Connection system, method, electronic device and storage medium for data service objects

Abstract

Embodiments of the present application provide a data service object connection system, method, electronic device and storage medium, belonging to the technical field of data service. The data service object connection system comprises a data request terminal and a connection control terminal; the data request terminal is configured to generate a terminal identity credential in response to a data request instruction, and send the terminal identity credential to the connection control terminal; the connection control terminal is configured to match connection configuration information according to the terminal identity credential, and send the matched connection configuration information to the data request terminal, wherein the connection configuration information comprises a target address, a target object account and a target object password; and the data request terminal is configured to send the target object account and the target object password to the corresponding data service object according to the target address, so that the data service object establishes a connection with the data request terminal. The present application can reduce the risk of data service object password leakage of users, thereby improving the security of the connection between the client and the data server.

Description

Technical Field

[0001] This invention relates to the field of data service technology, and in particular to a connection system, method, electronic device, and storage medium for data service objects. Background Technology

[0002] With the development of cloud computing technology, more and more enterprise data is being stored on third-party servers. User data security is closely related to the process of connecting to the server's operating system or database. Data security covers the entire lifecycle of data, including data generation, collection, storage, transmission, processing, and destruction. Ensuring secure access to servers is crucial for data storage security.

[0003] Taking accessing a database on a server as an example, secure database access requires a valid account and password. The account is a plaintext string assigned by the database administrator to users as their identification ID, and the password is also a plaintext string. If the account is used by an individual, such as an IT technician who needs to directly access the database for backend operations, the account and password are the responsibility of the person responsible for the identification ID. Password changes and memorization are usually done by the individual, making management relatively simple but also prone to leakage. However, in scenarios where applications access the database as clients, especially in environments with dozens or hundreds of different database management systems, the secure management of database accounts and passwords becomes much more complex. This mainly involves each application storing its own database account and password, the application's strict requirements on password strength and expiration dates, and the fact that each application stores its own database account and password in plaintext, which also poses a security risk. Even if a designated person regularly changes the password and encrypts it into ciphertext using tools, human intervention still increases the security risk, including but not limited to: password leakage, forgotten passwords, operational errors, and omissions.

[0004] The current password management method, which relies on users remembering passwords or applications storing passwords, involves each client obtaining the user's entered username and password or retrieving them from the application's local storage before sending an access request containing the username and password to the server. This connection method results in low server connection security due to the high risk of password leakage and cannot effectively protect server data security. Summary of the Invention

[0005] The main objective of this invention is to provide a connection system, method, electronic device, and storage medium for data service objects, aiming to reduce the risk of data service object password leakage and improve the security of the connection between the client and the data server.

[0006] A first aspect of this invention provides a connection system for a data service object, the connection system for the data service object including a data request terminal and a connection control terminal;

[0007] The data request terminal is used to generate a terminal identity credential in response to a data request instruction, and send the terminal identity credential to the connection control terminal;

[0008] The connection control terminal is used to match connection configuration information according to the terminal identity credentials and send the matched connection configuration information to the data request terminal, wherein the connection configuration information includes the target address, the target object account and the target object password;

[0009] The data request terminal is also used to send the target object's account and password to the corresponding data service object according to the target address, so that the data service object can establish a connection with the data request terminal.

[0010] In some embodiments, the data request terminal includes a dynamic credential generation module;

[0011] The dynamic credential generation module is used to invoke the identity credential collection tool from the connected control terminal in response to a data request instruction to collect the terminal's identity credential, wherein the identity credential collection tool is used for:

[0012] Collect the first identifier of the application that issued the data request command and the second identifier of the data request terminal;

[0013] The first identifier and the second identifier are integrated to obtain a terminal identity credential in plaintext form;

[0014] The terminal identity credential is encrypted using the first encryption algorithm to obtain the ciphertext form of the terminal identity credential.

[0015] In some embodiments, the connection control terminal includes a registration module, which is used for:

[0016] Receive registration requests from data request terminals;

[0017] In response to a registration request, an identity credential collection tool is sent to the requesting terminal so that the data requesting terminal can run the identity credential collection tool to obtain terminal identity credentials.

[0018] The terminal identity credential is used to verify the permissions of the data service object, and the verified terminal identity credential is associated with the connection configuration information used to connect to the data service object and stored.

