A multi-database data processing method and related device

Abstract

The specification provides a multi-database data processing method and related equipment, applied to a data security gateway, the data security gateway is used for security management to the data in the multiple databases connected with it, wherein at least part of the databases are heterogeneous databases of different database types. The method comprises the following steps: obtaining the connection information of the target database to be accessed in the multiple databases sent by the target application program through the uniform driver corresponding to the multiple databases, and establishing a communication connection with the target database based on the connection information; obtaining the operation information of the target database sent by the target application program through the uniform driver, and sending the operation information to the target database based on the communication connection for data processing; obtaining the data processing result returned by the target database based on the communication connection, performing data privacy protection processing on the data processing result, and sending the processed data processing result to the target application program through the uniform driver.

Description

Technical Field

[0001] This specification relates to the field of data processing technology, and in particular to a data processing method and related equipment for multiple databases. Background Technology

[0002] With the advent of the cloud era and the digital transformation era, data security has become increasingly important. Data security gateways are a key data security protection technology that provides access control, access auditing, and dynamic data masking. The underlying layer of a data security gateway connects to databases. Currently, mainstream database engines include MySQL, SQL Server, DB2, and others. When protecting different types of databases, data security gateways often require different driver packages, leading to high costs and complex implementation in multi-database scenarios. Summary of the Invention

[0003] In view of this, one or more embodiments of this specification provide a data processing method and related equipment for multiple databases.

[0004] To achieve the above objectives, one or more embodiments of this specification provide a data processing method for multiple databases, applied to a data security gateway. The data security gateway is used for security management of data stored in multiple databases it interfaces with; wherein at least some of the multiple databases are heterogeneous databases of different database types; the method includes:

[0005] Obtain connection information for the target database to be accessed from the multiple databases sent by the target application through the unified driver corresponding to the multiple databases, and establish a communication connection with the target database based on the connection information;

[0006] The system obtains operation information for the target database sent by the target application through the unified driver, and sends the operation information to the target database for data processing based on the communication connection.

[0007] The system obtains the data processing result corresponding to the operation information returned by the target database based on the communication connection, performs data privacy protection processing on the data processing result, and sends the data processing result after data privacy protection processing to the target application through the unified driver.

[0008] Accordingly, this specification also provides a multi-database data processing device applied to a data security gateway, wherein the data security gateway is used to perform security management on data stored in multiple databases connected to it; wherein at least some of the multiple databases are heterogeneous databases of different database types; the device includes:

[0009] The first acquisition module is used to acquire connection information of the target database to be accessed in the multiple databases, sent by the target application through the unified driver corresponding to the multiple databases.

[0010] A communication establishment module is used to establish a communication connection with the target database based on the connection information.

[0011] The second acquisition module is used to acquire operation information of the target database sent by the target application through the unified driver.

[0012] The first sending module is used to send the operation information to the target database for data processing based on the communication connection;

[0013] The third acquisition module is used to acquire the data processing result corresponding to the operation information returned by the target database based on the communication connection;

[0014] The processing module is used to perform data privacy protection processing on the data processing results;

[0015] The second sending module is used to send the data processing result after data privacy protection processing to the target application through the unified driver.

[0016] In the solution provided in this specification, a unified driver is set up between the application and the data security gateway. This allows the application to interact with the data security gateway through the unified driver (e.g., by calling the unified interface provided by the unified driver) and access various heterogeneous databases connected to the data security gateway. As a result, the data security gateway can be used to provide efficient and unified data security protection for various types of heterogeneous databases, reducing the data security protection cost in multi-database scenarios. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of a system architecture provided in an exemplary embodiment;

[0018] Figure 2 This is a schematic diagram of another system architecture provided in an exemplary embodiment;

[0019] Figure 3This is a flowchart illustrating a data processing method for multiple databases provided in an exemplary embodiment;

[0020] Figure 4 This is a flowchart illustrating another data processing method for multiple databases provided in an exemplary embodiment;

[0021] Figure 5 This is a schematic diagram of the structure of a data processing apparatus for multiple databases provided in an exemplary embodiment;

[0022] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an exemplary embodiment. Detailed Implementation

[0023] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0024] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0025] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0026] First, some of the technical terms used in this specification will be explained to facilitate understanding by those skilled in the art.

[0027] (1) A database is a repository for organizing, storing, and managing data according to a data structure. It is a large collection of organized, shareable, and uniformly managed data that is stored long-term in a computer. Among them, a multi-database system is a technology that integrates multiple heterogeneous data sources to achieve information sharing.

[0028] (2) A data security gateway is a data content security protection technology used to implement security controls such as access control, access auditing, and dynamic data masking. Common data security gateways on the market include ZhongAn Xingyun Big Data Security Protection Gateway System, Yisaitong Data Security Gateway System, and Mingyu Database Security Gateway, etc.

[0029] Among them, the Zhong'an Xingyun Big Data Security Protection Gateway System is a product that provides security protection for components and data in big data platforms, supporting functions such as data discovery, access control, and security auditing. The Yisaitong Data Security Gateway System is a business system access control device that uses network traffic detection technology to detect unauthorized terminal access to application systems and can audit and block such access, effectively ensuring the security of user application system access. The Mingyu Database Security Gateway is a database security protection and access control device that can efficiently and accurately analyze and control access traffic entering and leaving the core database.

