A database request combining method and apparatus

Abstract

The application provides a database request combining method and device. In the execution of the method, a request forwarding unit first receives a first Sql request sent from a client and forwards the first Sql request to a plurality of server ends; then each server end in the plurality of server ends forwards the first Sql request to a corresponding source database; next, a request combining unit receives the first Sql request sent by the server of each source database, combines and filters the plurality of first Sql requests, takes one of the filtered plurality of first Sql requests as a second Sql request, and finally sends the second Sql request to a target database. By forwarding the Sql request sent by the client to a plurality of server ends, if one of the server ends is attacked when the plurality of first Sql requests are combined and filtered, the first Sql request will be different from the first Sql requests of other server ends and will be eliminated, thereby improving the security of the user request process.

Description

Technical Field

[0001] This application relates to the field of database security, and in particular to a database request routing method and apparatus. Background Technology

[0002] With the development of computer and network technologies, the application of internet information systems is becoming increasingly widespread. As the core and foundation of information technology in business platforms, databases carry more and more critical data. The secure and stable operation of databases directly determines whether business systems can function normally, and platform databases often store extremely important and sensitive information.

[0003] In existing technologies, cyber hackers utilize various methods, attack tools, and deception techniques to obtain the information they desire. For example, they may insert SQL commands into web form submissions, domain name inputs, or query strings in page requests, ultimately deceiving the server into executing malicious SQL commands and rendering the user's request insecure. Summary of the Invention

[0004] In view of this, embodiments of this application provide a database request routing method and apparatus, which aim to improve the security of the user request process.

[0005] In a first aspect, embodiments of this application provide a database request combining method, the method comprising:

[0006] The request forwarding unit receives the first SQL request sent from the client;

[0007] The request forwarding unit forwards the first SQL request to multiple servers.

[0008] Each of the plurality of server terminals forwards the first SQL request to the corresponding source database.

[0009] Each source database server sends the first SQL request to the request combining unit;

[0010] The request combining unit receives the first SQL request sent by the server of each source database, performs combining and filtering on multiple first SQL requests, and takes one of the filtered multiple first SQL requests as the second SQL request.

[0011] The request combining unit sends the second SQL request to the target database.

[0012] Optionally, if the first SQL request is a read request, then after the request combining unit sends the second SQL request to the target database, the method further includes:

[0013] The request combining unit receives the read result returned by the target database, and the read result is obtained by the target database in processing the read request;

[0014] The request combining unit sends the read result to the request forwarding unit;

[0015] The request forwarding unit forwards the read result to the client.

[0016] Optionally, before the request forwarding unit forwards the read result to the client, the method further includes:

[0017] The request forwarding unit checks the read result and obtains the check result corresponding to the read result;

[0018] The request forwarding unit forwards the inspection results to the client.

[0019] Optionally, after each of the plurality of server terminals forwards the first SQL request to the corresponding source database, the method further includes:

[0020] Different tags are added to the keywords of the first SQL request in each source database. These tags are obtained based on preset parameters corresponding to each source database.

[0021] Optionally, after performing a merging and filtering process on multiple first SQL requests, and before selecting one of the filtered first SQL requests as the second SQL request, the method further includes:

[0022] The request combining unit performs tag removal processing on the plurality of first SQL requests, and retains the tag of one of the SQL requests.

[0023] Secondly, embodiments of this application provide a database request combining apparatus, the apparatus comprising:

[0024] The request forwarding unit is used to receive a first SQL request sent from the client and forward the first SQL request to multiple servers.

[0025] Multiple server-side components are used to forward the first SQL request to the corresponding source database;

[0026] Multiple source database servers are used to send the first SQL request to the request combining unit, respectively;

[0027] The request combining unit is used to receive the first SQL request sent by the server of each source database, perform combining and filtering on multiple first SQL requests, select one of the filtered multiple first SQL requests as a second SQL request, and send the second SQL request to the target database.

[0028] Optionally, if the first SQL request is a read request, the request combining unit is further configured to receive the read result returned by the target database, the read result being obtained by the target database processing the read request; send the read result to the request forwarding unit; and have the request forwarding unit forward the read result to the client.

[0029] Optionally, before the request forwarding unit forwards the read result to the client, the request forwarding unit is further configured to check the read result to obtain the check result corresponding to the read result; and forward the check result to the client.

[0030] Thirdly, embodiments of this application provide an electronic device, the electronic device comprising:

[0031] Memory, used to store one or more programs;

[0032] A processor; when the one or more programs are executed by the processor, to implement the database request merging method described in any of the first aspects above.

[0033] Fourthly, embodiments of this application provide a computer storage medium storing a program that, when executed by a processor, implements the database request merging method described in any of the first aspects above.