[0019] In some embodiments, the connection control terminal further includes a connection configuration module, the connection configuration module being used for:

[0020] Obtain connection technology configuration information from the management terminal, wherein the connection technology configuration information includes the target object identifier and connection technology configuration;

[0021] The corresponding data service object is determined based on the target object identifier;

[0022] The connection technology configuration is written into the connection configuration information associated with the data service object.

[0023] In some embodiments, the connection configuration information further includes connection technology configuration, and the data request terminal further includes a connection establishment module, which is used for:

[0024] Determine whether the corresponding connection technology tool exists locally based on the connection technology configuration;

[0025] If a corresponding connection technology tool exists locally, the connection technology tool is invoked locally to establish a connection with the data service object;

[0026] If the corresponding connection technology tool does not exist locally, the connection technology tool is invoked from the connection control terminal to establish a connection with the data service object.

[0027] In some embodiments, the connection control terminal includes a password update module, which is used for:

[0028] The password update tool is invoked based on a timer triggered by the connection configuration information to update the password of the target object in the connection configuration information.

[0029] A second aspect of this invention provides a method for connecting a data service object, applied in a data request terminal of a data service object connection system as described in the first aspect. The method for connecting the data service object includes the following steps:

[0030] Generate terminal identity credentials in response to data request commands;

[0031] The terminal identity credentials are sent to the connection control terminal to obtain connection configuration information, wherein the connection configuration information includes the target address, the target object account, and the target object password;

[0032] Based on the target address, the target object's account and password are sent to the corresponding data service object to establish a connection with the data service object.

[0033] A third aspect of this invention provides a method for connecting a data service object, applied in a connection control terminal of a data service object connection system as described in the first aspect. The method for connecting the data service object includes the following steps:

[0034] Obtain the terminal identity credentials from the data requesting terminal;

[0035] The connection configuration information is matched based on the terminal identity credentials, wherein the connection configuration information includes the target address, the target object account, and the target object password;

[0036] The matching connection configuration information is sent to the data request terminal so that the data request terminal can establish a connection with the corresponding data service object according to the connection configuration information.

[0037] A fourth aspect of the present invention provides an electronic device, the electronic device including a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for implementing connection communication between the processor and the memory, wherein the program, when executed by the processor, implements the connection method of the data service object described in the second or third aspect above.

[0038] A fifth aspect of the present invention provides a storage medium, which is a computer-readable storage medium for computer-readable storage, wherein the storage medium stores one or more programs that can be executed by one or more processors to implement the connection method of the data service object described in the second or third aspect above.

[0039] The technical solution described above has at least one of the following advantages or beneficial effects: In the data service object connection system of the present invention, the connection configuration information related to the connected data service object is stored in the connection control terminal. When a data request terminal needs to access a data service object, the data request terminal collects its own terminal identity credentials and uses these credentials to obtain the connection configuration information from the connection control terminal before establishing a connection with the corresponding data service object. Compared to the method where the data request terminal stores the account password of the data service object and directly connects to the data service object, the present invention uses the connection control terminal to uniformly manage all account passwords. All data request terminals in the system do not store account passwords locally, which reduces the risk of password leakage for data service objects. Dynamically collecting terminal identity credentials when connecting to a data service object and requesting relevant connection configuration information from the connection control terminal using these credentials improves the security of the connection between the client and the data server. Attached Figure Description

[0040] Figure 1This is a schematic diagram illustrating the process of establishing a connection between a data service object-based connection system and a data service object, as provided in an embodiment of the present invention.

[0041] Figure 2 This is a schematic diagram of a database connection process based on the RADIUS protocol provided in an embodiment of the present invention;

[0042] Figure 3 This is a schematic diagram of a database connection process provided in another embodiment of the present invention;

[0043] Figure 4 This is a schematic diagram of the data request terminal registration process provided in an embodiment of the present invention;

[0044] Figure 5 This is a schematic diagram of the database connection architecture provided in an embodiment of the present invention;

[0045] Figure 6 This is a flowchart of a connection method for a data service object applied to a data request terminal, provided in an embodiment of the present invention.

[0046] Figure 7 This is a flowchart of a connection method for a data service object applied to a connection control terminal, provided in an embodiment of the present invention.

