypted password information in the application's database configuration file to prevent plaintext password leakage. However, this approach still lacks effective management of the application's built-in database account and password, does not regularly update passwords, and lacks effective management of requirements such as password strength. Summary of the invention

[0004] The main technical problem solved by the embodiments of the present invention is to provide a method, device and electronic device for enhancing application data security based on database drive.

[0005] To solve the above technical problems, in the first aspect, an embodiment of the present invention provides a database-driven application data security enhancement method, comprising: presetting a strict mode and a loose mode in an enhanced database driver; presetting a security policy in an identity enhancement control system, wherein the security policy is used to periodically modify the account password of the database and trigger the mode selection of the enhanced database driver; configuring a database pseudo account and password in the enhanced database driver; the identity enhancement control system periodically reads the pseudo account and password of the database through the enhanced database driver according to the preset security policy; the identity enhancement control system periodically sends an instruction to change the built-in account and password to the database according to the read pseudo account and password, and changes the database built-in account and password; the enhanced database driver sends a modification authentication request, built-in account and password information to the database, requesting authentication whether the built-in account and password have been synchronized, and the database sends the authentication result to the enhanced database driver. If the authentication result is no, the changed built-in account and password are synchronized to the enhanced database driver.

[0006] In one embodiment of the present invention, when the login of the built-in account of the application database accesses the database, the enhanced database driver parses the login request of the application and the SQL instruction executed by the application. When the login of the built-in account of the application database is successful or the SQL instruction is executed correctly, the enhanced database driver releases data to the application normally; when the login of the built-in account of the application database fails or the SQL instruction is executed incorrectly: when the enhanced database driver triggers the strict mode, the administrator chooses whether to reply with the release verification code, the enhanced database driver obtains the release verification code from the identity enhancement control system, and the application database connection module sends the release verification code to the enhanced database driver for verification, and the enhanced database driver returns the verification result to the application database connection module. If the verification is correct, the data is released; if the verification is wrong, the data is not released; when the enhanced database driver triggers the loose mode, the enhanced database driver sends an alarm message to the administrator for early warning.

[0007] In one embodiment of the present invention, the identity enhancement control system and the enhanced database driver are both deployed in a network of application systems and databases.

[0008] In one embodiment of the present invention, the identity enhancement control system manages multiple enhanced database drivers in a unified manner, and the administrator configures security policies.

[0009] In one embodiment of the present invention, in the strict mode, if the application system account triggers a login failure or multiple statement executions fail, the administrator is required to reply with a release verification code;

[0010] In the loose mode, the enhanced database driver program will send an alarm message to the corresponding administrator.

[0011] In one embodiment of the present invention, the SQL instruction is associated with a database built-in account, and the database built-in account information and SQL execution error information can be obtained by parsing the SQL instruction. The SQL instruction is parsed by the enhanced database driver.

[0012] In a second aspect, an embodiment of the present invention provides a database-driven application data security enhancement device, the device comprising: an identity enhancement control module, communicating with an enhanced database driver module and a database, the identity enhancement control module being preset with a security policy, the security policy being used to periodically modify an account password of the database and trigger a mode selection of the enhanced database driver module, the identity enhancement control module periodically reading a pseudo account and password in the enhanced database driver module according to the preset security policy, and periodically sending an instruction to change a built-in account and password to the database according to the pseudo account and password read, changing the database built-in account and password, and then synchronizing the changed built-in account and password to the enhanced database driver module;

[0013] The enhanced database driver module communicates with the identity enhancement control module and the database. The enhanced database driver module is preset with a strict mode and a loose mode. The enhanced database driver module is configured with a database pseudo account and password. The enhanced database driver module is used to parse SQL instructions and login requests of the application, and choose whether to release data based on the parsing results.