[0034] The above technical solution has the following beneficial effects:

[0035] This application provides a database request combining method and apparatus. When executing the method, a request forwarding unit first receives a first SQL request sent from a client and forwards the first SQL request to multiple servers; then, each of the multiple servers forwards the first SQL request to its corresponding source database; then, each source database server sends the first SQL request to the request combining unit; next, the request combining unit receives the first SQL request sent by each source database server, performs combining and filtering on the multiple first SQL requests, selects one of the filtered first SQL requests as a second SQL request, and finally, the request combining unit sends the second SQL request to the target database.

[0036] In this way, by forwarding the SQL requests sent by the client to multiple servers, when filtering these first SQL requests, if one of the servers is attacked, that first SQL request will be different from the first SQL requests on the other servers and will be rejected. Then, one of the filtered first SQL requests is sent as the second SQL request to the target database, thereby improving the security of the user request process. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings used in the description of the embodiment or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 A flowchart of a method for database request merging provided in this application embodiment;

[0039] Figure 2 This is a schematic diagram of a database request combining device provided in an embodiment of this application. Detailed Implementation

[0040] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0041] With the development of computer and network technologies, the application of internet information systems is becoming increasingly widespread. As the core and foundation of information technology in business platforms, databases carry more and more critical data. The secure and stable operation of databases directly determines whether business systems can function normally, and platform databases often store extremely important and sensitive information.

[0042] The inventors discovered through research that, in existing technologies, cyber hackers utilize various methods, attack tools, and deception techniques to obtain the information they desire. For example, they may insert SQL commands into web form submissions, domain name inputs, or query strings in page requests, ultimately deceiving the server into executing malicious SQL commands, thus compromising the user's security.

[0043] To overcome the above-mentioned technical problems, embodiments of this application provide a database request combining method, which can be executed by a database request combining device. This device can be implemented in software and / or hardware and is generally integrated into a server or terminal device.

[0044] See Figure 1 , Figure 1 A flowchart of a database request merging method provided in this application embodiment is shown. The method may include:

[0045] Step S101: The request forwarding unit receives the first SQL request sent from the client.

[0046] Structured Query Language (SQL) is a database query and programming language used to access, query, update, and manage relational database systems.

[0047] In this embodiment of the application, the first SQL request is generated by the client based on the user's operation instructions, but it is not sent directly to the destination database. Instead, it is sent to the request forwarding unit, which receives the first SQL request sent by the client.

[0048] It is understandable that the first SQL request can be either a write request or a read request; no specific limitation is made here.

[0049] Step S102: The request forwarding unit forwards the first SQL request to multiple servers.

[0050] In this embodiment of the application, after the request forwarding unit receives the first SQL request sent from the client in step S101, the request forwarding unit forwards the first SQL request to multiple servers.

[0051] It should be noted that multiple server-side components refer to at least three web server-side components.

[0052] Step S103: Each of the plurality of server terminals forwards the first SQL request to the corresponding source database; wherein each source database is connected to a different incremental log parsing unit.

[0053] In this embodiment of the application, after the request forwarding unit forwards the first SQL request to multiple servers, each of the multiple servers forwards the first SQL request to the source database corresponding to each server; wherein, each source database is connected to a different incremental log parsing unit.

[0054] As one possible implementation, after each of the plurality of server terminals forwards the first SQL request to the corresponding source database, the method includes: adding different tags to the keywords of the first SQL request in each source database, the tags being obtained based on preset parameters corresponding to each source database.

[0055] Let's take one of the source databases as an example: For instance, the first SQL request in a source database is "select * from info…". After adding the tag, the first SQL request becomes "xxtag select * xxtag from info…". Here, "xxtag" is the tag.

[0056] It should be noted that this label is obtained based on the preset parameters corresponding to each source database. These preset parameters can be set by the user according to actual needs, and are not limited here.

[0057] It can be understood that by adding different tags to the keywords of the first SQL request in each source database, if the incremental log parsing unit parses the first SQL request later and the first SQL request does not have the tags, it can be assumed that the server may have been attacked, thus further improving the security of the user request process.

[0058] Step S104: Each source database server sends the first SQL request to the request combining unit.

[0059] In this embodiment of the application, after each of the multiple server terminals forwards the first SQL request to the corresponding source database through step S103, the server of each source database sends the first SQL request to the request combining unit, so that the subsequent request combining unit can perform combining and filtering of multiple first SQL requests.

[0060] It should be noted that, in one possible implementation, each source database is connected to a different incremental log parsing unit. Each incremental log parsing unit parses the logs of the source database, obtains a first SQL request, and sends the first SQL request to the server of the source database corresponding to the incremental log parsing unit.

[0061] Step S105: The request combining unit receives the first SQL request sent by the server of each source database, performs combining and filtering on the multiple first SQL requests, and takes one of the filtered multiple first SQL requests as the second SQL request.