[0047] Figure 8 This is a flowchart of a connection method for a data service object applied to a connection control terminal, provided by another embodiment of the present invention;

[0048] Figure 9 This is a flowchart of a connection method for a data service object applied to a connection control terminal, provided by another embodiment of the present invention;

[0049] Figure 10 This is a schematic diagram of the hardware structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0051] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0052] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein is for the purpose of describing embodiments of the invention only and is not intended to limit the invention.

[0053] First, let's clarify some of the terms used in this invention:

[0054] A Database Management System (DBMS) is a large software application used to manipulate and manage databases. It's used for creating, using, and maintaining databases. It provides unified management and control of the database to ensure its security and integrity. Users access data in the database through the DBMS, and database administrators also use it for database maintenance. It offers various functions, allowing multiple applications and users to create, modify, and query the database simultaneously or at different times using different methods. It enables users to easily define and manipulate data, maintain data security and integrity, and perform concurrent control and database recovery under multi-user conditions.

[0055] RADIUS is the most widely used AAA protocol. It's a client / server (C / S) architecture protocol, and its client was originally a NAS (Network Access Server). Any computer running RADIUS client software can become a RADIUS client. The NAS, acting as a RADIUS client, provides access and interaction services to remote users. The RADIUS server stores user identity information, authorization information, and access records, and performs authentication, authorization, and billing services for users. Users submit their username and password to the RADIUS client. The RADIUS client does not perform authentication itself but submits the authentication to the RADIUS server. After successful authentication by the RADIUS server, the RADIUS client handles user access.

[0056] Data service objects refer to remote systems that can provide data service functions to individual users or applications. For example, a database management system or operating system hosted on a server requires users to provide a corresponding database username and password or a corresponding operating system username and password to access the database or server operating system. Taking database access as an example, the user terminal sends the username and password to the corresponding database management system for authentication, thereby establishing a connection.

[0057] Reference Figure 2In establishing database connections, the RADIUS protocol's principles of "separation of management control from business / access" and "centralized management control, decentralized business / access" can be leveraged. The authentication functions originally handled by the DBMS can be offloaded, while other functions such as access control and database connection are retained. This involves configuring the DBMS as a RADIUS client and the control center as a RADIUS server for authentication. The RADIUS client is responsible for transmitting the user / application's account and password information to the designated RADIUS server. The RADIUS server receives the user's authentication request, authenticates the user, and then returns the user's configuration information to the RADIUS client. The RADIUS client then establishes a connection with the user based on this configuration information. While this method improves connection security, the risk of password leakage remains high, and it requires modification of the DBMS, involving a wide range of aspects and incurring high costs.

[0058] Based on the RADIUS protocol, this invention provides a connection system, method, electronic device, and storage medium for data service objects, aiming to reduce the risk of password leakage of data service objects, thereby improving the security of the connection between the client and the data server, without requiring any modification to the DBMS.

[0059] This invention provides a connection system for a data service object, which includes a data request terminal and a connection control terminal.

[0060] The data request terminal is used to generate terminal identity credentials in response to a data request command and send the terminal identity credentials to the connection control terminal.

[0061] The connection control terminal is used to match connection configuration information based on the terminal identity credentials and send the matched connection configuration information to the data request terminal. The connection configuration information includes the target address, the target object account, and the target object password.

[0062] The data request terminal is used to send the target object's account and password to the corresponding data service object based on the target address, so that the data service object can establish a connection with the data request terminal.

[0063] Reference Figure 1 The process of establishing a connection between a connection system based on data service objects and data service objects is as follows:

[0064] S11. The data requesting terminal sends its own terminal identity credentials to the connection control terminal.

[0065] S12. The connection control terminal returns the corresponding connection configuration information to the data request terminal based on the terminal's identity credentials;

[0066] S13. The data request terminal performs authentication interaction with the data service object based on the connection configuration information to realize the connection between the data request terminal and the data service object.

[0067] In some embodiments, the data request terminal is a device used by a user or application, such as a smartphone, tablet, laptop, or desktop computer. It is primarily used to obtain services provided by a data service object, which is a database. The data request terminal acts as the database client. The data request terminal does not locally store account and password information for connecting to the data service object. The connection control terminal is mainly used to manage the account and password information of multiple data request terminals connecting to the data service object within the enterprise. It can be a computer or server. Both the data request terminal and the connection control terminal have related software installed to enable them to cooperate in completing tasks such as... Figure 1 The interactive process is shown.

