A database access control method, device, system and storage medium

Abstract

The application relates to a database access control method, device, system and storage medium, wherein the database access control method comprises the following steps: obtaining a database access statement corresponding to a target database input by a current operation user; parsing the database access statement to obtain a target operation instruction and a corresponding target database object; judging whether the current operation user has the right to execute the database access statement according to the target operation instruction and the target database object; if yes, sending the database access statement to the target database; and if not, blocking the database access statement. Compared with the common database access control method in the prior art, the database access control method in the application can realize more accurate and detailed access control. Meanwhile, the method can be executed by an access control system independent of a database system and does not depend on the permission judgment function built in the database itself.

Description

Technical Field

[0001] This application relates to the field of database security, and in particular to a database access control method, apparatus, system and storage medium. Background Technology

[0002] Existing database access control auditing solutions mainly include:

[0003] 1. Use the database system's built-in permission management and audit logs based on users, roles, and database objects for access control and auditing.

[0004] 2. Use a bastion host to manage database assets and implement access control at the asset level, while recording operations and auditing the recordings.

[0005] The first approach mentioned above has the following drawbacks because it relies on the built-in functions of the database system: it can only perform permission management, access control, and auditing for one type of database; it can only authorize users through command statements, making management inconvenient and inflexible; after enabling the database auditing function, a large amount of audit log data will be written to the database, which will have a significant impact on database performance; it only generates audit record files, making it inconvenient to perform audit queries and audit analysis.

[0006] Although the second approach is independent of the database system, it can only perform coarse-grained instruction-level access control and cannot perform fine-grained access control for specific database objects; moreover, it can only perform screen recording auditing and is not convenient for audit querying and audit analysis.

[0007] Therefore, existing technologies lack database access control methods that can be independent of the database system, achieve fine-grained access control, and provide unified access control for multiple databases.

[0008] There is currently no effective solution to the problem that existing database access control methods cannot achieve fine-grained access control independently of the database system. Summary of the Invention

[0009] This invention provides a database access control method, apparatus, system, and storage medium to address the problem that existing database access control methods cannot achieve fine-grained access control independently of the database system.

[0010] In a first aspect, the present invention provides a database access control method, the method comprising:

[0011] Connect to the target database;

[0012] Retrieve the database access statement corresponding to the target database, input by the current user.

[0013] Parse the database access statement to obtain the target operation instruction and its corresponding target database object;

[0014] Based on the target operation instruction and the target database object, determine whether the current user has the right to execute the database access statement;

[0015] If yes, then send the database access statement to the target database; if no, then block the database access statement.

[0016] In some embodiments, determining whether the current user has permission to execute the database access statement based on the target operation instruction and the target database object includes:

[0017] Obtain the total operation permissions of the current user, the total operation permissions include multiple sub-operation permissions corresponding to multiple databases, and the sub-operation permissions include operation instructions and their corresponding database objects;

[0018] Determine the target sub-operation permissions corresponding to the target database from the total operation permissions;

[0019] Match the target operation instruction and its corresponding target database object with the target sub-operation permissions;

[0020] Based on the matching results, determine whether the current user has the right to execute the database access statement.

[0021] In some embodiments, the method further includes:

[0022] Retrieve permission configuration information entered by the user;

[0023] Generate total operating permissions for at least one user based on the permission configuration information.

[0024] In some embodiments, the permission configuration information includes role information, permission information, and allocation information;

[0025] The step of generating total operation permissions for at least one user based on the permission configuration information includes:

[0026] Create at least one operational role based on the aforementioned role information;

[0027] Based on the permission information, determine the total operation permissions of at least one of the operation roles;

[0028] At least one of the operation roles is assigned to at least one of the operation users based on the allocation information.

[0029] In some embodiments, the plurality of databases includes at least two different types of databases.

[0030] In some embodiments, the method further includes:

[0031] Obtain the current login information, and determine the current user based on the current login information;

[0032] Determine the operable databases that the current user has the right to access, and send the operable databases to the current user.

[0033] In response to the selection instruction of the current operating user, the target database is determined from the operable database.