[0014] In one embodiment of the present invention, the application database connection module communicates with the enhanced database driver module. If the enhanced database driver module triggers the strict mode, when the built-in account fails to log in multiple times or the SQL instruction execution fails multiple times, the administrator chooses whether to reply with a release verification code. The enhanced database driver program obtains the release verification code from the identity enhancement control system, and the application database connection module sends the release verification code to the enhanced database driver program for verification. The enhanced database driver program returns the verification result to the application database connection module. If the verification is correct, the data is released; if the verification is wrong, the data is not released; when the enhanced database driver module triggers the loose mode, the enhanced database driver module sends an alarm message to the administrator for early warning.

[0015] In a third aspect, an embodiment of the present invention provides an electronic device, characterized in that it comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a database-driven application data security enhancement method as described above.

[0016] In a fourth aspect, an embodiment of the present invention provides a non-volatile computer storage medium, characterized in that the computer storage medium stores computer executable instructions, which are executed by one or more processors, enabling the one or more processors to execute a database-driven application data security enhancement method as described above.

[0017] The beneficial effects of the embodiments of the present invention are as follows: Different from the prior art, the embodiments of the present invention transform the original database driver, configure a pseudo account and password in the enhanced database driver and preset different modes, preset the security policies of regularly modifying passwords and triggering different modes in the identity enhancement control system, and the identity enhancement control system implements regular password modification and changes the pseudo account to a real account, and synchronizes it to the enhanced database driver. When different modes of the enhanced database driver are triggered, the enhanced database driver will adopt different strategies to restrict the release of data. In the above manner, the embodiments of the present invention can enhance the authentication of the database built into the application system, and at the same time, when there is suspicious behavior in the operation of each application, timely and effective control is carried out to protect data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a flowchart of a method for enhancing application data security based on database drive provided by an embodiment of the present invention;

[0019] Figure 2 It is a structural schematic diagram of an application data security enhancement device based on database drive provided by an embodiment of the present invention;

[0020] Figure 3 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention.

[0021] The following is a description of the reference numerals:

[0022] 10: A database-driven application data security enhancement device;

[0023] 100: identity enhancement control module; 200: enhanced database driver module; 300: application database connection module; 400: database;

[0024] 500: electronic device; 501: processor; 502: memory. DETAILED DESCRIPTION

[0025] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several variations and improvements may be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0026] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0027] It should be noted that, if there is no conflict, the various features in the embodiments of the present invention can be combined with each other, all within the scope of protection of the present application. In addition, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in a different order than the module division in the device or the flow chart. In addition, the words "first", "second", "third", etc. used herein do not limit the data and execution order, but only distinguish the same items or similar items with basically the same functions and effects.

[0028] Unless otherwise defined, all technical and scientific terms used in this specification have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in this specification and in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used in this specification includes any and all combinations of one or more of the related listed items.

[0029] In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0030] See also Figure 1 , the embodiment of the present invention includes:

[0031] Step S100: presetting different modes in the enhanced database driver;

[0032] The database driver is used to provide an interface for external applications to access the database and is called to perform the lowest-level database operations. The application and the database cannot interact directly. The database driver is equivalent to a translator between the application and the database, which can translate the language of the application into commands that the database can execute.

[0033] In one embodiment of the present invention, the enhanced database driver is modified, and different modes are preset in the enhanced database driver, namely, strict mode and loose mode. In the strict mode, if the application account triggers a login failure or multiple statement execution failures, the administrator needs to send a release verification code; in the loose mode, the enhanced database driver will send an alarm message to the corresponding administrator.

[0034] Step S200: Presetting a security policy in the identity enhancement control system;

[0035] In one embodiment of the present invention, a security policy is preset in the identity enhancement control system, and the security policy includes an enhancement policy and a password change policy. The password change policy is used to regularly change the password of the application's built-in database account; the identity enhancement control system communicates with the enhanced database driver, and the enhancement policy is used to trigger the strict and loose modes of the enhanced database driver.

[0036] In one embodiment of the present invention, the identity enhancement control system can communicate with multiple enhanced database drivers and manage the multiple enhanced database drivers in a unified manner, and the administrator can configure policies according to the situation.

[0037] Step S300: configuring a database built-in pseudo account and password in the enhanced database driver;

[0038] Configure a pseudo account for external display in the enhanced database driver, and configure the corresponding password.

