Grammar parser generation method, sql access control method, device and apparatus

Abstract

The present specification relates to the technical field of distributed database, and provides a syntax parser generation method, a SQL access control method, a device and equipment, the method comprising: before an application program executes a SQL statement, intercepting the SQL statement based on a filter chain integrated in the application program; calling a filter in the filter chain to perform corresponding filtering processing on the SQL statement; wherein one of the filters is a syntax analyzer configured with a custom access control rule; when the SQL statement fails to pass the audit of the syntax analyzer, the application program is prohibited from executing the SQL statement. The embodiments of the present specification can reduce or avoid the database performance decline caused by the non-standard SQL statement accessing the distributed database.

Description

Technical Field

[0001] This specification relates to the field of distributed database technology, and in particular to a syntax parser generation method, an SQL access control method, an apparatus, and a device. Background Technology

[0002] With the development of distributed database technology, many application systems can now access distributed databases. However, currently, many application systems lack a unified standard for the SQL (Structured Query Language) statements used when accessing distributed databases; these non-standard SQL statements can easily lead to performance degradation of distributed databases. Therefore, how to reduce or avoid the performance degradation caused by non-standard SQL statements when accessing distributed databases has become an urgent technical problem to be solved. Summary of the Invention

[0003] The purpose of the embodiments in this specification is to provide a syntax parser generation method, an SQL access control method, an apparatus, and a device to reduce or avoid database performance degradation caused by non-standard SQL statements accessing distributed databases.

[0004] To achieve the above objectives, this specification provides an SQL access control method, including:

[0005] Before the application executes the SQL statement, the SQL statement is intercepted based on a filter chain integrated into the application;

[0006] The filters in the filter chain are invoked to perform corresponding filtering processing on the SQL statement; one of the filters is a syntax analyzer configured with custom access control rules.

[0007] If the SQL statement fails the parser's review, the application is prohibited from executing the SQL statement.

[0008] In the SQL access control method of this specification embodiment, the filter chain is configured in the database connection pool of the application.

[0009] The SQL access control method in the embodiments of this specification also includes:

[0010] When the application starts, it iterates through the filter interface set to check whether the switches of each filter are in the on state;

[0011] All filters in the filter interface set whose switches are in the on state are recorded in the filter chain.

[0012] In the SQL access control method of this specification embodiment, preventing the application from executing the SQL statement includes:

[0013] Terminate the execution of the application.

[0014] In the SQL access control method of this specification embodiment, after terminating the execution of the application, it further includes:

[0015] Output a prompt log.

[0016] On the other hand, embodiments of this specification also provide a method for generating a syntax parser, including:

[0017] Obtain the SQL syntax rules file;

[0018] Lexical analysis is performed on the SQL syntax rule file to extract the symbol set;

[0019] The symbol set is parsed to generate a parse tree;

[0020] Custom access control rules are added to the parse tree to generate a parser with access control functionality.

[0021] In the syntax parser generation method of this specification, the SQL syntax rule file includes SQL syntax rule files for various relational databases.

[0022] In the syntax parser generation method of this specification, the step of performing lexical analysis on the SQL syntax rule file to extract the symbol set includes:

[0023] The lexical analysis module based on the parser generation tool performs lexical analysis on the SQL syntax rule file to obtain the corresponding symbol set.

[0024] In the syntax parser generation method of this specification embodiment, the step of parsing the symbol set to generate a parse tree includes:

[0025] The syntax analysis module based on the syntax analyzer generation tool performs syntax analysis on the symbol set to obtain the corresponding parse tree.

[0026] In the parser generation method of this specification, the step of adding custom access control rules to the parse tree to generate a parser with access control functionality includes:

[0027] Add custom access control rules to the attributes of the child nodes corresponding to the rules in the parse tree.

[0028] On the other hand, embodiments of this specification also provide an SQL access control device, including:

[0029] The SQL interception module is used to intercept SQL statements based on a filter chain integrated in the application before the application executes the SQL statement;

[0030] The filter invocation module is used to invoke the filters in the filter chain to perform corresponding filtering processing on the SQL statement; one of the filters is a syntax analyzer configured with custom access control rules;

[0031] An execution control module is used to prevent the application from executing the SQL statement when the SQL statement fails the parser's review.