[0068] In some embodiments, the terminal identity credential is a unique identifier for the object issuing the data request instruction. It may be a user identifier, an application identifier, or a device identifier, or a combination of a user identifier and a device identifier, or a combination of an application identifier and a device identifier.

[0069] In some embodiments, if the data service object is a database, the target address in the connection configuration information can be the IP address and port of the target DBMS; if the data service object is a host operating system, the target address in the connection configuration information can be the IP address and port of the target host operating system.

[0070] In the data service object connection system of this invention embodiment, an "account and password managed mode" is adopted to maintain the independence of the DBMS without requiring any modifications or cooperation. The authentication and connection methods between the database client and the DBMS remain unchanged; the difference is that the database client no longer needs to store the database account and password, nor does it require human intervention or contact, thus reducing the aforementioned security risks. In enterprise management, refer to... Figure 3A connection control terminal is established as a "hosting center" for database accounts and passwords. Except for the database administrator (DBA) account (root, sys, etc.), all other user-level accounts and their passwords for each DBMS are centrally stored and managed in this "hosting center." Database clients (i.e., users or applications) no longer directly authenticate and establish connections with the target DBMS using accounts and passwords maintained locally on the database client. Instead, they request the necessary connection configuration information from the "hosting center" using their terminal credentials, including the user's database account, password, and database connection address. This information can be transmitted in encrypted form. After receiving the encrypted information, the database client directly decrypts it into plaintext connection configuration information in memory. This connection configuration information is only stored in memory for authentication and connection between the database client and the database server, and is not persistently stored on the database client's local disk.

[0071] According to some specific embodiments of the present invention, the data request terminal includes a dynamic credential generation module;

[0072] The dynamic credential generation module is used to respond to data request commands by invoking the identity credential acquisition tool from the connected control terminal to acquire the terminal's identity credentials. The identity credential acquisition tool is used for:

[0073] Collect the first identifier of the application that issued the data request command and the second identifier of the data requesting terminal;

[0074] The first identifier and the second identifier are integrated to obtain the terminal identity credential in plaintext form;

[0075] The terminal identity credential is encrypted using the first encryption algorithm to obtain the ciphertext form of the terminal identity credential.

[0076] In some embodiments, an application installed on the data request terminal issues a data request command. The memory of the data request terminal then invokes an identity credential acquisition tool from the connection control terminal according to the data request command. This invocation can be online or offline. In an online invocation, the memory of the data request terminal sends an invocation request to the connection control terminal to obtain the identity credential acquisition tool based on the data request command. In an offline invocation, the connection control terminal sends the identity credential acquisition tool to the data request terminal in advance. The data request terminal stores the identity credential acquisition tool on its local disk, and when the memory of the request terminal receives the data request command, it invokes the identity credential acquisition tool from the local disk.

[0077] In some embodiments, the identity credential acquisition tool is a computer program plugin, such as a JAR package, used to generate terminal identity credentials. Taking an application issuing a data request command as an example, the memory of the data requesting terminal calls and runs the identity credential acquisition tool. The identity credential acquisition tool collects the application identifier that issued the data request command on the data requesting terminal as a first identifier, and collects the application's environment dependency information as a second identifier to ensure that the identity cannot be impersonated. The application identifier and environment dependency information are integrated to obtain a plaintext terminal identity credential, which is then encrypted using a first encryption algorithm to obtain a ciphertext terminal identity credential. The first encryption algorithm performs symmetric encryption on the plaintext terminal identity credential, supplemented by a hash transformation, to finally obtain the ciphertext terminal identity credential. The hash transformation ensures the integrity and immutability of the information. The identity credential acquisition tool returns the collected terminal identity credential to the memory of the data requesting terminal, and the memory of the data requesting terminal sends the terminal identity credential to the connection control terminal. The connection control terminal uses a decryption algorithm corresponding to the first encryption algorithm to decrypt the terminal identity credential, obtaining a plaintext terminal identity credential for subsequent processing.

[0078] In some embodiments, the second identifier may also be a device identifier, which can uniquely identify the hardware device on which the application runs.

[0079] According to some specific embodiments of the present invention, the connection control terminal includes a registration module, which is used for:

[0080] Receive registration requests from data request terminals;

[0081] In response to a registration request, an identity credential collection tool is sent to the requesting terminal so that the data requesting terminal can run the identity credential collection tool to obtain the terminal's identity credentials;

[0082] The system performs permission verification on the terminal identity credentials for data service objects and associates and stores the verified terminal identity credentials with the connection configuration information used to connect to the data service objects.