[0030] As mentioned above, although various data security gateways are emerging, they lack unified and effective management for different types of databases (i.e., heterogeneous databases with different database types). This means that when providing data security access protection for different types of databases, data security gateways often need to perform compatibility adaptations separately with each database type. For example, for each new database type supported, a corresponding driver package must be introduced. Therefore, this often results in redundancy and high costs.

[0031] Based on this, this specification provides a technical solution that allows an application to access various types of databases connected to a data security gateway through a unified driver, enabling the data security gateway to provide unified data security protection for various types of heterogeneous databases through this unified driver.

[0032] In implementation, the data security gateway can obtain connection information for a target database from multiple databases sent by the target application through the unified driver, and establish a communication connection with the target database based on this connection information. Then, the data security gateway can obtain operation information for the target database sent by the target application through the unified driver, and send this operation information to the target database based on the established communication connection. Subsequently, the data security gateway can obtain the data processing result returned by the target database based on the operation information, perform data privacy protection processing on the data processing result, and then send the privacy-protected data processing result to the target application.

[0033] In the above technical solution, by setting up a unified driver (such as a JDBC driver) between the application and the data security gateway, the application can interact with the data security gateway through the unified driver (such as by calling the JDBC interface provided by the JDBC driver) and access various heterogeneous databases connected to the data security gateway. In this way, the data security gateway can be used to provide efficient and unified data security protection for various types of heterogeneous databases, reducing the data security protection cost in multi-database scenarios.

[0034] Please see Figure 1 , Figure 1 This is a schematic diagram of a system architecture provided in an exemplary embodiment. The technical solutions of the embodiments in this specification can be... Figure 1 The specific implementation is within the system architecture shown or a similar system architecture. For example... Figure 1 As shown, the system architecture may include electronic device 100, electronic device 200a, electronic device 200b, electronic device 200c, electronic device 300a, electronic device 300b, electronic device 300c, etc.

[0035] like Figure 1 As shown, the electronic device 100 is equipped with a data security gateway.

[0036] like Figure 1 As shown, electronic devices 200a, 200b, and 200c can each store different types of databases. For example, electronic device 200a stores database A, electronic device 200b stores database B, and electronic device 200c stores database C. In one embodiment shown, databases A, B, and C can be relational databases. Specifically, databases A, B, and C can be various types of databases such as MySQL, SQL Server, and DB2.

[0037] like Figure 1 As shown, electronic devices 300a, 300b, and 300c can run corresponding applications. For example, application A runs on electronic device 300a, application B runs on electronic device 300b, and application C runs on electronic device 300c. For instance, application A, application B, and application C can be Java applications.

[0038] Furthermore, a general database interface is defined on the data security gateway in the electronic device 100. The general database interface defined on the data security gateway can establish a communication connection with the general database defined on various databases, thereby conveniently realizing unified and secure access to different types of databases.

[0039] Furthermore, electronic device 100 can also run a corresponding unified driver. Through this unified driver, the data security gateway can communicate with applications in electronic devices 300a, 300b, and 300c. Ultimately, this allows applications to access multiple databases connected to the data security gateway (e.g., database A, database B, database C, etc.) and provides them with corresponding data security protection. Please refer to the description of the following embodiments for details, which will not be elaborated here.

[0040] In one embodiment shown, the application described above can also run on electronic device 100, and this specification does not specifically limit this.

[0041] The aforementioned electronic device 100 can be a laptop computer, desktop computer, server, etc., with the above-mentioned functions. Electronic devices 200a, 200b, and 200c can be desktop computers, servers, etc., with the above-mentioned functions. For example, electronic device 200a can be a single server or a server cluster consisting of multiple servers. Electronic devices 300a, 300b, and 300c can be smart wearable devices, smartphones, tablets, laptops, desktop computers, servers, and in-vehicle computers, etc., with the above-mentioned functions, etc. This specification does not specifically limit them.

[0042] Further, please refer to Figure 2 , Figure 2 This is a schematic diagram of another system architecture provided in an exemplary embodiment. For example... Figure 2 As shown, the system may include target applications, unified drivers, data security gateways, and various databases, specifically databases A, B, and C, etc.

[0043] In one embodiment shown, databases A, B, and C can be MySQL, SQL Server, DB2, or any other possible type of database available on the market; this specification does not specifically limit them.

[0044] In one embodiment shown, the target application can be a Java application that can run on various electronic devices.

[0045] In one embodiment shown, the unified driver can be a JDBC driver. Java Database Connectivity (JDBC) is an application programming interface in the Java language that specifies how client programs access databases, establishing a communication channel between Java applications and database systems. The JDBC driver can provide a JDBC interface to the target application, which can then call this interface to implement corresponding functions. Please refer to the description of the following embodiments for details; further elaboration is not provided here.