[0034] In some embodiments, the method further includes:

[0035] An audit log is generated based on the current user, the corresponding database access statement, and the target database.

[0036] Obtain log query information input by the audit user, and determine the target log data from the audit log based on the log query information;

[0037] Send the target log data to the audit user.

[0038] Secondly, this invention provides a database access control device, the device comprising:

[0039] The statement acquisition module is used to acquire the database access statement corresponding to the target database input by the current user.

[0040] The statement parsing module is used to parse the database access statement to obtain the target operation instruction and its corresponding target database object;

[0041] The permission determination module is used to determine whether the current user has the right to execute the database access statement based on the target operation instruction and the target database object;

[0042] The control execution module is configured to send the database access statement to the target database when the current operating user has the right to execute the database access statement; and to block the database access statement when the current operating user does not have the right to execute the database access statement.

[0043] Thirdly, the present invention provides a database access control system, the system comprising: a web server and a web client, wherein the web client and the web server are connected in communication.

[0044] The web server is used to execute the database access control method described in the first aspect above.

[0045] Fourthly, the present invention provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the database access control method described in the first aspect above.

[0046] Compared with related technologies, the database access control method, apparatus, system, and storage medium provided in this invention determine whether the current user has the right to execute the corresponding database access statement based on the target operation instruction and the target database object. The permission determination is refined to the database object level, thereby achieving access control at the database object level. Compared with common database access control methods in the prior art, the database access control method in this invention can achieve more precise and granular access control. Furthermore, this method can be executed by an access control system independent of the database system, without relying on the database's built-in permission determination function, thus solving the problem that existing database access control methods cannot achieve fine-grained access control independently of the database system. Additionally, this database access control method can uniformly control access to multiple types of databases.

[0047] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0048] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0049] Figure 1 This is a hardware structure block diagram of the terminal executing the database access control method of the present invention;

[0050] Figure 2 This is a flowchart of the database access control method in an embodiment of the present invention;

[0051] Figure 3 This is a structural diagram of the database access control auditing system in a preferred embodiment of the present invention;

[0052] Figure 4 This is a structural block diagram of a database access control device according to an embodiment of the present invention. Detailed Implementation

[0053] To better understand the purpose, technical solution, and advantages of this application, the application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0054] Unless otherwise defined, the technical or scientific terms used in this application shall have the general meaning as understood by one of ordinary skill in the art to which this application pertains. Words such as “a,” “an,” “an,” “the,” “the,” and “these,” used in this application, do not indicate quantitative limitation and may be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to such processes, methods, products, or devices. The terms “connected,” “linked,” and “coupled,” used in this application, are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. The term “multiple” used in this application refers to two or more. The "and / or" operator describes the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: A alone, A and B simultaneously, and B alone. Typically, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," and "third," etc., used in this application are merely for distinguishing similar objects and do not represent a specific ordering of the objects.

[0055] The method embodiments provided in this example can be executed on a terminal, computer, or similar computing device. For example, it can run on a terminal. Figure 1 This is a hardware structure block diagram of the terminal executing the database access control method of the present invention. For example... Figure 1 As shown, a terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 and a memory 104 for storing data are also included. The processor 102 may be, but is not limited to, a microprocessor (MCU) or a programmable logic device (FPGA). The terminal may also include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that… Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the terminal described above. For example, the terminal may also include components that are larger than... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown are illustrated.

[0056] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the database access control method in this invention. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, thereby implementing the aforementioned method. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0057] The transmission device 106 is used to receive or send data via a network. This network includes a wireless network provided by the terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 can be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0058] This invention provides a database access control method. Figure 2 This is a flowchart of a database access control method in an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0059] Step S210: Obtain the database access statement corresponding to the target database input by the current user.

[0060] Specifically, the access control system first obtains the database access statement entered by the current user. Typically, after logging into the access control system, the user needs to select the target database to connect to. Based on the user's selection, the access control system establishes a connection with the target database. Then, the user enters the corresponding database access statement. Therefore, the database access statement entered by the user corresponds to the target database. For example, the database access statement can be an SQL (Structured Query Language) statement. Structured Query Language is a database query and programming language used for accessing, querying, updating, and managing relational database systems.