[0083] In some embodiments, the process of registering a data request terminal is as follows: Figure 4 As shown:

[0084] S21. The data request terminal sends a registration request to the connection control terminal. Specifically, the application running on the data request terminal calls a method in the JAR package provided by the connection control terminal to initiate the registration request. The parameters required for the method call include, but are not limited to, the application ID that the application administrator has requested from the connection control terminal administrator in advance, and the database account and other identity information that the database administrator has requested from the DBMS administrator.

[0085] S22. The connection control terminal returns the identity credential collection tool to the data request terminal according to the registration request.

[0086] S23. The data requesting terminal downloads and invokes the identity credential collection tool to collect and generate terminal identity credentials. Specifically, the data requesting terminal runs the identity credential collection tool to collect the application's environment dependencies and generates terminal identity credentials based on the environment dependencies and the application identifier that initiated the registration request. The identity credential collection tool algorithm used during the data requesting terminal registration process is the same as the algorithm used when the data requesting terminal connects to the data service object. Environment dependencies characterize the hardware and underlying software (such as the operating system) on which the application currently runs, and can be the device number on which the application resides, etc.

[0087] S24. The data requesting terminal uploads its terminal identity credentials to the connection control terminal.

[0088] S25. The connection control terminal displays the terminal identity credentials to the hosting administrator for identity verification. Specifically, if the verification is successful, the terminal identity credentials are associated with and stored with the database connection configuration information to complete the filing of the application and its environment dependencies for subsequent database connection authentication.

[0089] Furthermore, after the registration is completed, when the application needs to connect to the database, the connection control terminal provides the application running in the data request with an identity credential collection tool to dynamically generate terminal identity credentials and submit an identity authentication request to the connection control terminal. The connection control terminal matches and verifies the terminal identity credentials registered in the registration. If the verification passes, it provides the connection configuration information required to connect to the target DBMS. If the verification fails, it provides an identity error message.

[0090] In this embodiment, since the generation, uploading, review, filing, and authentication of terminal identity credentials are all dynamic, and the terminal identity credentials include not only the application identifier but also the hardware device environment and basic software environment on which the application runs, the risk of database accounts and passwords being stolen can be reduced.

[0091] According to some embodiments of the present invention, the connection control terminal further includes a connection configuration module, which is used for:

[0092] Obtain connection technology configuration information from the management terminal, wherein the connection technology configuration information includes the target object identifier and connection technology configuration;

[0093] The corresponding data service object is determined based on the target object identifier;

[0094] Write the connectivity technology configuration into the connectivity configuration information associated with the data service object.

[0095] In some embodiments, the management terminal is a terminal that provides various configuration, auditing and other operation support for management roles such as account custodians, hosting administrators, and database administrators. The management terminal is connected to the connection control terminal, and the management roles can use the management terminal to manage and configure various connection configuration information in the connection control terminal.

[0096] In some embodiments, the data service object identifier, terminal identity credentials, and connection configuration information are stored together in the connection control terminal. The connection configuration information includes the target address of the data service object, the target object account and password used by the user or application to log in to the target data service object, and the connection technology configuration used to connect to the target data service object. The connection technology configuration may include the connection technology and the connection method. For example, the connection technology may be Java database connection technology, and the connection method may be SERVICE_NAME or SID. SERVICE_NAME format: jdbc:oracle:thin:@ / / <host> : <port> / <SERVICE_NAME> SID connection method: jdbc:oracle:thin:@ <host> : <port> : <sid>.

[0097] In some embodiments, when the connection technology used by a data service object changes, the management terminal sends connection technology configuration information, including the target object identifier and connection technology configuration, to the connection control terminal. The connection control terminal searches for the associated connection configuration information based on the target object identifier, writes the received new connection technology configuration into the searched connection configuration information, and deletes the old connection technology configuration. Similarly, when the IP address, port, etc., of a data service object changes, the management terminal can also modify the relevant connection configuration information in the connection control terminal. Unified maintenance of connection configuration information, which is crucial for connectivity, can improve the connection efficiency of each client. For example, when the DBMS environment changes, the connection configuration of relevant clients can be modified through simple operations on the management terminal, eliminating the need for time-consuming and laborious notifications to all relevant parties and clients to make configuration adjustments. This ensures that changes on the DBMS service side are imperceptible to the clients and reduces the probability of client configuration errors leading to database connection failures.