[0046] like Figure 2 As shown, this data security gateway can communicate with the JDBC driver via the Java Native Interface (JNI) protocol. Figure 2 As shown in the embodiments of this specification, a general database interface is defined on the data security gateway, and correspondingly, each database also defines its own general database interface. Thus, the data security gateway can establish communication connections with the general database interfaces of each database through its own general database interface to achieve secure access to each database.

[0047] In one embodiment shown, the generic database interface may include an interface based on a generic programming language. For example, the generic programming language-based interface may be a C language interface (or a C program interface).

[0048] Combination Figure 1 The system shown allows databases A, B, and C to be stored on different electronic devices. The data security gateway and unified driver can run on the same electronic device. The target application can run on a separate electronic device, or it can run on the same electronic device as the data security gateway and unified driver, etc., etc., which are not specifically limited in this specification.

[0049] Please see Figure 3 , Figure 3 This is a schematic flowchart illustrating a multi-database data processing method provided in an exemplary embodiment. This method can be applied to a data security gateway operating in an electronic device. The electronic device can be, for example, the one described above. Figure 1 The electronic device 100 shown. The data security gateway can be used to securely manage data stored in multiple databases it interfaces with, at least some of which are heterogeneous databases of different database types. For example... Figure 3 As shown, the method may specifically include the following steps S101-S103.

[0050] Step S101: Obtain connection information for the target database to be accessed among the multiple databases sent by the target application through the unified driver corresponding to the multiple databases, and establish a communication connection with the target database based on the connection information.

[0051] In one embodiment, the unified driver can provide a unified interface that can be invoked by the target application. The target application can submit connection information for the target database to be accessed from multiple databases to the unified driver by invoking the unified interface provided by the unified driver. For example, the target application can construct a call request for the unified interface, carry the aforementioned connection information as a call parameter in the call request, and then submit the call request to the unified interface to initiate an interface call.

[0052] After obtaining the connection information submitted by the target application, the unified driver can communicate with the data security gateway by running the supported communication protocol, and then send the connection information to the data security gateway, which will then establish a communication connection with the target database based on the connection information.

[0053] For example, in one embodiment shown, the target application can be a Java application, and the unified driver can be a JDBC driver.

[0054] In this scenario, the aforementioned communication protocol can be the JNI protocol, and the aforementioned unified interface can be the JDBC interface. The target application can call the JDBC interface provided by the JDBC driver to submit connection information for the target database to be accessed from multiple databases to the JDBC driver; after obtaining the connection information submitted by the target application, the JDBC driver can communicate with the data security gateway through the JNI protocol and further send the connection information to the data security gateway.

[0055] It should be noted that the database types corresponding to the above-mentioned databases are not specifically limited in this specification.

[0056] For example, in one embodiment shown, the aforementioned databases can be relational databases, such as MySQL databases.

[0057] The aforementioned connection information may specifically include any form of information used to establish a communication connection with the aforementioned target database, and is not specifically limited in this specification.

[0058] For example, in one illustrated embodiment, the connection information of the target database may include one or more combinations of the following: the database type, database address, database name, user account, user password, etc. In one illustrated embodiment, the connection information may also include any other possible information besides the information described above, which is not specifically limited in this specification.

[0059] After obtaining connection information from the target application sent via a unified driver for a target database among multiple databases, the data security gateway can establish a communication connection with the target database based on this connection information. It should be noted that the specific process by which the data security gateway establishes a communication connection with the target database based on this connection information typically depends on the type of the target application. Different application types may have slightly different processes for establishing a communication connection with the target database, which will not be detailed in this embodiment.

[0060] For example, taking the target application as a Java application and the unified driver as a JDBC driver, in this case, the data security gateway can establish a communication connection with the target database by creating a Datasource class under the Java framework for the target database and running the connection establishment method contained in the Datasource class.

[0061] Step S102: Obtain the operation information for the target database sent by the target application through the unified driver, and send the operation information to the target database for data processing based on the communication connection.

[0062] After the data security gateway establishes a communication connection with the target database, the target application can then interact with the data security gateway through a unified driver, sending operation information for the target database to the data security gateway. The data security gateway then sends the operation information to the target database for data processing through the communication connection.

[0063] In one embodiment shown, the target application can still submit operation information for the target database to the unified driver by calling the unified interface provided by the unified driver. For example, the target application can still construct a call request for the unified interface, carry the above operation information as a call parameter in the call request, and then submit the call request to the unified interface to initiate an interface call.

[0064] After obtaining the operation information submitted by the target application, the unified driver can communicate with the data security gateway by running the supported communication protocol, and then send the operation information to the data security gateway. The data security gateway then sends the operation information to the target database for data processing through the communication connection.

[0065] For example, in one embodiment shown, assuming the target application is still a Java application and the unified driver is a JDBC driver, the communication protocol can be the JNI protocol, and the unified interface can be the JDBC interface. The target application can call the JDBC interface provided by the JDBC driver to submit operation information for the target database to the JDBC driver. After receiving the operation information submitted by the target application, the JDBC driver can communicate with the data security gateway through the JNI protocol and further send the operation information to the data security gateway. After receiving the operation information, the data security gateway can send the operation information to the target database based on the communication connection with the target database.