[0039] Step S400: The identity enhancement control system periodically reads the pseudo account and password in the database;

[0040] The identity enhancement control system periodically reads the pseudo account number and password of the database through the enhanced database driver according to the predetermined password change strategy.

[0041] Step S500: The identity enhancement control system periodically changes the account number and password;

[0042] The identity enhancement control system periodically reads the pseudo account and password of the database through the enhanced database driver according to the predetermined password change strategy, and sends an instruction to change the built-in account and password to the database according to the read pseudo account and password, thereby changing the built-in account and password of the database.

[0043] Step S600: The enhanced database driver sends a modification authentication request and synchronizes the built-in account and password according to the authentication result;

[0044] The enhanced database driver sends a modification authentication request, built-in account and password information to the database, requesting authentication whether the built-in account and password have been synchronized. The database sends the authentication result to the enhanced database driver. If the authentication result is no, the changed built-in account and password are synchronized to the enhanced database driver. If the authentication result is yes, no operation is performed.

[0045] Step S700: The enhanced database driver program parses the login request of the application database account and the SQL command issued by the application;

[0046] Structured Query Language (SQL) is a database query and programming language used to access data, query, update and manage relational database systems.

[0047] In one embodiment of the present invention, each SQL instruction is associated with an application program, that is, each SQL instruction contains built-in account and password information.

[0048] When the application database built-in account requests to access the database, the enhanced database driver parses the application database built-in account request and the SQL instruction executed by the application, and the parsed information includes the application database built-in account information and SQL execution error information. The enhanced database driver performs the next operation according to the parsing result, and selects to execute step S810 or step S820.

[0049] Step S810: enhancing the database driver to release data to the application normally;

[0050] The enhanced database driver parses the application database built-in account request and the SQL instructions executed by the application. When the database built-in account information obtained by the analysis is consistent with the modified account information, and the SQL instructions executed by the application are all executed successfully and there is no SQL execution error information, the enhanced database driver releases data to the application normally.

[0051] Step S820: The enhanced database driver does not normally release data to the application;

[0052] The enhanced database driver parses the application database built-in account request and the SQL instruction executed by the application. When the account and password of the application database built-in account are different from the modified account and password when logging in, and when the SQL instruction executed by the application fails during the application process, when the SQL execution error information is obtained by parsing, the enhanced database driver does not release data normally to the application. Step S910 or step S920 is executed according to the mode triggered by the enhanced database driver.

[0053] Step S910: the enhanced database driver performs authentication according to the input release verification code and releases the data according to the authentication result;

[0054] The identity enhancement control system sends a preset enhancement policy to the enhanced database driver. When the strict mode is triggered, the administrator chooses whether to reply with a release verification code. The enhanced database driver obtains the release verification code from the identity enhancement control system. The application database connection module sends the release verification code to the enhanced database driver for verification. The enhanced database driver returns the verification result to the application database connection module. If the verification is correct, the data is released; if the verification is wrong, the data is not released.

[0055] Step S920: The enhanced database driver sends an alarm message to the administrator.

[0056] When the enhanced database driver triggers the loose mode, the enhanced database driver sends an alarm message to the administrator for early warning.

[0057] The embodiment of the present invention transforms the original database driver, configures a pseudo account and password in the enhanced database driver and presets different modes, presets security policies for periodic password modification and triggering different modes in the identity enhancement control system, and the identity enhancement control system implements periodic password modification and changes the pseudo account to a real account, and synchronizes it to the enhanced database driver. When different modes of the enhanced database driver are triggered, the enhanced database driver will adopt different strategies to restrict the release of data. Through the above method, the authentication enhancement of the built-in database of the application system is realized, and at the same time, when there is suspicious behavior in the operation of each application, timely and effective control is carried out to protect data security.