[0032] On the other hand, embodiments of this specification also provide a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the computer program, when run by the processor, executes instructions of the above-described SQL access control method.

[0033] On the other hand, embodiments of this specification also provide a computer storage medium storing a computer program, which, when run by the processor of a computer device, executes instructions for the aforementioned SQL access control method.

[0034] On the other hand, embodiments of this specification also provide a computer program product, the computer program product including instructions, which, when executed by the processor of a computer device, execute the instructions of the above-described SQL access control method.

[0035] On the other hand, embodiments of this specification also provide a syntax parser generation apparatus, including:

[0036] The rule retrieval module is used to retrieve SQL syntax rule files;

[0037] The lexical analysis module is used to perform lexical analysis on the SQL syntax rule file to extract the symbol set from it;

[0038] The syntax parsing module is used to perform syntax parsing on the symbol set to generate a parse tree;

[0039] The parser generation module is used to add custom access control rules to the parse tree to generate a parser with access control functionality.

[0040] On the other hand, embodiments of this specification also provide a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the computer program, when run by the processor, executes the instructions of the above-described syntax parser generation method.

[0041] On the other hand, embodiments of this specification also provide a computer storage medium storing a computer program, which, when run by the processor of a computer device, executes the instructions of the above-described syntax parser generation method.

[0042] On the other hand, embodiments of this specification also provide a computer program product, the computer program product including instructions, which, when executed by a processor of a computer device, execute the instructions of the above-described syntax parser generation method.

[0043] As can be seen from the technical solutions provided in the embodiments of this specification above, the embodiments of this specification can pre-build a syntax analyzer with custom access control rules, and integrate the syntax analyzer as a filter into the application's filter chain; whenever the application executes an SQL statement, the filter chain can be used to intercept the SQL statement, and the syntax analyzer can be used to review the SQL statement; when the SQL statement fails the review of the syntax analyzer, the application is prohibited from executing the SQL statement. In this way, the execution of SQL statements that do not conform to access control rules (i.e., non-standard SQL statements) can be avoided, thereby reducing or avoiding the database performance degradation caused by non-standard SQL statements accessing the distributed database. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0045] Figure 1 A schematic diagram of an SQL access control system in some embodiments of this specification is shown;

[0046] Figure 2 Flowcharts of syntax parser generation methods in some embodiments of this specification are shown;

[0047] Figure 3 Flowcharts of SQL access control methods in some embodiments of this specification are shown;

[0048] Figure 4 Flowcharts of SQL access control methods in other embodiments of this specification are shown;

[0049] Figure 5 This specification shows a block diagram of the structure of a syntax parser generation apparatus in some embodiments;

[0050] Figure 6 This specification shows a block diagram of the SQL access control device in some embodiments;

[0051] Figure 7 A structural block diagram of a computer device in some embodiments of this specification is shown.

[0052] [Explanation of Labels in the Attached Image]

[0053] 10. Client-side;

[0054] 20. Server-side;

[0055] 30. Database;

[0056] 51. Rule Acquisition Module;

[0057] 52. Lexical Analysis Module;

[0058] 53. Syntax parsing module;

[0059] 54. Analyzer Generation Module;

[0060] 61. SQL interception module;

[0061] 62. Filter calling module;

[0062] 63. Execution control module;

[0063] 702. Computer equipment;

[0064] 704, Processor;

[0065] 706. Memory;

[0066] 708. Drive mechanism;

[0067] 710. Input / output interfaces;

[0068] 712. Input devices;

[0069] 714. Output devices;

[0070] 716. Presentation equipment;

[0071] 718. Graphical User Interface;

[0072] 720. Network interface;

[0073] 722. Communication link;

[0074] 724. Communication bus. Detailed Implementation

[0075] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0076] refer to Figure 1 As shown in the embodiments of this specification, the SQL access control system may include a client 10, a server 20, and a database 30. The client 10 may initiate a database operation request containing an SQL statement to the server 20. Before executing the SQL statement (i.e., before parsing the SQL statement and performing corresponding operations on the database 30 based on the parsing results), the server 20 may intercept the SQL statement based on a filter chain integrated in the application of the server 20; it may also call filters in the filter chain to perform corresponding filtering processing on the SQL statement; wherein at least one filter is a syntax analyzer configured with custom access control rules; when the SQL statement fails the syntax analyzer's review, the application is prohibited from executing the SQL statement. In this way, the execution of SQL statements that do not conform to access control rules (i.e., non-standard SQL statements) can be avoided, thereby reducing or preventing the database performance degradation caused by non-standard SQL statements accessing the distributed database.