[0098] According to some specific embodiments of the present invention, the data request terminal further includes a connection establishment module, which is used for:

[0099] Determine if the corresponding connection technology tool exists locally based on the connection technology configuration in the connection configuration information;

[0100] If the corresponding connection technology tool exists locally, the connection technology tool is invoked locally to establish a connection with the data service object;

[0101] If the corresponding connection technology tool does not exist locally, the connection technology tool is invoked from the connection control terminal to establish a connection with the data service object.

[0102] In this embodiment, the connection control terminal encapsulates mainstream database connection pool (DCP) technology into a unified connection technology tool and sends it to the relevant data request terminals, ensuring the standardized use of database connection technology within the enterprise. When a data request terminal establishes a connection with the database, if the corresponding connection technology tool is pre-stored locally, it invokes the tool to establish a connection with the data service object; if the corresponding connection technology tool is not present locally, it invokes it online from the connection control terminal to establish a connection with the data service object.

[0103] According to some specific embodiments of the present invention, the connection control terminal includes a password update module, which is used for:

[0104] The password update tool is invoked based on a timer triggered by the connection configuration information to update the password of the target object in the connection configuration information.

[0105] In some embodiments, each connection configuration information in the connection control terminal is set with a corresponding timer. When the timer of the connection configuration information reaches the set time, the password update tool is called to update the password of the target object in the connection configuration information, so as to realize the automatic modification of the password on a regular basis, reduce the risk of password leakage, and be unaware of the client.

[0106] The following example, using an application accessing a database management system, further illustrates the embodiments of the present invention. Figure 5 In the related database connection architecture 510, applications connect to the database by directly accessing the DBMS with their own database accounts and passwords. This method requires each application to store its own accounts and passwords, which can easily lead to password leaks or errors, affecting the application's connection to the DBMS. Therefore, in the improved database connection architecture 520 of this embodiment, a connection control terminal is set up as a "hosting center" for the database accounts and passwords of each application. The connection control terminal interacts with the DBMS to register database accounts and update passwords. Applications do not store database accounts and passwords locally. When connecting to the DBMS, the application ID and environment dependency information are dynamically collected as identity credentials to dynamically obtain the database account and password in memory. The connection is established with the DBMS based on memory, rather than on the traditionally persistently stored database account and password.

[0107] Specifically, the overall detailed process of an application connecting to a database management system is as follows:

[0108] S31. The application dynamically calls the identity credential collection tool provided by the connection control terminal to generate an encrypted terminal identity credential, and sends the terminal identity credential to the connection control terminal. The terminal identity credential includes the application ID and environment dependency information.

[0109] S32. The connection control terminal uses the decryption algorithm corresponding to the first encryption algorithm in the identity credential acquisition tool to decrypt the terminal identity credential. It performs identity matching and authentication based on the plaintext terminal identity credential. If the match is successful, it uses the second encryption algorithm to encrypt the corresponding connection configuration information and returns it to the application. If the match is unsuccessful, it sends an error message to the person in charge of the application through SMS, IM, email, to-do, or other message notifications for inspection or reapplication.

[0110] S33. When the application memory receives the connection configuration information, it decrypts the connection configuration information using the second decryption algorithm corresponding to the second encryption algorithm. Then, it sends a connection request containing the account and password to the corresponding target DBMS according to the target object address in the connection configuration information, and establishes a connection with the DBMS using the connection technology specified in the connection configuration information.

[0111] This invention also provides a method for connecting data service objects, applied to a data request terminal in the data service object connection system described above, with reference to... Figure 6 The connection method for the data service object in this embodiment of the invention includes, but is not limited to, the following steps:

[0112] Step S101: Generate terminal identity credentials in response to the data request instruction;

[0113] Step S102: Send the terminal identity credentials to the connection control terminal to obtain connection configuration information, wherein the connection configuration information includes the target address, the target object account and the target object password;

[0114] Step S103: Send the target object account and target object password to the corresponding data service object according to the target address to establish a connection with the data service object.