[0066] It should be noted that the above operation information can be any form of data (such as operation statements) executed by the database, and is not specifically limited in this specification.

[0067] For example, in one embodiment shown, the operation information may include an SQL statement. It should be noted that the SQL statement may be a parameterized SQL statement or a parameterless SQL statement.

[0068] Step S103: Obtain the data processing result corresponding to the operation information returned by the target database based on the communication connection, perform data privacy protection processing on the data processing result, and send the data processing result after data privacy protection processing to the target application through the unified driver.

[0069] In one embodiment shown, after the data security gateway sends operation information to the target database based on the communication connection with the target database, the target database can perform corresponding operations based on the operation information to obtain the corresponding data processing result. Then, the target database can send the data processing result to the data security gateway based on the communication connection.

[0070] In one embodiment shown, after obtaining the data processing result corresponding to the operation information returned by the target database based on the communication connection, the data security gateway can perform data privacy protection processing on the data processing result to obtain the data processing result after data privacy protection processing.

[0071] After completing the data privacy processing, the data security gateway can communicate with the unified driver through the supported communication protocol to further send the data processing results after data privacy protection to the unified driver, which in turn sends the data processing results after data privacy protection to the target application.

[0072] For example, in one embodiment shown, taking the target application as a Java application and the unified driver as a JDBC driver, the communication protocol can be the JNI protocol, and the unified interface can be the JDBC interface. The data security gateway can communicate with the JDBC driver via the JNI protocol to further send the data processing result after data privacy protection processing to the JDBC driver. Then, the JDBC driver can return the data processing result after data privacy protection processing as the return data of the JDBC interface call to the Java application.

[0073] The aforementioned data privacy protection processing (or data security processing) may specifically include processing for security or privacy protection of the data processing results returned by the target database, which is not specifically limited in this specification.

[0074] In one embodiment shown, the data privacy protection process may include one or more combinations of the following: data auditing, data anonymization, data watermarking, etc. In another embodiment shown, the data privacy protection process may also include any other possible processes besides those described above, which are not specifically limited herein.

[0075] Further, please refer to Figure 4 , Figure 4 This is a flowchart illustrating another data processing method using multiple databases, provided in an exemplary embodiment. Figure 4 As shown, the following will take a Java application as the target application and a JDBC driver as the unified driver as an example to further explain the data processing method provided in this specification from the interaction side of the application, data security gateway, and database. Correspondingly, the data security gateway can be used to securely manage data stored in multiple databases it interfaces with. At least some of these databases are heterogeneous databases of different database types, and these databases may include... Figure 4 The target database shown.

[0076] like Figure 4As shown, the method may specifically include a communication connection establishment phase, a data processing phase, and a communication connection closure phase. The method may specifically include the following steps S11-S27.

[0077] In step S11, the Java application calls the JDBC interface provided by the JDBC driver to send connection information for the target database to the JDBC driver. Correspondingly, the JDBC driver receives the connection information for the target database. The target database is one of the databases that the target application needs to access from among multiple databases.

[0078] In one embodiment shown, the connection information of the target database may include one or more combinations of the following: the database type, database address, database name, user account, user password, etc.

[0079] In step S12, the JDBC driver sends connection information for the target database to the data security gateway via the JNI protocol. Correspondingly, the data security gateway receives the connection information for the target database.

[0080] In step S13, the data security gateway determines whether the Java application has access permissions to the target database. If the Java application does have access permissions to the target database, a data source class corresponding to the target database is created. This data source class contains various methods (or functions), such as methods for connecting to the database. In Java, a data source is typically used to connect to the database.

[0081] In step S14, the data security gateway calls the connection establishment method contained in the Datasource class to establish a communication connection between the data security gateway and the target database based on the connection information, and generates a Connection object corresponding to this communication connection. A Connection object can represent a database connection session and is mainly used to establish and manage the connection between the application and the database.

[0082] The Connection object has an object identifier and contains various methods (or functions), such as methods to open and close the communication connection with the target database.

[0083] In one embodiment shown, as described above, a common database interface for establishing connections is defined on the data security gateway and multiple databases, respectively. Establishing a communication connection between the data security gateway and the target database based on the connection information may include: establishing a communication connection between the common database interface defined on the data security gateway and the common database interface defined on the target database.

[0084] In step S15, the data security gateway sends the object identifier of the Connection object to the JDBC driver via the JNI protocol. Correspondingly, the JDBC driver receives the object identifier of the Connection object. In one embodiment shown, the object identifier can be a string.

[0085] Thus far, steps S11-S15 have completed the stage of establishing a communication connection between the data security gateway and the target database.

[0086] In step S16, the Java application calls the JDBC interface provided by the JDBC driver to send operation information for the target database to the JDBC driver. Correspondingly, the JDBC driver receives the operation information for the target database.

[0087] In one embodiment shown, the operation information may include SQL statements.

[0088] In step S17, the JDBC driver sends operation information and object identifiers for the target database to the data security gateway via the JNI protocol. The data security gateway then receives this operation information and object identifiers.

[0089] In step S18, the data security gateway initiates a call to the first method contained in the Connection object based on the object identifier, thereby opening the established communication connection with the target database.

