Data access method, device, storage medium and electronic device

Abstract

The present disclosure relates to a data access method, device, storage medium and electronic device, and relates to the field of computer technology. The method comprises: first, in response to a target application deployed in a first network segment, initiating a target access request to a target client deployed in a second network segment; filtering and processing the target access request through a proxy client deployed in the first network segment; forwarding the target access request to a proxy server deployed in the second network segment; then, authenticating the target access request by the proxy server deployed in the second network segment; forwarding the authenticated target access request to a database server in the second network segment; and the database server in the second network segment responding to the target access request. In this way, by setting up a proxy client and a proxy server, and restricting access to the proxy client and the proxy server, the security of the cross-segment network connection is further improved, the data access traffic can be accurately controlled, and the possibility of network attacks can be reduced.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of computer technology, and in particular to a data access method, device, storage medium, and electronic device. Background Art

[0002] Database access typically occurs within the local area network (LAN) and is not open to the outside world. However, in some specialized scenarios, such as database data sharing and access across different network segments, data warehouses aggregating heterogeneous data from multiple sources, and cross-network database clusters, clients and apps accessing cross-network databases inevitably face data transmission security issues. For example, network data collection and analysis tools (TCPDUMP) and packet capture tools can easily capture sensitive data transmitted over the network.

[0003] While the database server's built-in SSL (Secure Sockets Layer) / TLS (Transport Layer Security) encryption can address these issues, enabling SSL / TLS certificates and keys complicates development and deployment. The requirements and configurations for enabling SSL / TLS secure database access vary widely across development languages ​​and database client drivers, increasing the complexity for app developers and even requiring business system restructuring to meet security requirements.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute prior art known to ordinary technicians in this field. Summary of the Invention

[0005] In order to overcome the problems existing in the related art, the present disclosure provides a data access method, device, storage medium and electronic device, so as to at least solve the problem in the related art that different development languages, database drivers, etc. have different requirements and configurations for accessing the SSL / TLS secure access database, which will increase the difficulty for APP developers and even cause the business system to be restructured to meet the security needs.

[0006] According to one aspect of the present disclosure, a data access method is provided, the method comprising:

[0007] In response to a target application deployed on the first network segment initiating a target access request to a target client deployed on the second network segment, filtering the target access request through the proxy client deployed on the first network segment and forwarding the target access request to the proxy server deployed on the second network segment;

[0008] The proxy server deployed in the second network segment authenticates the target access request and forwards the authenticated target access request to the database server in the second network segment;

[0009] The database server in the second network segment responds to the target access request.

[0010] Optionally, filtering the target access request by a proxy client deployed on the first network segment and forwarding the target access request to a proxy server deployed on the second network segment includes:

[0011] Determining an access address of the target access request;

[0012] The access address is compared with the local address of the target client, and the target access request with the consistent address is forwarded to the proxy server deployed in the second network segment.

[0013] Optionally, before forwarding the target access request with the consistent address to the proxy server deployed in the second network segment, the method further includes:

[0014] The target access request with the same address is signed and encrypted, and the encrypted target access request is forwarded to the proxy server deployed in the second network segment.

[0015] Optionally, the proxy server deployed on the second network segment authenticates the target access request, including:

[0016] The proxy server authenticates the signature included in the target access request and rejects the target access request that fails the signature authentication.

[0017] Optionally, before the proxy server deployed on the second network segment authenticates the target access request, the method further includes:

[0018] determining permission information included in a proxy client that forwards the target access request;

[0019] detecting whether the license information contained in the proxy client matches the stored preset license information;

[0020] If they match, the operation of authenticating the target access request is performed; if they do not match, the proxy client is denied from forwarding the target access request.

[0021] Optionally, forwarding the authenticated target access request to the database server in the second network segment includes:

[0022] The proxy server deployed in the second network segment receives the target access request that passes the authentication;

[0023] The proxy server decrypts the authenticated target access request and forwards the decrypted target access request to the database server in the second network segment.

[0024] Optionally, after the database server in the second network segment responds to the target access request, the method includes:

[0025] The response result of the target access request is returned to the target application through the proxy server and the proxy client.