[0077] In some embodiments, the user terminal can be a self-service terminal device, a mobile terminal (i.e., a smartphone), a display, a desktop computer, a tablet computer, a laptop computer, a digital assistant, or a smart wearable device, etc. Smart wearable devices can include smart bracelets, smartwatches, smart glasses, or smart helmets, etc. Of course, the user terminal is not limited to the above-mentioned physical electronic devices; it can also be software running on the aforementioned electronic devices.

[0078] In some embodiments, the server can be an electronic device with computing and network interaction capabilities; it can also be software running on the electronic device that provides business logic for data processing and network interaction. The server can interact with the user terminal.

[0079] In some embodiments, the database may be a distributed database or a relational database.

[0080] Unlike traditional SQL auditing standards (such as those in the *Java Development Manual*), the access control rules in the parser of this embodiment are custom-defined, better suited to the characteristics and needs of specific application scenarios. This embodiment provides a parser generation method that can be applied to the computer device side. (Reference) Figure 2 As shown, in some embodiments, the syntax parser generation method may include the following steps:

[0081] Step 201: Obtain the SQL syntax rules file.

[0082] The SQL syntax rule file may include SQL syntax rule files for one or more relational databases. For example, in an exemplary embodiment, the SQL syntax rule file may include syntax rule files provided by MySQL and Oracle.

[0083] SQL syntax rule files can be obtained in advance through downloading or other means and stored in a specified storage path. When a syntax parser needs to be generated, it can be read from the specified storage path.

[0084] Step 202: Perform lexical analysis on the SQL syntax rule file to extract the symbol set.

[0085] To reduce implementation complexity, an open-source parser generation tool can be used to generate the parser. Therefore, in some embodiments, performing lexical analysis on the SQL syntax rule file to extract the token set may include: performing lexical analysis on the SQL syntax rule file using a lexical analysis module based on the parser generation tool to obtain the corresponding token set. Lexical analysis involves grouping various symbols in the SQL syntax rule file into token classes, which are the token sets.

[0086] For example, in one embodiment, using Antlr4 (ANother Tool for Language Recognition) as the parser generation tool and a MySQL grammar rule file as the SQL grammar rule file, the MySQL .g4 file contains various symbols for MySQL statements (such as literals, operators, punctuation marks, graphic symbols, and numbers). Antlr4's lexer part can perform lexical analysis on the MySQL .g4 file to form a symbol set. Antlr4 is a powerful cross-language parser that can be used to read, process, execute, or translate structured text or binary files. It is widely used to build languages, tools, and frameworks. Therefore, Antlr can also generate a parser that can build and traverse parse trees from a grammatical perspective.

[0087] Step 203: Perform syntax parsing on the symbol set to generate a parse tree.

[0088] In some embodiments, the symbol set can be parsed using the parsing module of a parser generation tool to obtain a corresponding parse tree. For example, in one embodiment, taking Antlr4 as the parser generation tool, the parser part of Antlr4 can be used to perform parsing on the symbol set obtained in the previous step to obtain a parse tree. The parse tree is the representation of the parser. In Antlr4, the parse tree consists of terminal nodes and rule nodes. Since a terminal node cannot contain any child nodes, the parent node of any rule node is also a rule node. Each rule node has a corresponding enter and exit method.

[0089] Step 204: Add custom access control rules to the parse tree to generate a parser with access control functionality.

[0090] In the embodiments described in this specification, the parse tree directly generated using Antlr4 is only a parser for standard or general SQL syntax rule files, and it does not include custom access control rules. Therefore, it is necessary to add custom access control rules to the parse tree to generate a parser with access control functionality. These custom access control rules are code derived from practical applications, summarizing and generalizing access control specifications specific to that application.

[0091] In some embodiments, adding custom access control rules to the parse tree to generate a parser with access control functionality may include adding custom access control rules to the attributes of the child nodes corresponding to the rules in the parse tree.