[0090] In step S19, the data security gateway sends operation information to the target database based on the opened communication connection. The target database then receives this operation information.

[0091] In one embodiment shown, the data security gateway can generate at least one execution object corresponding to the operation information. The data security gateway can then send the operation information to the target database via this at least one execution object, based on an open communication connection.

[0092] In one embodiment shown, the at least one execution object may include execution objects of different types. Specifically, the at least one execution object may include a first type of execution object for sending the operation information to the target database for execution. Further, the first type of execution object may include a second method for sending the operation information to the target database for execution.

[0093] In one embodiment shown, the data security gateway may invoke the second method contained in the first type of execution object to send the operation information to the target database based on the opened communication connection.

[0094] For example, the first type of execution object may include a statement object or a prepareStatement object. The statement object can be used to execute simple SQL statements without parameters. The prepareStatement object inherits from the statement object and can be used to execute SQL statements with parameters. In some possible implementations, the prepareStatement object can also be used to execute prepared SQL statements with or without IN parameters. In one illustrated embodiment, the first type of execution object may also include any other possible objects, which are not specifically limited herein.

[0095] In step S20, the target database performs the corresponding operation based on the operation information to obtain the corresponding data processing result. This data processing result can be a series of data that the Java application wants to query.

[0096] In step S21, the target database, based on the opened communication connection, returns the data processing result corresponding to the operation information to the data security gateway. Correspondingly, the data security gateway obtains the data processing result corresponding to the operation information returned by the target database based on the communication connection.

[0097] In one embodiment shown, the at least one execution object may further include a second type of execution object for querying the data processing result corresponding to the operation information from the target database. Further, the second type of execution object includes a third method for querying the data processing result corresponding to the operation information from the target database.

[0098] In one embodiment shown, the data security gateway may invoke the third method contained in the second type of execution object to query the data processing result corresponding to the operation information from the target database.

[0099] For example, the second type of execution object may include a resultSet object, or any other possible object, which is not specifically limited in this specification.

[0100] Step S22: The data security gateway performs data privacy protection processing on the data processing results to obtain the data processing results after data privacy protection processing.

[0101] After obtaining the data processing results returned by the target database, the data security gateway can perform data privacy protection processing on the data processing results to obtain the data processing results after data privacy protection processing.

[0102] In one embodiment shown, the above-described data privacy protection process may include one or more combinations of the following: data auditing, data desensitization, data watermarking, etc., which are not specifically limited in this specification.

[0103] In step S23, the data security gateway sends the data processing result after data privacy protection processing to the JDBC driver via the JNI protocol. Correspondingly, the JDBC driver receives the data processing result after data privacy protection processing.

[0104] In step S24, the JDBC driver returns the data processing result after data privacy protection as the return data of the JDBC interface call to the Java application. Correspondingly, the Java application receives this data processing result after data privacy protection.

[0105] Thus, steps S16-S24 complete the data processing phase for the target database, enabling access to any database of various types through a unified interface. User applications rely on this JDBC driver (or JDBC driver package). Through the JDBC interface provided by the JDBC driver, they can access various types of databases connected to the data security gateway, which is more suitable for practical applications, has less impact on applications, and is imperceptible to users.

[0106] In step S25, the Java application calls the JDBC interface provided by the JDBC driver to send a closure message for the communication connection to the target database to the JDBC driver. Correspondingly, the JDBC driver receives the closure message for the communication connection to the target database.

[0107] In step S26, the JDBC driver sends a closure message and object identifier for the communication connection with the target database to the data security gateway via the JNI protocol. The data security gateway then receives the closure message and object identifier.

[0108] Step S27: Based on the object identifier, the data security gateway initiates a call to the fourth method contained in the Connection object, closes the communication connection established with the target database, and releases the Connection object after the communication connection is closed.

[0109] At this point, steps S25-S27 complete the communication connection closure phase between the data security gateway and the target database, officially ending the Java application's access to the target database.

[0110] In summary, the solution provided in this specification establishes a unified driver (e.g., a JDBC driver) between the application and the data security gateway, enabling the application to access various databases connected to the data security gateway by calling the unified interface (e.g., the JDBC interface) provided by the unified driver.

[0111] In addition, this specification defines a common database interface (e.g., a C language interface) on the data security gateway and multiple databases. A communication connection can be established between a common database interface defined on the data security gateway and the common database interfaces defined on each database, so that the corresponding database can be accessed based on the communication connection, thus unifying the access interface for each database.

[0112] Using the solution provided in this manual, a data security gateway can be used to provide efficient and unified data security protection for various types of heterogeneous databases, reducing the cost of data security protection in multi-database scenarios.

[0113] Corresponding to the above method and process implementation, embodiments of this specification also provide a multi-database data processing device applied to a data security gateway. The data security gateway is used for security management of data stored in multiple databases it interfaces with. At least some of the multiple databases are heterogeneous databases of different database types. Please refer to [link to relevant documentation]. Figure 5 , Figure 5 This is a schematic diagram of the structure of a data processing apparatus for multiple databases provided in an exemplary embodiment. For example... Figure 5 As shown, the device 30 includes:

[0114] The first acquisition module 301 is used to acquire connection information of the target database to be accessed in the multiple databases sent by the target application through the unified driver corresponding to the multiple databases;

[0115] Communication establishment module 302 is used to establish a communication connection with the target database based on the connection information;

[0116] The second acquisition module 303 is used to acquire operation information of the target database sent by the target application through the unified driver.