[0062] In this embodiment of the application, the request combining unit receives the first SQL request sent by the server of each source database, and after combining and filtering the multiple first SQL requests, selects one of the filtered multiple first SQL requests as the second SQL request.

[0063] Understandably, if one of the source database servers is attacked, the first SQL request will be different from the first SQL request sent by the source database server. Therefore, the SQL request from the source database server will be removed, and the user will be notified that the source database server has been attacked.

[0064] Accordingly, the request combining unit will use one of the filtered first SQL requests as the second SQL request.

[0065] In one possible implementation, before combining and filtering multiple first SQL requests and then selecting one of the filtered first SQL requests as the second SQL request, the method further includes:

[0066] The request combining unit performs tag removal processing on multiple first SQL requests, and retains the tag of one of the SQL requests.

[0067] Specifically, after receiving multiple first SQL requests, the request combining unit performs tag removal processing on the multiple first SQL requests and retains the tag of only one SQL request.

[0068] In practical applications, after the request combining unit receives the first SQL request sent by the server of each source database, it performs SQL injection attack detection on multiple first SQL requests to improve the security of the user request process.

[0069] Step S106: The request combining unit sends the second SQL request to the target database.

[0070] As can be seen from the above technical solution, the request forwarding unit first receives the first SQL request sent from the client and forwards the first SQL request to multiple servers; then each of the multiple servers forwards the first SQL request to the corresponding source database; then each source database server sends the first SQL request to the request combining unit; next, the request combining unit receives the first SQL request sent by each source database server, performs combining and filtering on the multiple first SQL requests, and takes one of the filtered first SQL requests as the second SQL request; finally, the request combining unit sends the second SQL request to the target database.

[0071] In this way, by forwarding the SQL requests sent by the client to multiple servers, when filtering these first SQL requests, if one of the servers is attacked, that first SQL request will be different from the first SQL requests on the other servers and will be rejected. Then, one of the filtered first SQL requests is sent as the second SQL request to the target database, thereby improving the security of the user request process.

[0072] As one possible implementation, if the first SQL request is a read request, then after the request combining unit sends the second SQL request to the target database, the method further includes: the request combining unit receiving a read result returned by the target database, the read result being obtained by the target database processing the read request; the request combining unit sending the read result to the request forwarding unit; and the request forwarding unit forwarding the read result to the client.

[0073] In this embodiment of the application, when the first SQL request is a read request, after the request combining unit sends the second SQL request to the target database, the request combining unit receives the read result returned by the target database, which is the result obtained by the target database in processing the read request.

[0074] Accordingly, the request combining unit sends the read result to the request forwarding unit, which then forwards the read result to the client to ensure the normal operation of services.

[0075] As one possible implementation, before the request forwarding unit forwards the read result to the client, the method further includes: the request forwarding unit checking the read result to obtain a check result corresponding to the read result; and the request forwarding unit forwarding the check result to the client.

[0076] Specifically, after the request combining unit sends the read result to the request forwarding unit, the request forwarding unit checks the read result, for example, by adjudicating the read result or performing an SQL injection check. The request combining unit then forwards the check result to the client, thereby ensuring the security of the user request process.

[0077] The above are some specific implementations of the database request merging method provided in the embodiments of this application. Based on this, this application also provides a corresponding apparatus. The apparatus provided in the embodiments of this application will be described below from the perspective of functional modularity.

[0078] See Figure 2 The diagram shows an example of the structure of a database request combining device, which includes a request forwarding unit 100, multiple server-side components 200, multiple source database servers 300, and a request combining unit 400.

[0079] The request forwarding unit 100 is used to receive a first SQL request sent from a client and forward the first SQL request to multiple servers.

[0080] Multiple server-side 200s are used to forward the first SQL request to the corresponding source database; wherein each source database is connected to a different incremental log parsing unit.

[0081] Multiple source database servers 300 are used to send the first SQL request to the request combining unit respectively;

[0082] The request combining unit 400 is used to receive the first SQL request sent by the server of each source database, perform combining and filtering on multiple first SQL requests, select one of the filtered multiple first SQL requests as a second SQL request, and send the second SQL request to the target database.

[0083] Optionally, if the first SQL request is a read request, the request combining unit is further configured to receive the read result returned by the target database, the read result being obtained by the target database processing the read request; send the read result to the request forwarding unit; and have the request forwarding unit forward the read result to the client.

[0084] Optionally, before the request forwarding unit forwards the read result to the client, the request forwarding unit is further configured to check the read result to obtain the check result corresponding to the read result; and forward the check result to the client.

[0085] As can be seen from the above technical solution, in the embodiment of this application, the request forwarding unit first receives a first SQL request sent from the client and forwards the first SQL request to multiple servers; then each of the multiple servers forwards the first SQL request to the corresponding source database; then each source database server sends the first SQL request to the request combining unit; next, the request combining unit receives the first SQL request sent by each source database server, performs combining and filtering on the multiple first SQL requests, and takes one of the filtered multiple first SQL requests as the second SQL request; finally, the request combining unit sends the second SQL request to the target database.