[0026] According to one aspect of the present disclosure, a data access device is provided, the device comprising:

[0027] a filtering module configured to, in response to a target application deployed on a first network segment initiating a target access request to a target client deployed on a second network segment, filter the target access request through a proxy client deployed on the first network segment, and forward the target access request to a proxy server deployed on the second network segment;

[0028] An authentication module, configured to authenticate the target access request on a proxy server deployed on the second network segment, and forward the authenticated target access request to a database server in the second network segment;

[0029] A response module is used for the database server in the second network segment to respond to the target access request.

[0030] Optionally, the filtering module is further used to:

[0031] Determining an access address of the target access request;

[0032] The access address is compared with the local address of the target client, and the target access request with the consistent address is forwarded to the proxy server deployed in the second network segment.

[0033] Optionally, before forwarding the target access request with the consistent address to the proxy server deployed in the second network segment, the apparatus further includes:

[0034] The encryption module is used to perform signature encryption processing on the target access request with the same address, and forward the encrypted target access request to the proxy server deployed in the second network segment.

[0035] Optionally, the authentication module is further configured to:

[0036] The proxy server authenticates the signature included in the target access request and rejects the target access request that fails the signature authentication.

[0037] Optionally, before the proxy server deployed on the second network segment authenticates the target access request, the apparatus further includes:

[0038] a determination module, configured to determine the permission information contained in the proxy client that forwards the target access request;

[0039] The detection module is used to detect whether the permission information contained in the proxy client matches the stored preset permission information; if so, perform an operation to authenticate the target access request; if not, refuse the proxy client to forward the target access request.

[0040] Optionally, the authentication module is further configured to:

[0041] The proxy server deployed in the second network segment receives the target access request that passes the authentication;

[0042] The proxy server decrypts the authenticated target access request and forwards the decrypted target access request to the database server in the second network segment.

[0043] Optionally, after the database server in the second network segment responds to the target access request, the apparatus includes:

[0044] The returning module is used to return the response result of the target access request to the target application through the proxy server and the proxy client.

[0045] According to one aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the computer program implements any one of the above-mentioned data access methods.

[0046] According to one aspect of the present disclosure, there is provided an electronic device, including:

[0047] processor; and

[0048] a memory for storing executable instructions of the processor;

[0049] The processor is configured to execute any one of the above-mentioned data access methods by executing the executable instructions.

[0050] In summary, the data access method provided by the embodiment of the present invention can first respond to the target application deployed in the first network segment and initiate a target access request to the target client deployed in the second network segment, filter the target access request through the proxy client deployed in the first network segment, forward the target access request to the proxy server deployed in the second network segment, and then authenticate the target access request by the proxy server deployed in the second network segment, and forward the authenticated target access request to the database server in the second network segment, and the database server in the second network segment responds to the target access request. In this way, by setting up a proxy client and a proxy server, and restricting access to the proxy client and the proxy server, the security of the cross-segment network connection can be further improved, the data processing rate can be increased, and the data access traffic can be accurately controlled, while also reducing the possibility of network attacks.

[0051] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification, are used to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0053] Figure 1 A flowchart schematically illustrates a data access method provided by an embodiment of the present disclosure;

[0054] Figure 2 A flowchart schematically illustrates a step of filtering a target access request provided by an embodiment of the present disclosure;

[0055] Figure 3 A flowchart schematically illustrates a step of authenticating a target access request provided by an embodiment of the present disclosure;

[0056] Figure 4 A flowchart schematically illustrates a step of forwarding a target access request provided by an embodiment of the present disclosure;

[0057] Figure 5 A block diagram schematically illustrates a data access device provided by an embodiment of the present disclosure;

[0058] Figure 6 An electronic device for implementing the above-mentioned data access method provided by an embodiment of the present disclosure is schematically illustrated. DETAILED DESCRIPTION

[0059] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the present disclosure will be more comprehensive and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or that other methods, components, devices, steps, etc. may be employed. In other cases, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0060] In addition, the accompanying drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. Identical reference numerals in the figures denote identical or similar parts, and thus repetitive descriptions thereof will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0061] Figure 1 This is a flowchart of a data access method provided by an embodiment of the present disclosure. Figure 1 As shown, the method may include:

[0062] Step S101: In response to a target application deployed in the first network segment initiating a target access request to a target client deployed in the second network segment, the target access request is filtered and processed by the proxy client deployed in the first network segment, and the target access request is forwarded to the proxy server deployed in the second network segment.