[0117] The first sending module 304 is used to send the operation information to the target database for data processing based on the communication connection;

[0118] The third acquisition module 305 is used to acquire the data processing result corresponding to the operation information returned by the target database based on the communication connection;

[0119] Processing module 306 is used to perform data privacy protection processing on the data processing results;

[0120] The second sending module 307 is used to send the data processing result after data privacy protection processing to the target application through the unified driver.

[0121] In yet another embodiment shown, the target application is a Java application, and the unified driver is a JDBC driver.

[0122] In yet another embodiment shown, the data security gateway communicates with the JDBC driver via the JNI protocol;

[0123] The first acquisition module 301 is specifically used for:

[0124] Obtain the connection information of the target application for the target database to be accessed among the multiple databases, sent by the JDBC driver through the JNI protocol; wherein, the connection information is submitted to the JDBC driver by the target application by calling the JDBC interface provided by the JDBC driver;

[0125] The second acquisition module 303 is specifically used for:

[0126] The operation information of the target application for the target database to be accessed among the multiple databases is obtained by the target application through the JNI protocol sent by the JDBC driver; wherein the operation information is submitted to the JDBC driver by the target application by calling the JDBC interface provided by the JDBC driver;

[0127] The second transmitting module 307 is specifically used for:

[0128] The data processing result, after data privacy protection processing, is sent to the unified driver via the JNI protocol, so that the unified driver can further return the data processing result as the call return data of the JDBC interface to the target application.

[0129] In yet another illustrated embodiment, the communication establishment module 302 is specifically used for:

[0130] Determine whether the target application has access permissions to the target database;

[0131] If so, a communication connection is established with the target database based on the connection information.

[0132] In yet another embodiment shown, the connection information includes one or more combinations of the following: the database type, database address, database name, user account, and user password of the target database.

[0133] In yet another illustrated embodiment, the communication establishment module 302 is specifically used for:

[0134] Create a Datasource class corresponding to the target database;

[0135] The connection establishment method contained in the Datasource class is invoked to establish a communication connection between the data security gateway and the target database based on the connection information.

[0136] In yet another illustrated embodiment, the communication establishment module 302 is specifically used for:

[0137] The connection establishment method contained in the Datasource class is invoked to establish a communication connection between the data security gateway and the target database based on the connection information, and a Connection object corresponding to the communication connection is generated. The object identifier of the Connection object is sent to the unified driver, so that the unified driver can initiate a call to the connection management method contained in the Connection object based on the object identifier to manage the communication connection.

[0138] In another illustrated embodiment, a common database interface for establishing connections is defined on the data security gateway and the plurality of databases, respectively; the communication establishment module 302 is specifically used for:

[0139] Establish a communication connection between the general database interface defined on the data security gateway and the general database interface defined on the target database.

[0140] In yet another embodiment shown, the general database interface includes an interface based on a general programming language.

[0141] In yet another embodiment shown, the interface based on a general programming language is a C language interface.

[0142] In yet another illustrated embodiment, the connection management method includes a first method for opening the communication connection;

[0143] The second acquisition module 303 is specifically used for:

[0144] Obtain the operation information and object identifier of the target database to be accessed in the plurality of databases sent by the JDBC driver through the JNI protocol;

[0145] The first sending module 304 is specifically used for:

[0146] Based on the object identifier, a call is initiated to the first method contained in the Connection object to open the established communication connection with the target database, and the operation information is sent to the target database based on the opened communication connection.

[0147] In yet another illustrated embodiment, the first transmitting module 304 is specifically used for:

[0148] Generate at least one execution object corresponding to the operation information; wherein, the at least one execution object includes a first type of execution object for sending the operation information to the target database for execution; the first type of execution object includes a second method for sending the operation information to the target database for execution;

[0149] The second method contained in the first type of execution object is invoked to send the operation information to the target database based on the opened communication connection.

[0150] In yet another embodiment, the at least one execution object further includes a second type of execution object for querying the data processing result corresponding to the operation information from the target database; the second type of execution object includes a third method for querying the data processing result corresponding to the operation information from the target database.

[0151] The third acquisition module 305 is specifically used for:

[0152] The third method contained in the second type of execution object is invoked to query the data processing result corresponding to the operation information from the target database.

[0153] In yet another illustrated embodiment, the operation information includes SQL statements; the first type of execution object includes a statement object or a prepareStatement object; the first type of execution object includes a resultSet object.

[0154] In yet another illustrated embodiment, the connection management method includes a fourth method for closing the communication connection; the apparatus further includes:

[0155] The fourth acquisition module 308 is used to acquire the closing information and object identifier of the communication connection between the target application and the target database sent by the JDBC driver through the JNI protocol; wherein the closing information is submitted to the JDBC driver by the target application by calling the JDBC interface provided by the JDBC driver;

[0156] The communication closure module 309 is used to initiate a call to the fourth method contained in the Connection object based on the object identifier, close the communication connection established with the target database, and release the Connection object after the communication connection is closed.