[0061] Step S220: Parse the database access statement to obtain the target operation instruction and its corresponding target database object.

[0062] Specifically, after receiving a database access statement, the access control system parses it to extract the operation instructions and database objects within the statement. Database objects refer to tables, indexes, views, charts, default values, rules, triggers, users, functions, etc., stored in the database. Operation instructions guide the database to perform relevant operations on the corresponding database objects.

[0063] Step S230: Based on the target operation instruction and the target database object, determine whether the current user has the right to execute database access statements.

[0064] Specifically, after parsing the target operation instruction and the target database object, the access control system determines whether the current user has the necessary permissions, i.e., whether the current user is authorized to perform the target operation on the target database object. In this method, the permission determination is refined to the database object level, thus achieving access control at the database object level. Existing common database access control methods only achieve database-level access control, i.e., determining whether the database access language can enter the corresponding database based on the database and operation instruction, i.e., determining whether the user is authorized to perform the target operation on the target database. Therefore, the database access control method in this invention can achieve more precise and granular access control. Furthermore, when the user has the right to execute the database access statement, the access control system executes step S240; otherwise, it executes step S250.

[0065] Step S240: Send a database access statement to the target database.

[0066] Specifically, when it is determined that the current user has the right to access, the database access control system sends the corresponding database access statement to the target database. Since the target database will perform the target operation on the target database object according to the target operation instruction and return the operation result to the data access control system, the system then sends the operation result to the current user.

[0067] Step S250: Block database access statements.

[0068] Specifically, if it is determined that the current user does not have permission to access the database, the database access statement will be blocked, meaning the database access statement will not be sent to the target database. The blocking result will also be sent to the current user, informing them that they are not authorized to execute the database access statement.

[0069] Through the above steps, the database access control system determines whether the current user has the right to execute the corresponding database access statement based on the target operation instruction and the target database object. The permission determination is refined to the database object level, thus achieving access control at the database object level. Compared to common database access control methods in the prior art, the database access control method in this invention can achieve more precise and granular access control. Furthermore, this method can be executed by an access control system independent of the database system, without relying on the database's built-in permission determination function.

[0070] In some embodiments, step S230, determining whether the current user has permission to execute database access statements based on the target operation instruction and the target database object, includes:

[0071] Step S231: Obtain the total operation permissions of the current user. The total operation permissions include multiple sub-operation permissions corresponding to multiple databases. The sub-operation permissions include operation instructions and their corresponding database objects. Step S232: Determine the target sub-operation permissions corresponding to the target database from the total operation permissions. Step S233: Match the target operation instructions and their corresponding target database objects with the target sub-operation permissions. Step S234: Determine whether the current user has the right to execute database access statements based on the matching results.

[0072] This embodiment provides a specific process for determining whether a user has the right to execute relevant access statements. The database access control system first obtains the total operating permissions of the current user. These total operating permissions consist of multiple sub-operating permissions, each corresponding to a different database. The total operating permissions need to be pre-configured and represent the user's operating permissions across multiple databases. Therefore, the database access control method in this invention simultaneously accesses and controls multiple databases. In a preferred embodiment, the multiple databases include at least two different types, such as Oracle, MySQL, PostgreSQL, and DB2. Furthermore, in this preferred embodiment, the database access control method can access and control multiple types of databases. Existing access control methods typically only target one type of database. After obtaining the total operating permissions of the current user, the database access control system determines the target sub-operating permissions corresponding to the target database. These permissions include the operation instructions that the current user can execute and their corresponding database objects. Therefore, the database access control system can match the target operation instructions and their corresponding target databases with the target sub-operating permissions. If a match is found, the current user has the right to execute the corresponding database access statement; otherwise, they do not.

[0073] In some embodiments, the database access control method further includes:

[0074] Step 261: Obtain the permission configuration information entered by the management user.

[0075] Specifically, since the overall operational permissions of the user need to be pre-configured, the database access control system also needs to first obtain the permission configuration information entered by the management user. The management user is the administrator of the database access control system. The permission configuration information includes at least role information, permission information, and allocation information.

[0076] Step 262: Generate total operation permissions for at least one user based on the permission configuration information.