[0063] In the disclosed embodiment, a target application deployed on a first network segment may initiate a target access request to a target client deployed on a second network segment. In response to the target access request, a proxy client deployed on the same network segment as the target application, i.e., the proxy client deployed on the first network segment, filters the target access request and forwards the filtered target access request to a proxy server deployed on the second network segment. Since the target access request is a data transmission between the target application and the proxy client within the same network segment, the target access request can be a transparent access request. Furthermore, the proxy client can be restricted to only receiving access from devices within the first network segment.

[0064] Step S102: The proxy server deployed in the second network segment authenticates the target access request and forwards the authenticated target access request to the database server in the second network segment.

[0065] In the embodiment of the present disclosure, since the proxy server deployed in the second network segment needs to be authenticated when sending access requests to other network segments, the target access request can be forwarded to the database server in the second network segment only if the authentication is passed. In addition, the proxy server can be set to limit the IP address of the client, that is, only requests sent by the client with the recorded IP address are passed.

[0066] Step S103: The database server in the second network segment responds to the target access request.

[0067] In the embodiment of the present disclosure, the database server in the second network segment responds to the target access request, which may be that the database server in the second network segment processes the target access request and obtains a response result to the target access request.

[0068] In summary, the data access method provided by the embodiment of the present invention can first respond to the target application deployed in the first network segment and initiate a target access request to the target client deployed in the second network segment, filter the target access request through the proxy client deployed in the first network segment, forward the target access request to the proxy server deployed in the second network segment, and then authenticate the target access request by the proxy server deployed in the second network segment, and forward the authenticated target access request to the database server in the second network segment, and the database server in the second network segment responds to the target access request. In this way, by setting up a proxy client and a proxy server, and restricting access to the proxy client and the proxy server, the security of the cross-segment network connection can be further improved, the data processing rate can be increased, and the data access traffic can be accurately controlled, while also reducing the possibility of network attacks.

[0069] Optionally, in the embodiment of the present disclosure, the target access request is filtered by the proxy client deployed in the first network segment and forwarded to the proxy server deployed in the second network segment, as shown in FIG. Figure 2 As shown, it may specifically include:

[0070] Step S1011: Determine the access address of the target access request.

[0071] In the embodiment of the present disclosure, the client address to be accessed by the target access request may be parsed from the target access request. The access address may be an Internet Protocol (IP) address or other network protocol address.

[0072] Step S1012: Compare the access address with the local address of the target client, and forward the target access request with the consistent address to the proxy server deployed in the second network segment.

[0073] In the disclosed embodiment, the access address determined in the target access request can be compared with the local address of the target client. If the access address and the local address are consistent, the target access request is forwarded to the proxy server deployed on the second network segment. Because network attacks, processing errors, and other data issues may occur when generating access requests, which may cause the access address carried in the generated access request to be inconsistent with the local address, comparing the access address with the local address can avoid the problem of access requests not being able to respond normally due to address errors.

[0074] For example, the target application APP is deployed in network segment C, and initiates a target access request to the local machine deployed in network segment S. The IP address of the local machine can be 127.0.0.1. The proxy client C deployed on network segment C receives the target access request initiated by the target application APP. The proxy client C can limit the flow and reject requests from hosts other than 127.0.0.1 through the traffic control module, and then forward the target access request to the proxy server S (proxy.xyz) on network segment S after signing and encryption processing.

[0075] Optionally, in the embodiment of the present disclosure, before the operation of forwarding the target access request with the same address to the proxy server deployed in the second network segment, the following steps may be further included:

[0076] The target access request with the same address is signed and encrypted, and the encrypted target access request is forwarded to the proxy server deployed in the second network segment.

[0077] In an embodiment of the present disclosure, the target access request may be signed and encrypted using a preset encryption method. The preset encryption method may be a pre-set encryption method, which is not limited by the present disclosure. The encrypted target access request may be forwarded to a proxy server deployed in the second network segment. The encrypted target access request may be forwarded to the proxy server deployed in the second network segment via TLS secure transmission.