[0092] In one exemplary embodiment, the custom access control rule may include, for example:

[0093] 1) Do not use * as the field list in the query. The fields that need to be returned must be explicitly specified. That is, do not use select*. For distributed databases, such as MySQL, this can prevent select* from returning a large result set, which may cause memory overflow and database crash.

[0094] 2) Do not perform join operations on more than three tables; For distributed databases, limiting the number of tables in a join operation can prevent the distributed database computing layer from performing a large number of calculations, improve query efficiency, and prevent memory overflow when performing a large number of calculations.

[0095] 3) Disable left-hand fuzzy queries, i.e., LIKE queries starting with % or _. For distributed databases like MySQL, disabling left-hand fuzzy queries can improve query efficiency.

[0096] Those skilled in the art will understand that the three custom access control rules described above are merely illustrative examples. In actual implementation, one or more custom access control rules can be defined according to the specific application scenario or application system.

[0097] A parser with access control is a customized parser tailored to the specific characteristics and needs of an application scenario. Based on a customized parser generated for a particular application scenario (e.g., a specific application system), this customized parser can be integrated as a plugin into the application (i.e., the server). In this way, the application can utilize this plugin for access control before executing SQL statements, thereby reducing the impact of non-standard SQL access on database performance.

[0098] Given that many applications use open-source database connection pool components, it is worth considering integrating the parser with access control functionality into the application's database connection pool. This can be achieved by extending the functionality of the database connection pool's filter chain.

[0099] For example, in an exemplary embodiment, taking an application using the Druid connection pool as an example, the Druid connection pool provides a filter chain to extend functionality. Developers can customize plugins to extend functionality by implementing its provided filter interface. That is, a plugin xxxSqlCheck that integrates the aforementioned parser with access control functionality can be defined through the filter interface. Since the Druid connection pool is implemented in Java, when defining the Java class xxxSqlCheck, this class implements the filter interface in the Druid connection pool and integrates the aforementioned parser with access control functionality into the methods of the filter interface.

[0100] Based on the integration of the aforementioned parser with access control functionality into the server-side, this specification provides an SQL access control method that can be applied to the aforementioned server-side. (Refer to...) Figure 3 As shown, the SQL access control method may include the following steps:

[0101] Step 301: Before the application executes the SQL statement, intercept the SQL statement based on the filter chain integrated into the application.

[0102] Before executing step 301, when the application starts, it iterates through the filter interface set to check if the switches of each filter are in the "on" state. When a filter's switch is in the "on" state, it indicates that the filter is allowed to join the filter chain; when a filter's switch is in the "off" state, it indicates that the filter is prohibited or not allowed to join the filter chain. The on / off state of the filters can be pre-configured by the user. In this embodiment, to reduce the impact of non-standard SQL access on database performance, the parser with access control functionality, as one of the filters, should have its switch configured to be "on" by default.

[0103] For example, if an application uses the Druid connection pool, when the application starts, the Druid connection pool initializes by iterating through the filter interface set to check if the switch of each filter is in the on state. Then, through the Java SPI mechanism, all filters in the filter interface set whose switches are in the on state are recorded into the filter chain.

[0104] Thus, whenever an application needs to execute an SQL statement, the filter intercepts the SQL statement before the application executes it, so that the filter can perform filtering processing.

[0105] Step 302: Call the filters in the filter chain to perform corresponding filtering processing on the SQL statement; one of the filters is a syntax analyzer configured with custom access control rules.

[0106] Each filter in the filter chain can be used to implement a specific filtering function. For example, one filter can be used to filter sensitive information, so this filter can perform pre-configured sensitive information checking logic; another filter can be used for login verification, so this filter can perform pre-configured login verification logic; another filter can be used for data compression, so this filter can perform pre-configured data compression logic; and yet another filter can be used for Uniform Resource Locator (URL) level access control, so this filter can perform pre-configured access control logic.

[0107] In most cases, the functions of each filter in a filter chain are independent, meaning there are no restrictions on the execution order of the filters in the filter chain. However, in some cases, depending on the needs, some or all of the filters in the filter chain can be configured to execute in a specific order, meaning there can be dependencies between some or all of the filters in the filter chain.

[0108] For a parser with access control functionality that is one of the filters in a filter chain, the filtering process performed by the filter is to audit the SQL statement according to the code of the custom access control rules in order to identify whether the SQL statement conforms to the requirements of the custom access control rules.