[0157] In yet another embodiment shown, the data privacy protection process includes one or more combinations of the following: data auditing, data desensitization, and data watermarking.

[0158] In yet another embodiment shown, the database is a relational database.

[0159] For details on the implementation process of the functions and roles of each unit in the aforementioned device 30, please refer to the above. Figures 1-4 The description of the corresponding embodiments will not be repeated here. It should be understood that the above-described device 30 can be implemented by software, hardware, or a combination of software and hardware. Taking software implementation as an example, as a logical device, it is formed by the CPU (Central Processing Unit) of the device loading the corresponding computer program instructions into memory for execution. From a hardware perspective, in addition to the CPU and memory, the device typically includes other hardware such as chips for wireless signal transmission and reception, and / or other hardware such as boards for implementing network communication functions.

[0160] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the units or modules can be selected to achieve the purpose of the solution described in this specification, depending on actual needs. Those skilled in the art can understand and implement this without any inventive effort.

[0161] The devices, units, and modules described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0162] Corresponding to the above method embodiments, embodiments of this specification also provide an electronic device. Please refer to... Figure 6 , Figure 6 This is a schematic diagram of the structure of an electronic device provided in an exemplary embodiment. For example... Figure 6 As shown, the electronic device 1000 can operate a data security gateway, which is used to perform security management on data stored in multiple databases connected to it; wherein, at least some of the multiple databases are heterogeneous databases of different database types. Figure 6 As shown, the electronic device 1000 includes a processor 1001 and a memory 1002, and may further include an input device 1004 (e.g., a keyboard) and an output device 1005 (e.g., a display). The processor 1001, memory 1002, input device 1004, and output device 1005 can be connected via a bus or other means. Figure 6As shown, the memory 1002 includes a computer-readable storage medium 1003 storing a computer program executable by the processor 1001. The processor 1001 may be a general-purpose central processing unit, a microprocessor, or an integrated circuit for controlling the execution of the above method embodiments. When running the stored computer program, the processor 1001 can execute various steps of the multi-database data processing method in the embodiments of this specification, including: obtaining connection information for a target database to be accessed among the multiple databases sent by a target application through a unified driver corresponding to the multiple databases, and establishing a communication connection with the target database based on the connection information; obtaining operation information for the target database sent by the target application through the unified driver, and sending the operation information to the target database for data processing based on the communication connection; obtaining a data processing result corresponding to the operation information returned by the target database based on the communication connection, performing data privacy protection processing on the data processing result, and sending the data processing result after data privacy protection processing to the target application through the unified driver, etc.

[0163] For a detailed description of each step in the above multi-database data processing method, please refer to the previous content, which will not be repeated here.

[0164] Corresponding to the above-described method embodiments, embodiments of this specification also provide a computer-readable storage medium storing computer programs. When executed by a processor, these computer programs perform the various steps of the multi-database data processing method described in this specification. Please refer to the above for details. Figures 1-4 The description of the corresponding embodiments will not be repeated here.

[0165] The above description is merely a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of protection of this specification.

[0166] In a typical configuration, a terminal device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0167] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0168] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data.

[0169] Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transient media, such as modulated data signals and carrier waves.

[0170] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0171] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, the embodiments of this specification can take the form of computer program products implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

Claims

1. A multi-database data processing method, applied to a data security gateway, wherein the data security gateway is used to perform security management on data stored in multiple databases connected to it; wherein, At least some of the databases in the plurality of databases are heterogeneous databases of different database types; the method includes: The system obtains connection information for a target database among the multiple databases sent by a Java application through a JDBC driver corresponding to the multiple databases, and establishes a communication connection with the target database based on the connection information; wherein, the data security gateway communicates with the JDBC driver via the JNI protocol; The Java application obtains operation information for the target database sent by the JDBC driver, and sends the operation information to the target database for data processing based on the communication connection. The system obtains the data processing result corresponding to the operation information returned by the target database based on the communication connection, performs data privacy protection processing on the data processing result, and sends the data processing result after data privacy protection processing to the Java application through the JDBC driver.

2. The method according to claim 1, wherein obtaining the connection information of the target database to be accessed in the plurality of databases sent by the Java application through the JDBC driver includes: Obtain the connection information of the Java application for the target database to be accessed among the multiple databases, sent by the JDBC driver through the JNI protocol; wherein, the connection information is submitted to the JDBC driver by the Java application by calling the JDBC interface provided by the JDBC driver; The step of obtaining the operation information for the target database sent by the Java application through the JDBC driver includes: The operation information of the Java application targeting the target database among the multiple databases is obtained by the JDBC driver through the JNI protocol; wherein the operation information is submitted to the JDBC driver by the Java application by calling the JDBC interface provided by the JDBC driver; The step of sending the data processing result, after data privacy protection processing, to the Java application through the JDBC driver includes: The data processing result, after data privacy protection processing, is sent to the JDBC driver via the JNI protocol, so that the JDBC driver can further return the data processing result as the call return data of the JDBC interface to the Java application.