[0077] Specifically, the database access control system first obtains the role information input by the management user and creates at least one operation role based on this information. An operation role can be understood as a virtual role. Next, it obtains the permission information input by the management user and configures the total operation permissions for each operation role. This includes the databases that each operation role can access, the database objects that the operation role can manipulate within those databases, and the corresponding operation commands. After the total operation permissions for the operation roles are fully configured, the database access control system assigns these operation roles to different operation users based on the allocation information input by the management user. Each operation user can be bound to at least one operation role, thereby obtaining the total operation permissions for that corresponding operation role.

[0078] In some embodiments, the database access control method further includes:

[0079] Step 271: Obtain the current login information and determine the current user based on the current login information; Step 272: Determine the operable databases that the current user has the right to access and send the operable databases to the current user; Step 273: Respond to the selection command of the current user and determine the target database from the operable databases.

[0080] In this embodiment, before obtaining the database access statement input by the current user, the user's login information is first obtained to determine the current user. At this point, based on the current user's total access permissions, the databases that the user can access are determined, and the corresponding permission information is sent to the current user. Then, the user's end (e.g., a browser) can display the databases accessible to the current user, allowing the user to select the database they wish to access and then input the corresponding database access statement. The database access control system then designates the database selected by the user as the target database.

[0081] In some embodiments, the database access control method further includes:

[0082] Step 281: Generate audit logs based on the current user, their corresponding database access statement, and the target database; Step 282: Obtain log query information input by the audit user, and determine the target log data from the audit logs based on the log query information; Step 283: Send the target log data to the audit user.

[0083] In this embodiment, the database access control system also generates audit logs based on database access statements, thereby recording the user's access operations on the database. Therefore, the database access control system also responds to the audit user's log query information, sending the target log data to the audit user. Since this database access control system is independent of the database and generates log files based on database access statements, the database's own auditing function can be disabled, preventing the database from generating its own log files. Furthermore, the log query information can include filtering conditions such as: database type, database, operation time, operation command, database object, etc.

[0084] Based on the above database access control method, the present invention also provides a database access control system, the system including: a web server and a web client, wherein the web client and the web server communicate with each other; the web server is used to execute the above database access control method.

[0085] Specifically, this database access control system is implemented based on web technology. The database access control methods described above are executed by a web server, and the web client can be a browser. Therefore, users can directly access the web server through a browser and use the database access control system through a web page.

[0086] The technical solution of the present invention will be described below through specific preferred embodiments.

[0087] Figure 3 This is a structural diagram of a database access control auditing system according to a preferred embodiment of the present invention. (Refer to...) Figure 3 The database access control audit system 500 includes: a permission management subsystem 510, a database operation subsystem 520, and an audit management subsystem 530. The database operation subsystem 510 can establish connections with multiple databases in the database system 600 (such as target database 1, target database 2, target database 3, etc.) and send user-inputted database access statements to them.

[0088] For the access control subsystem 510, the database administrator logs into the web system through a browser to manage access: first, the information of each database that needs access control management is configured into the system (the system can configure various different database types supported by the system, such as Oracle, MySQL, PostgreSQL, DB2, etc.), and then different operation access permission policies are configured for each database according to different access control needs.

[0089] For the database operation subsystem 520, the database operator logs into the web system through a browser to perform database operations: on the web page, the operator selects the database to be accessed, enters an SQL statement for execution, the system checks the access permissions of the entered SQL statement, blocks SQL statements that are not authorized to be executed, and sends SQL statements that are authorized to be executed to the target database. After the execution is completed, the execution result is obtained and displayed to the database operator on the web page.

[0090] For Audit Management Subsystem 530, auditors can log in to the web system via a browser to perform database operations and query audit logs: on the web page, different filtering and query conditions can be set as needed to retrieve relevant audit logs.

[0091] The database permission management process is as follows:

[0092] 1. The database administrator logs in to the database permission management page through a browser.

[0093] 2. Database administrators define database operation roles as needed.

[0094] 3. The database administrator assigns operation roles to database operators.