[0109] For example, in one exemplary embodiment, the SQL statement is:

[0110] select *from test table

[0111] If the custom access control rules include an access control rule that "prohibits the use of * as a field list in a query", then since the above SQL statement (select * from test table) does not comply with this access control rule, it can be considered that the above SQL statement (select * from test table) has not passed the parser's review.

[0112] Step 303: When the SQL statement fails the parser's review, the application is prohibited from executing the SQL statement.

[0113] When the SQL statement fails the parser's review, it indicates that the SQL statement does not comply with the custom access control rules. In this case, the application can be prohibited from executing the SQL statement to avoid the risk of database performance degradation that may be caused by the subsequent execution of the SQL statement. This reduces or avoids the database performance degradation caused by non-standard SQL statements accessing the distributed database.

[0114] In this context, "SQL statement fails the parser's review" means that the SQL statement does not meet one or more of the custom access control rules. In other words, if the SQL statement does not meet any one of the rules, it is considered that the SQL statement has failed the parser's review.

[0115] The SQL access control method based on the embodiments of this specification can pre-build a syntax analyzer with custom access control rules and integrate the syntax analyzer as a filter in the application's filter chain. Before the application executes an SQL statement, the filter chain can intercept the SQL statement, and the syntax analyzer can audit the SQL statement. If the SQL statement fails the syntax analyzer's audit, the application is prohibited from executing the SQL statement. In this way, the execution of SQL statements that do not conform to access control rules (i.e., non-standard SQL statements) can be avoided, thereby reducing or preventing the database performance degradation caused by non-standard SQL statements accessing the distributed database.

[0116] refer to Figure 4 As shown in the embodiments of this specification, another SQL access control method is provided, which can be applied to the server-side described above. Figure 4 In the illustrated embodiment, the server uses a Druid connection pool, and a parser with access control functionality is integrated into the filter chain of the Druid connection pool. The SQL access control method may include the following steps:

[0117] Step 401: Intercept SQL statements.

[0118] Intercept SQL statements before the application executes them.

[0119] Step 402: Call the parser to check whether the SQL statement conforms to the custom access control rules. If the SQL statement does not conform to the custom access control rules, proceed to step 403; otherwise, proceed to step 404.

[0120] Step 403: Terminate the execution of the application and output a prompt log.

[0121] When an SQL statement does not comply with custom access control rules, to avoid potential database performance degradation risks from subsequent execution of that SQL statement, the application can be terminated, i.e., the execution of the SQL statement can be stopped. Furthermore, in addition to terminating the application's execution, a notification log can be output to alert application developers or other relevant personnel, facilitating subsequent operation and maintenance management.

[0122] Step 404: After the SQL statement has been filtered by the remaining filters in the filter chain, the SQL statement is sent.

[0123] When the filter chain contains filters other than the parser with access control functionality, the filtering results of these other filters must be considered to ultimately determine whether to send an SQL statement to the database. In this case, simply the SQL statement conforming to the custom access control rules is insufficient to send it. In other words, the condition for sending an SQL statement is met only when it conforms to the custom access control rules and is also filtered by the other filters in the filter chain. Only then can the application execute the SQL statement and perform corresponding operations on the database (such as querying, inserting, modifying, and deleting).

[0124] It should be pointed out that, in Figure 4In the illustrated embodiment, to highlight the role of the parser with access control functionality, the process of calling the parser to audit the SQL statement is directly described after intercepting it. However, in practice, depending on the actual application scenario, the parser in the filter chain can be the first filter to perform filtering, the last filter to perform filtering, or it can be executed after one or more filters in the filter chain but before another one or more filters, or it can be executed in parallel with one or more filters in the filter chain.

[0125] Although the process described above includes multiple operations that occur in a specific order, it should be clearly understood that these processes may include more or fewer operations, which may be executed sequentially or in parallel (e.g., using parallel processors or a multithreaded environment).