[0078] Optionally, in the embodiment of the present disclosure, the operation of authenticating the target access request by the proxy server deployed in the second network segment may specifically include:

[0079] The proxy server authenticates the signature included in the target access request and rejects the target access request that fails the signature authentication.

[0080] In the embodiment of the present disclosure, the signature contained in the target access request can be determined first, and then the proxy server can authenticate the signature. The target access request that passes the authentication can be forwarded to the database server in the second network segment. The target access request that fails the authentication can be rejected if it fails the signature authentication.

[0081] Optionally, in the embodiment of the present disclosure, before the proxy server deployed on the second network segment authenticates the target access request, Figure 3 As shown, it may also include:

[0082] Step S201: Determine the permission information included in the proxy client that forwards the target access request.

[0083] In the embodiment of the present disclosure, the permission information may be information set on the proxy server that allows processing of a request from a certain address. Specifically, the permission information about the proxy client may be obtained from the forwarded target access request.

[0084] Step S202: Detect whether the permission information contained in the proxy client matches the stored preset permission information.

[0085] In the embodiment of the present disclosure, the preset permission information may be information stored on the proxy server, and is used to indicate the device permitted by the proxy server. It is detected whether the permission information contained in the proxy client is the same as the stored preset permission information.

[0086] Step S203: If there is a match, the target access request is authenticated; if there is no match, the proxy client is denied from forwarding the target access request.

[0087] In an embodiment of the present disclosure, when the permission information contained in the proxy client is the same as the stored preset permission information, the operation of authenticating the target access request can be performed; when the permission information contained in the proxy client is different from the stored preset permission information, the proxy client can be refused to forward the target access request.

[0088] Optionally, in the embodiment of the present disclosure, the operation of forwarding the authenticated target access request to the database server in the second network segment is as follows: Figure 4 As shown, it may specifically include:

[0089] Step S1021: The proxy server deployed in the second network segment receives the target access request that has passed the authentication.

[0090] In the embodiment of the present disclosure, when signature authentication and permission information matching are passed, the proxy server deployed in the second network segment may receive the target access request.

[0091] Step S1022: The proxy server decrypts the authenticated target access request and forwards the decrypted target access request to the database server in the second network segment.

[0092] In an embodiment of the present disclosure, the proxy server may use a preset decryption method to decrypt the target access request forwarded by the proxy client, and forward the decrypted target access request to the database server in the second network segment, wherein the preset decryption method may be the inverse processing corresponding to the preset encryption method.

[0093] Optionally, in the embodiment of the present disclosure, after the database server in the second network segment responds to the target access request, the method may further include:

[0094] The response result of the target access request is returned to the target application through the proxy server and the proxy client.

[0095] In the embodiment of the present disclosure, the response result of the target access request may be returned to the proxy server, and then returned to the proxy client by the proxy server. Accordingly, the proxy client may receive the response result.

[0096] Figure 5 A data access device provided by an embodiment of the present disclosure is schematically shown. Figure 5 As shown, the device 30 may include:

[0097] The filtering module 301 is configured to, in response to a target application deployed on a first network segment initiating a target access request to a target client deployed on a second network segment, filter the target access request through a proxy client deployed on the first network segment, and forward the target access request to a proxy server deployed on the second network segment;

[0098] An authentication module 302 is configured to authenticate the target access request on a proxy server deployed in the second network segment, and forward the authenticated target access request to a database server in the second network segment;

[0099] The response module 303 is configured for the database server in the second network segment to respond to the target access request.

[0100] In summary, the data access device provided by the embodiment of the present invention can first respond to the target application deployed in the first network segment and initiate a target access request to the target client deployed in the second network segment, filter the target access request through the proxy client deployed in the first network segment, forward the target access request to the proxy server deployed in the second network segment, and then authenticate the target access request by the proxy server deployed in the second network segment, and forward the authenticated target access request to the database server in the second network segment, and the database server in the second network segment responds to the target access request. In this way, by setting up a proxy client and a proxy server, and restricting access to the proxy client and the proxy server, the security of the cross-segment network connection can be further improved, the data processing rate can be increased, and the data access traffic can be accurately controlled, while also reducing the possibility of network attacks.