[0115] In some embodiments, step S101, which involves generating terminal identity credentials in response to a data request instruction, includes, but is not limited to, the following steps:

[0116] Step S201: In response to the data request instruction, the identity credential acquisition tool from the connection control terminal is invoked to acquire the terminal's identity credentials, wherein the identity credential acquisition tool is used for:

[0117] Collect the first identifier of the application that issued the data request command and the second identifier of the data requesting terminal;

[0118] The first identifier and the second identifier are integrated to obtain the terminal identity credential in plaintext form;

[0119] The terminal identity credential is encrypted using the first encryption algorithm to obtain the ciphertext form of the terminal identity credential.

[0120] In some embodiments, the connection configuration information further includes connection technology configuration, and the connection method applied to the data request terminal further includes the following steps:

[0121] Step S301: Determine whether the corresponding connection technology tool exists locally based on the connection technology configuration;

[0122] Step S302: If a corresponding connection technology tool exists locally, the connection technology tool is invoked locally to establish a connection with the data service object;

[0123] Step S303: If the corresponding connection technology tool does not exist locally, the connection technology tool is invoked from the connection control terminal to establish a connection with the data service object.

[0124] Another embodiment of the present invention also provides a method for connecting data service objects, applied in the connection control terminal of the data service object connection system of the above embodiments, referring to... Figure 7 The connection method for the data service object in this embodiment of the invention includes, but is not limited to, the following steps:

[0125] Step S401: Obtain the terminal identity credential from the data requesting terminal;

[0126] Step S402: Match connection configuration information based on terminal identity credentials, wherein the connection configuration information includes target address, target object account and target object password;

[0127] Step S403: The matching connection configuration information is sent to the data request terminal so that the data request terminal can establish a connection with the corresponding data service object according to the connection configuration information.

[0128] In some embodiments, refer to Figure 8 The connection method applied to the connection control terminal also includes the following steps:

[0129] Step S501: Receive a registration request from the data request terminal;

[0130] Step S502: In response to the registration request, an identity credential collection tool is sent to the requesting terminal so that the data requesting terminal can run the identity credential collection tool to obtain the terminal identity credential.

[0131] Step S503: Perform permission verification on the terminal identity credential for the data service object, and associate and store the verified terminal identity credential with the connection configuration information used to connect to the data service object.

[0132] In some embodiments, refer to Figure 9 The connection method applied to the connection control terminal also includes the following steps:

[0133] Step S601: Obtain connection technology configuration information from the management terminal, wherein the connection technology configuration information includes the target object identifier and connection technology configuration;

[0134] Step S602: Determine the corresponding data service object based on the target object identifier;

[0135] Step S603: Write the connection technology configuration into the connection configuration information associated with the data service object.

[0136] In some embodiments, the connection method applied to the connection control terminal further includes the following steps:

[0137] Step S701: The password update tool is invoked based on the timer triggered by the connection configuration information to update the password of the target object in the connection configuration information.

[0138] This invention also provides an electronic device, comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for communication between the processor and the memory. When the program is executed by the processor, it implements the connection method for the aforementioned data service object. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0139] Please see Figure 10 , Figure 10 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes:

[0140] The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0141] The memory 902 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is invoked by the processor 901 to execute the connection method of the data service object in the embodiments of this invention.

[0142] The input / output interface 903 is used to implement information input and output;

[0143] The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0144] Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904);

[0145] The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0146] This invention also provides a storage medium, which is a computer-readable storage medium for computer-readable storage. The storage medium stores one or more programs, which can be executed by one or more processors to implement the above-described data service object connection method.

[0147] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0148] The embodiments described in this invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of this invention, and do not constitute a limitation on the technical solutions provided by the embodiments of this invention. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this invention are also applicable to similar technical problems.

[0149] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present invention, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0150] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0151] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0152] The terms "first," "second," "third," "fourth," etc. (if present) in the specification and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0153] It should be understood that in this invention, "at least one (item)" refers to one or more, and "more than" refers to two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0154] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0155] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0156] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0157] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0158] The preferred embodiments of the present invention have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and spirit of the present invention should be within the scope of the claims of the present invention.< / sid> < / port> < / host> < / port> < / host>