[0086] In this way, by forwarding the SQL requests sent by the client to multiple servers, when filtering these first SQL requests, if one of the servers is attacked, that first SQL request will be different from the first SQL requests on the other servers and will be rejected. Then, one of the filtered first SQL requests is sent as the second SQL request to the target database, thereby improving the security of the user request process.

[0087] This application also provides an electronic device, including: a memory for storing one or more programs;

[0088] Processor; when the one or more programs are executed by the processor, the database request merging method in the above embodiments is implemented.

[0089] This application also provides a computer storage medium storing a program that, when executed by a processor, implements the database request merging method described in the above embodiments.

[0090] In the embodiments of this application, the terms "first" and "second" (if they exist) are used only as name identifiers and do not represent the order of first and second.

[0091] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0092] Those skilled in the art will understand that the flowchart shown is merely an example in which the embodiments of this application can be implemented, and the scope of application of the embodiments of this application is not limited by any aspect of the flowchart.

[0093] In the several embodiments provided in this application, it should be understood that the disclosed methods, apparatuses, and devices can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings or direct couplings or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0094] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, the functional units in the various embodiments of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0095] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0096] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A database request routing method, characterized in that, The method includes: The request forwarding unit receives the first SQL request sent from the client; The request forwarding unit forwards the first SQL request to multiple servers. Each of the plurality of server terminals forwards the first SQL request to the corresponding source database; each source database server sends the first SQL request to the request combining unit. The request combining unit receives the first SQL request sent by the server of each source database, and performs combining and filtering on multiple first SQL requests, including: if one of the source database servers is attacked, the first SQL request will be different from the first SQL request sent by the source database server, so the SQL request of the source database server is removed, and one of the filtered multiple first SQL requests is used as the second SQL request; After each of the plurality of server terminals forwards the first SQL request to the corresponding source database, the method further includes: adding different tags to the keywords of the first SQL request in each source database, wherein the tags are obtained according to preset parameters corresponding to each source database; After filtering multiple first SQL requests, and before selecting one of the filtered first SQL requests as the second SQL request, the method further includes: the request filtering unit performs de-labeling processing on the multiple first SQL requests and retains the label of one of the SQL requests; The request combining unit sends the second SQL request to the target database.

2. The method according to claim 1, characterized in that, If the first SQL request is a read request, then after the request combining unit sends the second SQL request to the target database, the method further includes: The request combining unit receives the read result returned by the target database, and the read result is obtained by the target database in processing the read request; The request combining unit sends the read result to the request forwarding unit; The request forwarding unit forwards the read result to the client.

3. The method according to claim 2, characterized in that, Before the request forwarding unit forwards the read result to the client, the method further includes: The request forwarding unit checks the read result and obtains the check result corresponding to the read result; The request forwarding unit forwards the inspection results to the client.

4. A database request combining device, characterized in that, The device includes: The request forwarding unit is used to receive a first SQL request sent from the client and forward the first SQL request to multiple servers. Multiple server-side components are used to forward the first SQL request to the corresponding source database; Multiple source database servers are used to send the first SQL request to the request combining unit, respectively; The request combining unit is used to receive the first SQL request sent by the server of each source database, and to perform combining and filtering of multiple first SQL requests includes: if one of the source database servers is attacked, the first SQL request will be different from the first SQL request sent by the source database server, so the SQL request of the source database server is removed, and one of the filtered multiple first SQL requests is used as the second SQL request; and the second SQL request is sent to the target database. After each of the plurality of server terminals forwards the first SQL request to the corresponding source database, the database request combining device is further configured to: add different tags to the keywords of the first SQL request in each source database, the tags being obtained based on preset parameters corresponding to each source database; After filtering and combining multiple first SQL requests, before selecting one of the filtered first SQL requests as the second SQL request, the request combining unit is further configured to de-label the multiple first SQL requests and retain the label of one of the SQL requests.

5. The apparatus according to claim 4, characterized in that, If the first SQL request is a read request, the request combining unit is further configured to receive the read result returned by the target database, the read result being obtained by the target database processing the read request; and send the read result to the request forwarding unit. The request forwarding unit then forwards the read result to the client.

6. The apparatus according to claim 5, characterized in that, Before the request forwarding unit forwards the read result to the client, the request forwarding unit is further configured to check the read result to obtain the check result corresponding to the read result; and forward the check result to the client.

7. An electronic device, characterized in that, include: Memory, used to store one or more programs; processor; When the one or more programs are executed by the processor, the method as described in any one of claims 1 to 3 is implemented.

8. A storage medium, characterized in that, The storage medium stores a program that, when executed by a processor, implements the method of any one of claims 1 to 3.

Images