[0101] Optionally, the filtering module 301 is further configured to:

[0102] Determining an access address of the target access request;

[0103] The access address is compared with the local address of the target client, and the target access request with the consistent address is forwarded to the proxy server deployed in the second network segment.

[0104] Optionally, before forwarding the target access request with the consistent address to the proxy server deployed in the second network segment, the device 30 further includes:

[0105] The encryption module is used to perform signature encryption processing on the target access request with the same address, and forward the encrypted target access request to the proxy server deployed in the second network segment.

[0106] Optionally, the authentication module 302 is further configured to:

[0107] The proxy server authenticates the signature included in the target access request and rejects the target access request that fails the signature authentication.

[0108] Optionally, before the proxy server deployed on the second network segment authenticates the target access request, the device 30 further includes:

[0109] a determination module, configured to determine the permission information contained in the proxy client that forwards the target access request;

[0110] The detection module is used to detect whether the permission information contained in the proxy client matches the stored preset permission information; if so, perform an operation to authenticate the target access request; if not, refuse the proxy client to forward the target access request.

[0111] Optionally, the authentication module 302 is further configured to:

[0112] The proxy server deployed in the second network segment receives the target access request that passes the authentication;

[0113] The proxy server decrypts the authenticated target access request and forwards the decrypted target access request to the database server in the second network segment.

[0114] Optionally, after the database server in the second network segment responds to the target access request, the device 30 includes:

[0115] The returning module is used to return the response result of the target access request to the target application through the proxy server and the proxy client.

[0116] The specific details of each module in the above data access device have been described in detail in the corresponding data access method, so they will not be repeated here.

[0117] It should be noted that although several modules or units of the device for action execution are mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0118] Furthermore, although the steps of the method of the present disclosure are described in a particular order in the accompanying drawings, this does not require or imply that the steps must be performed in this particular order, or that all steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0119] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0120] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods, or program products. Therefore, various aspects of the present disclosure may be implemented in the following forms: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which may be collectively referred to herein as "circuits," "modules," or "systems."

[0121] Refer to the following Figure 64 to describe the electronic device 400 according to this embodiment of the present disclosure. Figure 6 The electronic device 400 shown is merely an example and should not limit the functionality and scope of use of the embodiments of the present disclosure.

[0122] like Figure 6 As shown, electronic device 400 is implemented as a general-purpose computing device. Components of electronic device 400 may include, but are not limited to, the aforementioned at least one processing unit 410, the aforementioned at least one storage unit 420, a bus 430 connecting various system components (including storage unit 420 and processing unit 410), and a display unit 440.

[0123] The storage unit stores program codes, which can be executed by the processing unit 410, so that the processing unit 410 performs the steps described in the "Exemplary Method" section of the present disclosure according to various exemplary embodiments. For example, the processing unit 410 can perform the following steps: Figure 1 In the step S101 shown in the figure, in response to a target application deployed in the first network segment initiating a target access request to a target client deployed in the second network segment, the target access request is filtered and processed by the proxy client deployed in the first network segment, and the target access request is forwarded to the proxy server deployed in the second network segment; in the step S102, the proxy server deployed in the second network segment authenticates the target access request, and forwards the authenticated target access request to the database server in the second network segment; in the step S103, the database server in the second network segment responds to the target access request.

[0124] The storage unit 420 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 4201 and / or a cache memory unit 4202 , and may further include a read-only memory unit (ROM) 4203 .

[0125] The storage unit 420 may also include a program / utility 4204 having a set (at least one) of program modules 4205, such program modules 4205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0126] Bus 430 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0127] The electronic device 400 can also communicate with one or more external devices 500 (e.g., a keyboard, a pointing device, a Bluetooth device, etc.), one or more devices that enable a user to interact with the electronic device 400, and / or any device that enables the electronic device 400 to communicate with one or more other computing devices (e.g., a router, a modem, etc.). Such communication can occur via an input / output (I / O) interface 450. Furthermore, the electronic device 400 can communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network such as the Internet) via a network adapter 460. As shown, the network adapter 460 communicates with other modules of the electronic device 400 via a bus 430. It should be understood that, although not shown, other hardware and / or software modules can be used in conjunction with the electronic device 400, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0128] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.