Claims

1. A connection system for data service objects, characterized in that, The connection system for the data service object includes a data request terminal and a connection control terminal; The data request terminal is used to generate a terminal identity credential in response to a data request instruction, and send the terminal identity credential to the connection control terminal; The connection control terminal is used to match connection configuration information according to the terminal identity credentials and send the matched connection configuration information to the data request terminal. The connection configuration information includes a target address, a target object account, and a target object password. The target object account represents the account used by the data request terminal to access the data service object, and the target object password represents the password used by the data request terminal to access the data service object. The data request terminal is also used to send the target object account and target object password to the corresponding data service object according to the target address, so that the data service object can establish a connection with the data request terminal; The data request terminal includes a dynamic credential generation module; The dynamic credential generation module is used to invoke the identity credential collection tool from the connected control terminal in response to a data request instruction to collect the terminal's identity credential, wherein the identity credential collection tool is used for: Collect the first identifier of the application that issued the data request command and the second identifier of the data request terminal; The first identifier and the second identifier are integrated to obtain a terminal identity credential in plaintext form; The terminal identity credential is encrypted using the first encryption algorithm to obtain the ciphertext form of the terminal identity credential.

2. The data service object connection system according to claim 1, characterized in that, The connection control terminal includes a registration module, which is used for: Receive registration requests from data request terminals; In response to a registration request, an identity credential collection tool is sent to the requesting terminal so that the data requesting terminal can run the identity credential collection tool to obtain terminal identity credentials. The terminal identity credential is used to verify the permissions of the data service object, and the verified terminal identity credential is associated with the connection configuration information used to connect to the data service object and stored.

3. The data service object connection system according to claim 2, characterized in that, The connection control terminal further includes a connection configuration module, which is used for: Obtain connection technology configuration information from the management terminal, wherein the connection technology configuration information includes the target object identifier and connection technology configuration; The corresponding data service object is determined based on the target object identifier; The connection technology configuration is written into the connection configuration information associated with the data service object.

4. The data service object connection system according to claim 1, characterized in that, The connection configuration information also includes connection technology configuration, and the data request terminal further includes a connection establishment module, which is used for: Determine whether the corresponding connection technology tool exists locally based on the connection technology configuration; If a corresponding connection technology tool exists locally, the connection technology tool is invoked locally to establish a connection with the data service object; If the corresponding connection technology tool does not exist locally, the connection technology tool is invoked from the connection control terminal to establish a connection with the data service object.

5. The data service object connection system according to claim 1, characterized in that, The connection control terminal includes a password update module, which is used for: The password update tool is invoked based on a timer triggered by the connection configuration information to update the password of the target object in the connection configuration information.

6. A method for connecting data service objects, characterized in that, In a data request terminal of a connection system for a data service object as described in claim 1, the connection method for the data service object includes the following steps: Generate terminal identity credentials in response to data request commands; The terminal identity credentials are sent to the connection control terminal to obtain connection configuration information, wherein the connection configuration information includes a target address, a target object account, and a target object password; the target object account represents the account used by the data request terminal to access the data service object, and the target object password represents the password used by the data request terminal to access the data service object; Based on the target address, the target object's account and password are sent to the corresponding data service object to establish a connection with the data service object; The process of generating terminal identity credentials in response to a data request instruction specifically includes the following steps: The dynamic credential generation module is used to invoke the identity credential collection tool from the connected control terminal in response to a data request instruction to collect the terminal's identity credential, wherein the identity credential collection tool is used for: Collect the first identifier of the application that issued the data request command and the second identifier of the data request terminal; The first identifier and the second identifier are integrated to obtain a terminal identity credential in plaintext form; The terminal identity credential is encrypted using the first encryption algorithm to obtain the ciphertext form of the terminal identity credential.

7. A method for connecting data service objects, characterized in that, In the connection control terminal of the connection system for the data service object as described in claim 1, the connection method for the data service object includes the following steps: Obtain the terminal identity credentials from the data requesting terminal; The connection configuration information is matched according to the terminal identity credentials, wherein the connection configuration information includes a target address, a target object account, and a target object password; the target object account represents the account used by the data request terminal to access the data service object, and the target object password represents the password used by the data request terminal to access the data service object; The matching connection configuration information is sent to the data request terminal so that the data request terminal can establish a connection with the corresponding data service object according to the connection configuration information.

8. An electronic device, characterized in that, The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for implementing communication between the processor and the memory. When the program is executed by the processor, it implements the steps of the connection method for the data service object as described in claim 6 or claim 7.

9. A storage medium, said storage medium being a computer-readable storage medium for computer-readable storage, characterized in that, The storage medium stores one or more programs, which can be executed by one or more processors to implement the steps of the connection method for the data service object as described in claim 6 or claim 7.

Images