[0058] Please participate Figure 2 , Figure 2An application data security enhancement device 10 based on database drive is provided in an embodiment of the present invention. The device 10 includes: an identity enhancement control module 100, an enhanced database driver module 200 and an application database connection module 300. The identity enhancement control module 100 communicates with the enhanced database driver module 200 and the database 400. The identity enhancement control module 100 is preset with a security policy, and the security policy is used to regularly modify the account password of the database 400 and trigger the mode selection of the enhanced database driver module 200. The identity enhancement control module 100 regularly reads the pseudo account and password in the enhanced database driver module 200 according to the preset security policy, and regularly sends an instruction to change the built-in account and password to the database 400 according to the read pseudo account and password, changes the built-in account and password of the database 400, and then synchronizes the changed built-in account and password to the enhanced database driver module 200;

[0059] The enhanced database driver module 200 communicates with the identity enhancement control module 100 and the database 400. The enhanced database driver module 200 is preset with a strict mode and a loose mode. The enhanced database driver module 200 is configured with a pseudo account and password of the database 400. The enhanced database driver module 200 is used to parse SQL instructions and login requests of the application, and choose whether to release data based on the parsing results.

[0060] The application database connection module 300 communicates with the enhanced database driver module 200. If the enhanced database driver module 200 triggers the strict mode, when the built-in account fails to log in multiple times or the SQL command execution fails multiple times, the administrator chooses whether to reply with a release verification code. The enhanced database driver program 200 obtains the release verification code from the identity enhancement control system 100, and the application database connection module 300 sends the release verification code to the enhanced database driver program 200 for verification. The enhanced database driver program 200 returns the verification result to the application database connection module 300. If the verification is correct, the data is released; if the verification is wrong, the data is not released; when the enhanced database driver module 200 triggers the loose mode, the enhanced database driver module sends an alarm message to the administrator for early warning.

[0061] Figure 3 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, such as Figure 3 As shown, the electronic device 500 includes:

[0062] One or more processors 501 and memory 502, Figure 3 A processor 501 is taken as an example.

[0063] The processor 501 and the memory 502 may be connected via a bus or other means, and the figure takes the connection via a bus as an example.

[0064] The memory 502 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The processor 501 executes various functional applications and data processing of the electronic device by running the non-volatile software programs, instructions and units stored in the memory 502, that is, the database type acquisition method of the above method embodiment is implemented.

[0065] The memory 502 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 502 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 502 may optionally include a memory remotely arranged relative to the processor 501, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0066] The one or more units are stored in the memory 502, and when executed by the one or more processors 501, execute the database-driven application data security enhancement method in any of the above method embodiments, for example, execute the above described Figure 1 Steps S100 to S901 or S902 of the method are implemented Figure 2 The functions of modules 100-300.

[0067] The above electronic device can execute the method for dynamically adjusting data permission control provided by the embodiment of the present invention, and has the program module and beneficial effects corresponding to the execution method. For technical details not fully described in the electronic device embodiment, please refer to the method for dynamically adjusting data permission control provided by the embodiment of the present invention.

[0068] The embodiment of the present invention further provides a non-volatile computer-readable storage medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above non-volatile computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method of the embodiment of the present disclosure is implemented.

[0069] The electronic devices of the embodiments of the present application exist in various forms, including but not limited to:

[0070] (1) Mobile communication devices: These devices are characterized by their mobile communication functions and their main purpose is to provide voice and data communications. These terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones.

[0071] (2) Ultra-mobile personal computer devices: These devices fall into the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access features. These terminals include: PDA, MID and UMPC devices, such as iPad.

[0072] (3) Portable entertainment devices: These devices can display and play multimedia content. They include audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys and portable car navigation devices.

[0073] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0074] (5) Other electronic devices.