3. The method according to claim 1, wherein establishing a communication connection with the target database based on the connection information includes: Determine whether the Java application has access rights to the target database; If so, a communication connection is established with the target database based on the connection information.

4. The method according to claim 1, wherein the connection information includes one or more combinations of the following: the database type, database address, database name, user account, and user password of the target database.

5. The method according to claim 2, wherein establishing a communication connection with the target database based on the connection information comprises: Create a Datasource class corresponding to the target database; The connection establishment method contained in the Datasource class is invoked to establish a communication connection between the data security gateway and the target database based on the connection information.

6. The method according to claim 5, wherein calling the connection establishment method contained in the Datasource class to establish a communication connection between the data security gateway and the target database based on the connection information includes: The connection establishment method contained in the Datasource class is invoked to establish a communication connection between the data security gateway and the target database based on the connection information, and a Connection object corresponding to the communication connection is generated. The object identifier of the Connection object is sent to the JDBC driver so that the JDBC driver can initiate a call to the connection management method contained in the Connection object based on the object identifier to manage the communication connection.

7. The method according to claim 6, wherein a general database interface for establishing a connection is defined on the data security gateway and the plurality of databases respectively; Establishing a communication connection between the data security gateway and the target database includes: Establish a communication connection between the general database interface defined on the data security gateway and the general database interface defined on the target database.

8. The method according to claim 7, wherein the general database interface includes an interface based on a general programming language.

9. The method according to claim 8, wherein the interface based on a general programming language is a C language interface.

10. The method according to claim 6, wherein the connection management method includes a first method for opening the communication connection; The step of obtaining the operation information of the Java application targeting the target database among the multiple databases, sent by the JDBC driver through the JNI protocol, includes: Obtain the operation information and object identifier of the target database to be accessed in the plurality of databases sent by the Java application through the JNI protocol by the JDBC driver; The step of sending the operation information to the target database for data processing based on the communication connection includes: Based on the object identifier, a call is initiated to the first method contained in the Connection object to open the established communication connection with the target database, and the operation information is sent to the target database based on the opened communication connection.

11. The method according to claim 10, wherein sending the operation information to the target database based on the opened communication connection comprises: Generate at least one execution object corresponding to the operation information; wherein, the at least one execution object includes a first type of execution object for sending the operation information to the target database for execution; the first type of execution object includes a second method for sending the operation information to the target database for execution; The second method contained in the first type of execution object is invoked to send the operation information to the target database based on the opened communication connection.

12. The method according to claim 11, wherein the at least one execution object further comprises a second type of execution object for querying the data processing result corresponding to the operation information from the target database; the second type of execution object includes a third method for querying the data processing result corresponding to the operation information from the target database; The step of obtaining the data processing result corresponding to the operation information returned by the target database based on the communication connection includes: The third method contained in the second type of execution object is invoked to query the data processing result corresponding to the operation information from the target database.

13. The method according to claim 12, wherein the operation information includes SQL statements; the first type of execution object includes a statement object or a prepareStatement object; and the first type of execution object includes a resultSet object.

14. The method according to claim 6, wherein the connection management method includes a fourth method for closing the communication connection; the method further includes: Obtain the closing information and object identifier of the communication connection between the Java application and the target database sent by the JDBC driver through the JNI protocol; wherein the closing information is submitted to the JDBC driver by the Java application by calling the JDBC interface provided by the JDBC driver; Based on the object identifier, a call is made to the fourth method contained in the Connection object to close the communication connection established with the target database, and the Connection object is released after the communication connection is closed.

15. The method according to claim 1, wherein the data privacy protection processing includes one or more combinations of the following: data auditing, data desensitization, and data watermarking.

16. The method according to any one of claims 1-15, wherein the database is a relational database.

17. A multi-database data processing device, applied to a data security gateway, wherein the data security gateway is used to perform security management on data stored in multiple databases connected to it; wherein, At least some of the databases in the plurality of databases are heterogeneous databases of different database types; the device includes: The first acquisition module is used to acquire connection information of the target database to be accessed in the plurality of databases sent by the Java application through the JDBC driver corresponding to the plurality of databases; the data security gateway communicates with the JDBC driver through the JNI protocol; A communication establishment module is used to establish a communication connection with the target database based on the connection information. The second acquisition module is used to acquire operation information for the target database sent by the Java application through the JDBC driver; The first sending module is used to send the operation information to the target database for data processing based on the communication connection; The third acquisition module is used to acquire the data processing result corresponding to the operation information returned by the target database based on the communication connection; The processing module is used to perform data privacy protection processing on the data processing results; The second sending module is used to send the data processing result after data privacy protection processing to the Java application through the JDBC driver.

18. An electronic device comprising: Memory and processor; The memory stores computer programs that can be executed by the processor; When the processor runs the computer program, it performs the method as described in any one of claims 1 to 16.

19. A computer-readable storage medium having a computer program stored thereon, the computer program, when executed by a processor, implementing the method as claimed in any one of claims 1 to 16.

Images