[0126] Corresponding to the above-described parser generation method, this specification also provides a parser generation apparatus, see reference. Figure 5 As shown, the syntax parser generation apparatus may include:

[0127] Rule acquisition module 51 can be used to acquire SQL syntax rule files;

[0128] The lexical analysis module 52 can be used to perform lexical analysis on the SQL syntax rule file to extract the symbol set from it;

[0129] The syntax parsing module 53 can be used to perform syntax parsing on the symbol set to generate a parse tree;

[0130] The parser generation module 54 can be used to add custom access control rules to the parse tree to generate a parser with access control functionality.

[0131] In some embodiments of the syntax parser generation apparatus, the SQL syntax rule file includes SQL syntax rule files for various relational databases.

[0132] In some embodiments of the syntax parser generation apparatus, the lexical analysis of the SQL syntax rule file to extract the symbol set includes:

[0133] The lexical analysis module based on the parser generation tool performs lexical analysis on the SQL syntax rule file to obtain the corresponding symbol set.

[0134] In some embodiments of the syntax parser generation apparatus, the step of parsing the symbol set to generate a parse tree includes:

[0135] The syntax analysis module based on the syntax analyzer generation tool performs syntax analysis on the symbol set to obtain the corresponding parse tree.

[0136] In some embodiments of the syntax parser generation apparatus, the step of adding custom access control rules to the parse tree to generate a syntax parser with access control functionality includes:

[0137] Add custom access control rules to the attributes of the child nodes corresponding to the rules in the parse tree.

[0138] Corresponding to the SQL access control method described above, this specification also provides an SQL access control device, see reference. Figure 6 As shown, the SQL access control device may include:

[0139] SQL interception module 61 can be used to intercept SQL statements based on a filter chain integrated in the application before the application executes the SQL statement;

[0140] The filter invocation module 62 can be used to invoke the filters in the filter chain to perform corresponding filtering processing on the SQL statement; one of the filters is a syntax analyzer configured with custom access control rules;

[0141] The execution control module 63 can be used to prevent the application from executing the SQL statement when the SQL statement fails the review of the parser.

[0142] In some embodiments of the SQL access control apparatus, the filter chain is configured in the database connection pool of the application.

[0143] Some embodiments of the SQL access control device may also include a filter loading module, which can be used to traverse the filter interface set to check whether the switch of each filter is in the on state when the application starts; and record all filters in the filter interface set whose switches are in the on state into the filter chain.

[0144] In some embodiments of the SQL access control device, preventing the application from executing the SQL statement includes:

[0145] Terminate the execution of the application.

[0146] In some embodiments of the SQL access control apparatus, after terminating the execution of the application, the following further steps are taken:

[0147] Output a prompt log.

[0148] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0149] Embodiments of this specification also provide a computer device. For example... Figure 7 As shown, in some embodiments of this specification, the computer device 702 may include one or more processors 704, such as one or more central processing units (CPUs) or graphics processing units (GPUs), each of which may implement one or more hardware threads. The computer device 702 may also include any memory 706 for storing any kind of information such as code, settings, data, etc. In one specific embodiment, a computer program is stored on the memory 706 and can run on the processor 704. When the computer program is run by the processor 704, it can execute instructions of the SQL access control method or the syntax parser generation method described in any of the above embodiments. Without limitation, for example, the memory 706 may include any type of RAM, any type of ROM, flash memory, hard disk, optical disk, etc. More generally, any memory can use any technology to store information. Furthermore, any memory can provide volatile or non-volatile retention of information. Furthermore, any memory may represent a fixed or removable component of the computer device 702. In one scenario, when processor 704 executes associated instructions stored in any memory or combination of memories, computer device 702 can perform any operation of the associated instructions. Computer device 702 also includes one or more drive mechanisms 708 for interacting with any memory, such as hard disk drive mechanisms, optical disk drive mechanisms, etc.

[0150] Computer device 702 may also include an input / output interface 710 (I / O) for receiving various inputs (via input device 712) and providing various outputs (via output device 714). A specific output mechanism may include a presentation device 716 and an associated graphical user interface 718 (GUI). In other embodiments, the input / output interface 710 (I / O), input device 712, and output device 714 may be omitted, and the device may function solely as a computer device within a network. Computer device 702 may also include one or more network interfaces 720 for exchanging data with other devices via one or more communication links 722. One or more communication buses 724 couple the components described above together.

[0151] Communication link 722 can be implemented in any way, such as via a local area network, a wide area network (e.g., the Internet), a point-to-point connection, or any combination thereof. Communication link 722 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc., governed by any protocol or combination of protocols.