[0075] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0076] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a general hardware platform, and of course, can also be implemented by hardware. Those skilled in the art can understand that all or part of the processes in the above embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them. Under the concept of the present invention, the technical features in the above embodiments or different embodiments may also be combined, the steps may be implemented in any order, and there are many other changes in different aspects of the present invention as described above, which are not provided in detail for the sake of simplicity. Although the present invention has been described in detail with reference to the aforementioned embodiments, a person of ordinary skill in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A database-driven application data security enhancement method, It is characterized in that include: Preset strict and lenient modes in enhanced database drivers; Presetting a security policy in the identity enhancement control system, the security policy is used to regularly modify the database account password and trigger the mode selection of the enhanced database driver; Configuring a database pseudo account and password in the enhanced database driver; The identity enhancement control system periodically reads the pseudo account and password in the database through the enhanced database driver according to a preset security policy; The identity enhancement control system periodically sends an instruction to change the built-in account and password to the database according to the pseudo account and password read, thereby changing the built-in account and password of the database; The enhanced database driver sends a modification authentication request, built-in account and password information to the database, requesting authentication whether the built-in account and password have been synchronized, and the database sends the authentication result to the enhanced database driver. If the authentication result is no, the modified built-in account and password are synchronized to the enhanced database driver; When the built-in account login to the application database fails or an SQL command execution error occurs: When the enhanced database driver triggers the strict mode, the administrator chooses whether to reply with a release verification code, the enhanced database driver obtains the release verification code from the identity enhancement control system, the application database connection module sends the release verification code to the enhanced database driver for verification, and the enhanced database driver returns the verification result to the application database connection module. If the verification is correct, the data is released; If the verification is wrong, the data will not be released; When the enhanced database driver program triggers the loose mode, the enhanced database driver program sends an alarm message to the administrator for early warning; The identity enhancement control system and the enhanced database driver are both deployed in a network of application systems and databases; The identity enhancement control system manages multiple enhanced database drivers in a unified manner, and the administrator configures security policies.

2. The method according to claim 1, It is characterized in that Also includes: When the application database built-in account logs in to access the database, the enhanced database driver parses the login request of the application and the SQL instructions executed by the application. When the built-in account of the application database logs in successfully or the SQL instruction is executed correctly, the enhanced database driver program releases data to the application normally.

3. The method according to claim 1, It is characterized in that In the strict mode, if the application system account triggers a login failure or multiple statement executions fail, the administrator is required to send a release verification code; In the loose mode, the enhanced database driver program will send an alarm message to the corresponding administrator.

4. The method according to claim 2, It is characterized in that The SQL instruction is associated with a built-in account of the application database, and the SQL instruction is parsed to obtain the built-in account information of the application database and SQL execution error information. The SQL instruction is parsed by the enhanced database driver.

5. A database-driven application data security enhancement device, used to implement the database-driven application data security enhancement method according to any one of claims 1 to 4, It is characterized in that include: An identity enhancement control module communicates with the enhanced database driver module and the database. The identity enhancement control module is preset with a security policy, and the security policy is used to regularly modify the account password of the database and trigger the mode selection of the enhanced database driver module. The identity enhancement control module regularly reads the pseudo account and password in the enhanced database driver module according to the preset security policy, and regularly sends an instruction to change the built-in account and password to the database according to the pseudo account and password read, changes the database built-in account and password, and then synchronizes the changed built-in account and password to the enhanced database driver module; The enhanced database driver module communicates with the identity enhancement control module and the database. The enhanced database driver module is preset with a strict mode and a loose mode. The enhanced database driver module is configured with a database pseudo account and password. The enhanced database driver module is used to parse SQL instructions and login requests of the application, and choose whether to release data based on the parsing results.

6. The device according to claim 5, It is characterized in that Also includes, The application database connection module communicates with the enhanced database driver module. If the enhanced database driver module triggers the strict mode, when the built-in account fails to log in multiple times or the SQL command execution fails multiple times, the administrator chooses whether to reply with a release verification code. The enhanced database driver obtains the release verification code from the identity enhancement control system. The application database connection module sends the release verification code to the enhanced database driver for verification. The enhanced database driver returns the verification result to the application database connection module. If the verification is correct, the data is released. If the verification is wrong, the data will not be released; when the enhanced database driver module triggers the loose mode, the enhanced database driver module sends an alarm message to the administrator for early warning.

7. An electronic device, It is characterized in that include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the database-driven application data security enhancement method described in any one of claims 1-4.

8. A non-volatile computer storage medium, It is characterized in that The computer storage medium stores computer executable instructions, which are executed by one or more processors, enabling the one or more processors to execute a database-driven application data security enhancement method as described in any one of claims 1 to 4.

Images