[0095] 4. Database administrators configure connection access information for each database that requires access control. The types of databases that can be configured are various databases supported by the system, such as Oracle, MySQL, PostgreSQL, DB2, etc. Therefore, multiple databases can be configured and managed, and multiple connections can be configured for each database.

[0096] 5. Database administrators configure operation permissions based on the configured database connections, using operation commands (such as select, insert, update, delete, etc.) + database objects (such as databases, tables, etc.) to generate operation permissions.

[0097] 6. The database administrator grants the configured operation permissions to the relevant operation roles. Database operators with the corresponding operation roles then obtain the corresponding operation permissions, thus completing the setting of operation access permissions.

[0098] The database access control process is as follows:

[0099] 1. Database operators can log in to the database operation page through a browser and see various databases that they have permission to operate on. Each database has multiple database connections.

[0100] 2. The database operator selects the database connection to operate on.

[0101] 3. The database operator opens the corresponding database connection.

[0102] 4. Enter the SQL statement in the SQL statement editing area.

[0103] 5. After the SQL statement is written, execute the corresponding SQL statement.

[0104] 6. The system parses the SQL statement to be executed, and obtains the operation instructions and database objects in the SQL statement.

[0105] 7. Obtain the operation permission information of the corresponding database operator from the permission management module, perform permission calculation based on the parsed operation instructions and database objects, and calculate whether the database operator has permission to execute SQL statements.

[0106] 8. If permission is granted: The system sends the SQL statement to the target database corresponding to the database connection for execution; the system obtains the execution result of the SQL statement from the target database; the system records the database operation audit log of the SQL statement (the target database does not need to enable the audit function, thus affecting the database performance); the system returns the execution result of the SQL statement from the target database to the web page for display to the database operator.

[0107] 9. If not authorized to execute: The system will block the SQL statement and will not send the SQL statement to the target database corresponding to the database connection; the system will return the blocking result to the web page to display to the database operator.

[0108] The database operation audit log processing flow is as follows:

[0109] 1. Auditors can log in to the database operation audit page through a browser and query the operation audit logs of multiple databases and multiple database connections supported by the system.

[0110] 2. Auditors can select and set different database audit log query conditions as needed, such as: database type, database connection, operation time, operation command, database object, etc.

[0111] 3. The system performs filtering and calculations based on the conditions set by the auditor to retrieve audit log data that meets the conditions.

[0112] 4. Return the audit log data that meets the criteria to the web page for the auditor to view, so that the auditor can carry out audit tracking work.

[0113] As can be seen from the above preferred embodiments, the technical solution of the present invention has the following technical effects:

[0114] 1. Provide unified permission management, access control, and auditing for multiple databases, such as Oracle, MySQL, PostgreSQL, and DB2.

[0115] 2. Database access control can be easily managed through a web page, reducing the workload of database administrators.

[0116] 3. It is not necessary to enable the auditing function in the database, thus avoiding impacting database performance.

[0117] 4. Auditors can easily obtain the audit log information they need by flexibly setting filtering conditions through the web page, reducing their workload in audit analysis. For example, they can analyze database audit log files or database audit recordings.

[0118] This embodiment also provides a database access control device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. The terms "module," "unit," "subunit," etc., used below refer to combinations of software and / or hardware that perform a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0119] Figure 4 This is a structural block diagram of a database access control device according to an embodiment of the present invention, such as... Figure 4 As shown, the device includes:

[0120] The statement acquisition module 410 is used to acquire the database access statement corresponding to the target database input by the current user.

[0121] The statement parsing module 420 is used to parse database access statements to obtain the target operation instructions and their corresponding target database objects.

[0122] The permission determination module 430 is used to determine whether the current user has the right to execute database access statements based on the target operation instruction and the target database object.

[0123] The control execution module 440 is used to send a database access statement to the target database when the current user has the right to execute the database access statement; and to block the database access statement when the current user does not have the right to execute the database access statement.

[0124] Through the aforementioned modules, the database access device determines whether the current user has the authority to execute the corresponding database access statement based on the target operation instruction and the target database object. The permission determination is refined to the database object level, thus achieving access control at the database object level. Compared to common database access control methods in the prior art, the database access control device of this invention can achieve more precise and granular access control. Furthermore, this device can be applied to access control systems independent of the database system, without relying on the database's built-in permission determination function.