[0129] In exemplary embodiments of the present disclosure, a computer-readable storage medium is also provided, on which is stored a program product capable of implementing the aforementioned methods of this specification. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product comprising program code. When the program product is executed on a terminal device, the program code is configured to cause the terminal device to execute the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of the present disclosure.

[0130] According to an embodiment of the present disclosure, a program product for implementing the above-mentioned method can be a portable compact disc read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0131] The program product may be implemented in any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0132] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0133] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0134] The program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0135] Furthermore, the figures above are merely illustrative of the processes included in the methods according to exemplary embodiments of the present disclosure and are not intended to be limiting. It is readily understood that the processes illustrated in the figures above do not indicate or limit the temporal order of these processes. Furthermore, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0136] Other embodiments of the present disclosure will readily occur to those skilled in the art after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow from the general principles of the present disclosure and include common knowledge or customary techniques in the art not invented herein. The specification and examples are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the claims.

Claims

1. A data access method, characterized in that: The method comprises: In response to a target application deployed in a first network segment initiating a target access request to a target client deployed in a second network segment, the target access request is filtered and processed by a proxy client deployed in the first network segment, and the target access request is forwarded to a proxy server deployed in the second network segment; the filtering and processing of the target access request by the proxy client deployed in the first network segment, and the forwarding of the target access request to the proxy server deployed in the second network segment, include: determining an access address of the target access request; comparing the access address with the local address of the target client, and forwarding the target access request with the consistent address to the proxy server deployed in the second network segment; the target access request is a transparent access request; the proxy client can only accept access from devices in the first network segment; The proxy server deployed in the second network segment authenticates the target access request and forwards the authenticated target access request to the database server in the second network segment; The database server in the second network segment responds to the target access request.

2. The method according to claim 1, characterized in that Before forwarding the target access request with the consistent address to the proxy server deployed in the second network segment, the method further includes: The target access request with the same address is signed and encrypted, and the encrypted target access request is forwarded to the proxy server deployed in the second network segment.

3. The method according to claim 1, characterized in that The proxy server deployed on the second network segment authenticates the target access request, including: The proxy server authenticates the signature included in the target access request and rejects the target access request that fails the signature authentication.

4. The method according to claim 3, characterized in that Before the proxy server deployed on the second network segment authenticates the target access request, the method further includes: determining permission information included in a proxy client that forwards the target access request; detecting whether the license information contained in the proxy client matches the stored preset license information; If they match, the operation of authenticating the target access request is performed; if they do not match, the proxy client is denied from forwarding the target access request.

5. The method according to claim 3, characterized in that The step of forwarding the authenticated target access request to the database server in the second network segment includes: The proxy server deployed in the second network segment receives the target access request that passes the authentication; The proxy server decrypts the authenticated target access request and forwards the decrypted target access request to the database server in the second network segment.

6. The method according to claim 1, wherein After the database server in the second network segment responds to the target access request, the method includes: The response result of the target access request is returned to the target application through the proxy server and the proxy client.

7. A data access device, characterized in that: The device comprises: A filtering module, configured to, in response to a target application deployed in a first network segment, initiate a target access request to a target client deployed in a second network segment, filter the target access request through a proxy client deployed in the first network segment, and forward the target access request to a proxy server deployed in the second network segment; the filtering of the target access request through the proxy client deployed in the first network segment and forwarding the target access request to the proxy server deployed in the second network segment is configured to: determine an access address of the target access request; compare the access address with the local address of the target client, and forward the target access request with the consistent address to the proxy server deployed in the second network segment; the target access request is a transparent access request; and the proxy client can only accept access from devices in the first network segment; An authentication module, configured to authenticate the target access request on a proxy server deployed on the second network segment, and forward the authenticated target access request to a database server in the second network segment; A response module is used for the database server in the second network segment to respond to the target access request.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the data access method according to any one of claims 1 to 6 is implemented.

9. An electronic device, characterized in that: include: processor; as well as a memory for storing executable instructions of the processor; The processor is configured to execute the data access method according to any one of claims 1 to 6 by executing the executable instructions.

Images