[0152] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to some embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processor to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processor, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0153] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processor to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0154] These computer program instructions may also be loaded onto a computer or other programmable data processor, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0155] In a typical configuration, a computer device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0156] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0157] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by computer equipment. As defined in this specification, computer-readable media does not include transient media, such as modulated data signals and carrier waves.

[0158] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, the embodiments of this specification can take the form of computer program products implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0159] The embodiments described in this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. The embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processors connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0160] It should also be understood that, in the embodiments of this specification, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0161] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0162] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the embodiments of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0163] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A SQL access control method, characterized in that, include: When the application starts, iterate through the filter interface set to check if the switches of each filter are in the on state. The on / off state of the filter is pre-configured by the user; at least one of the filters is a parser configured with custom access control rules; all filters in the filter interface set whose on / off state is enabled are loaded into the application's Druid connection pool via the Java SPI mechanism to form a filter chain; Each filter in the filter chain is used to perform a specific filtration function; Before the application executes the SQL statement, the SQL statement is intercepted based on a filter chain integrated into the application; The filters in the filter chain are invoked to perform corresponding filtering processing on the SQL statement in order to intercept non-standard SQL statements and avoid database performance degradation caused by non-standard SQL statements accessing the distributed database. If the SQL statement fails the parser's review, the application is prohibited from executing the SQL statement.

2. The SQL access control method as described in claim 1, characterized in that, The filter chain is configured in the application's database connection pool.

3. The SQL access control method as described in claim 1, characterized in that, The prohibition of the application from executing the SQL statement includes: Terminate the execution of the application.

4. The SQL access control method as described in claim 3, characterized in that, After terminating the execution of the application, the following is also included: Output a prompt log.

5. The SQL access control method as described in claim 1, characterized in that, The parser is pre-generated by obtaining an SQL syntax rule file; Lexical analysis is performed on the SQL syntax rule file to extract the symbol set; The symbol set is parsed to generate a parse tree; Custom access control rules are added to the parse tree to generate a parser with access control functionality.

6. The SQL access control method as described in claim 5, characterized in that, The SQL syntax rule files include SQL syntax rule files for various relational databases.

7. The SQL access control method as described in claim 5, characterized in that, The lexical analysis of the SQL syntax rule file to extract the symbol set includes: The lexical analysis module based on the parser generation tool performs lexical analysis on the SQL syntax rule file to obtain the corresponding symbol set.

8. The SQL access control method as described in claim 5, characterized in that, The step of parsing the symbol set to generate a parse tree includes: The syntax analysis module based on the syntax analyzer generation tool performs syntax analysis on the symbol set to obtain the corresponding parse tree.

9. The SQL access control method as described in claim 5, characterized in that, The step of adding custom access control rules to the parse tree to generate a parser with access control functionality includes: Add custom access control rules to the attributes of the child nodes corresponding to the rules in the parse tree.

10. An SQL access control device, characterized in that, include: The filter loading module is used to iterate through the filter interface set and check whether the switches of each filter are in the on state when the application starts. The on / off state of the filter is pre-configured by the user; at least one of the filters is a parser configured with custom access control rules; all filters in the filter interface set whose on / off state is enabled are loaded into the application's Druid connection pool via the Java SPI mechanism to form a filter chain; Each filter in the filter chain is used to perform a specific filtration function; The SQL interception module is used to intercept SQL statements based on a filter chain integrated in the application before the application executes the SQL statement; The filter invocation module is used to invoke the filters in the filter chain to perform corresponding filtering processing on the SQL statement, so as to intercept non-standard SQL statements and avoid the database performance degradation caused by non-standard SQL statements accessing the distributed database; An execution control module is used to prevent the application from executing the SQL statement when the SQL statement fails the parser's review.

11. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, When the computer program is run by the processor, it executes the instructions of the method according to any one of claims 1-9.

12. A computer storage medium having a computer program stored thereon, characterized in that, When the computer program is run by the processor of the computer device, it executes the instructions of the method according to any one of claims 1-9.

13. A computer program product, the computer program product comprising instructions, characterized in that, When the instructions on the computer program product are executed by the processor of the computer device, they perform the method according to any one of claims 1-9.

Images