[0125] It should be noted that the above modules can be functional modules or program modules, and can be implemented through software or hardware. For modules implemented through hardware, the above modules can reside in the same processor; or the above modules can be located in different processors in any combination.

[0126] This embodiment also provides an electronic device including a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform the steps in any of the above method embodiments.

[0127] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated in this embodiment.

[0128] Furthermore, in conjunction with the database access control methods provided in the above embodiments, this embodiment can also provide a storage medium for implementation. The storage medium stores a computer program; when executed by a processor, the computer program implements any of the database access control methods described in the above embodiments.

[0129] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0130] It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. All other embodiments derived by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0131] Obviously, the accompanying drawings are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar situations based on these drawings without any creative effort. Furthermore, it is understood that although the work done in this development process may be complex and lengthy, for those skilled in the art, certain design, manufacturing, or production modifications made based on the technical content disclosed in this application are merely conventional technical means and should not be considered as insufficient disclosure of this application.

[0132] The term "embodiment" in this application refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily imply the same embodiment, nor does it imply that it is mutually exclusive with or independent of other embodiments. It will be clearly or implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0133] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of patent protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the appended claims.

Claims

1. A database access control method characterized by, The method, executed by a web server, includes: Retrieve the database access statement corresponding to the target database, entered by the current user through the web client; Parse the database access statement to obtain the target operation instruction and its corresponding target database object; Based on the target operation instruction and the target database object, determine whether the current user has the right to execute the database access statement; If so, then send the database access statement to the target database; If not, then block the database access statement; The target database is one of a set of pre-defined databases, which include at least two different types of databases.

2. The database access control method according to claim 1, characterized by, The step of determining whether the current user has the right to execute the database access statement based on the target operation instruction and the target database object includes: Obtain the total operation permissions of the current user, the total operation permissions include multiple sub-operation permissions corresponding to multiple databases, and the sub-operation permissions include operation instructions and their corresponding database objects; Determine the target sub-operation permissions corresponding to the target database from the total operation permissions; Match the target operation instruction and its corresponding target database object with the target sub-operation permissions; Based on the matching results, determine whether the current user has the right to execute the database access statement.

3. The database access control method according to claim 2, characterized by, The method further includes: Retrieve permission configuration information entered by the user; Generate total operating permissions for at least one user based on the permission configuration information.

4. The database access control method according to claim 3, characterized in that, The permission configuration information includes role information, permission information, and allocation information; The step of generating total operation permissions for at least one user based on the permission configuration information includes: Create at least one operational role based on the aforementioned role information; Based on the permission information, determine the total operation permissions of at least one of the operation roles; At least one of the operation roles is assigned to at least one of the operation users based on the allocation information.

5. The database access control method according to claim 1, characterized in that, The method further includes: Obtain the current login information, and determine the current user based on the current login information; Determine the operable databases that the current user has the right to access, and send the operable databases to the current user. In response to the selection instruction of the current operating user, the target database is determined from the operable database.

6. The database access control method according to claim 2, characterized in that, The method further includes: An audit log is generated based on the current user, the corresponding database access statement, and the target database. Obtain log query information input by the audit user, and determine the target log data from the audit log based on the log query information; Send the target log data to the audit user.

7. A database access control device, characterized in that, The device includes: The statement acquisition module is used to acquire the database access statement corresponding to the target database that is entered by the current user through the web client; The statement parsing module is used to parse the database access statement to obtain the target operation instruction and its corresponding target database object; The permission determination module is used to determine whether the current user has the right to execute the database access statement based on the target operation instruction and the target database object; The control execution module is configured to send the database access statement to the target database when the current operating user has the right to execute the database access statement; and to block the database access statement when the current operating user does not have the right to execute the database access statement. The target database is one of a set of pre-defined databases, which include at least two different types of databases.

8. A database access control system, characterized in that, The system includes: a web server and a web client, wherein the web client and the web server communicate with each other. The web server is used to execute the database access control method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the database access control method according to any one of claims 1 to 6.

Images