Data access control methods, apparatus, computer equipment and storage media

Abstract

This application relates to a data access control method, apparatus, computer device, and storage medium. The method includes: authenticating the client by invoking multiple authentication methods when a bidirectional secure transmission connection is established between a zero-trust controller and a client; obtaining a comprehensive authentication result for the client based on the authentication results of each authentication method; determining a list of zero-trust application gateways allowed for the client's connection when the comprehensive authentication result indicates successful authentication; and sending the client's comprehensive authentication result and a preset security detection policy to each zero-trust application gateway in the list, enabling the zero-trust application gateways to perform security checks on the data processing requests sent by the client according to the security detection policy, and sending the data processing requests to the database system when the checks pass. This method enables layer-by-layer verification of client data processing requests, ensuring the security of the database system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a data access control method and device, a computer device, a storage medium and a computer program product. BACKGROUND

[0002] In order to ensure the security of a database system, most database systems will set related security protection to prevent data leakage, alteration or destruction caused by illegal use. However, if the database system itself has a vulnerability, a user who has connected and logged in may bypass these security protection measures by exploiting the vulnerability, thereby threatening the security of the database system. Therefore, how to ensure the security of the database system has become a problem to be solved. SUMMARY

[0003] Therefore, it is necessary to provide a data access control method, device, computer device, computer readable storage medium and computer program product to solve the technical problem that the database system is vulnerable to attack.

[0004] In a first aspect, the present application provides a data access control method. The method comprises:

[0005] In a case where a zero-trust controller and a client establish a bidirectional secure transmission connection, calling a plurality of authentication modes to authenticate the client;

[0006] Based on an authentication result of each authentication mode, obtaining a comprehensive authentication result for the client;

[0007] When the comprehensive authentication result is authentication success, determining a zero-trust application gateway list that allows the client to connect;

[0008] Sending the comprehensive authentication result of the client and a preset security detection strategy to each zero-trust application gateway in the zero-trust application gateway list;

[0009] The zero-trust application gateway is configured to perform security detection on a data processing request sent by the client according to the security detection strategy, and send the data processing request to a database system when the detection is passed.

[0010] In one embodiment, when the comprehensive authentication result is authentication success, determining a zero-trust application gateway list that allows the client to connect comprises:

[0011] Obtaining an application type of the client;

[0012] According to the application type, a preset mapping relationship table is queried to obtain a list of zero-trust application gateways that allow the client to connect; the mapping relationship table stores mapping relationships between multiple different application types and corresponding lists of zero-trust application gateways.

[0013] In one of the embodiments, the two-way secure transmission connection between the zero-trust controller and the client is established in the following manner:

[0014] In response to a connection request carrying an authorization data packet sent by the client, the authorization data packet is verified;

[0015] When the verification is passed, a two-way secure transmission connection between the zero-trust controller and the client is established;

[0016] When the verification fails, the authorization data packet is discarded, and no response information is sent to the client.

[0017] In one of the embodiments, before the comprehensive authentication result of the client and the preset security detection strategy are sent to each zero-trust application gateway in the list of zero-trust application gateways, the following further includes:

[0018] A connection request carrying an authorization data packet sent by each zero-trust application gateway is received; the information of the corresponding zero-trust application gateway is included in each authorization data packet;

[0019] Each authorization data packet is verified respectively, and a target zero-trust application gateway corresponding to the authorization data packet that passes the verification is determined based on the verification result;

[0020] A two-way secure transmission connection between the zero-trust controller and the target zero-trust application gateway is established.

[0021] In one of the embodiments, after the list of zero-trust application gateways that allow the client to connect is determined when the comprehensive authentication result is authentication success, the following further includes:

[0022] The list of zero-trust application gateways is sent to the client; the client is used to establish a two-way secure transmission connection with any zero-trust application gateway in the list of zero-trust application gateways, and send a data processing request to the zero-trust application gateway after the two-way secure transmission connection is established.

[0023] In one of the embodiments, after the comprehensive authentication result for the client is obtained based on the authentication result of each authentication method, the following further includes:

[0024] synchronize the comprehensive authentication result to the database system; the database system is configured to execute a data processing request of the client if the comprehensive authentication result is successful.

[0025] In a second aspect, the present application further provides another data access control method. The method comprises:

[0026] receiving a comprehensive authentication result for a client and a preset security detection policy sent by a zero trust controller; the comprehensive authentication result is obtained by the zero trust controller based on authentication results of multiple authentication manners, and the authentication results of the multiple authentication manners are obtained by the zero trust controller after calling the multiple authentication manners to authenticate the client in a case that a bidirectional secure transmission connection is established between the zero trust controller and the client;

[0027] establishing a bidirectional secure transmission connection with the client when the comprehensive authentication result is successful;

[0028] performing security detection on a data processing request sent by the client based on the bidirectional secure transmission connection according to the security detection policy;

[0029] sending the data processing request to a database system when the detection is passed; the database system is configured to execute the data processing request to obtain an execution result;

[0030] receiving the execution result returned by the database system and forwarding the execution result to the client.

[0031] In one embodiment, the method further comprises, after performing security detection on the data processing request sent by the client based on the bidirectional secure transmission connection according to the security detection policy:

[0032] filtering the data processing request and sending notification information to the client when the detection is not passed; the notification information is used to prompt the client that the security detection is not passed.

[0033] In one embodiment, the method further comprises:

[0034] sending a detection result for the data processing request and associated information of the data processing request to the zero trust controller;

[0035] the zero trust controller is configured to update the security detection policy according to the detection result and the associated information, and send the updated security detection policy to the zero trust credit gateway.

[0036] In a third aspect, the present application further provides a data access control device. The device comprises:

[0037] The client authentication module is used to authenticate the client by calling various authentication methods when a two-way secure transmission connection is established between the zero-trust controller and the client.

[0038] The result determination module is used to obtain a comprehensive authentication result for the client based on the authentication result of each authentication method.

[0039] The list determination module is used to determine a list of zero-trust application gateways that the client is allowed to connect to when the comprehensive authentication result is successful.

[0040] The information sending module is used to send the client's comprehensive authentication result and preset security detection policy to each zero-trust application gateway in the zero-trust application gateway list; the zero-trust application gateway is used to perform security detection on the data processing request sent by the client according to the security detection policy, and send the data processing request to the database system when the detection is successful.

[0041] Fourthly, this application also provides another data access control device. The device includes:

[0042] The information receiving module is used to receive the comprehensive authentication result and preset security detection strategy for the client sent by the zero trust controller; the comprehensive authentication result is obtained by the zero trust controller based on the authentication results of multiple authentication methods, and the authentication results of multiple authentication methods are obtained by the zero trust controller after authenticating the client by calling multiple authentication methods when a bidirectional secure transmission connection is established with the client;

[0043] The connection establishment module is used to establish a bidirectional secure transmission connection with the client when the comprehensive authentication result is successful.

[0044] The request detection module is used to respond to a data processing request sent by the client based on the bidirectional secure transmission connection, and to perform security detection on the data processing request according to the security detection strategy.

[0045] The request sending module is used to send the data processing request to the database system when the detection passes; the database system is used to execute the data processing request and obtain the execution result.

[0046] The result forwarding module is used to receive the execution result returned by the database system and forward the execution result to the client.

[0047] Fifthly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0048] When a two-way secure transmission connection is established between the zero-trust controller and the client, multiple authentication methods are invoked to authenticate the client;

[0049] Based on the authentication results of each authentication method, a comprehensive authentication result is obtained for the client.

[0050] When the overall authentication result is successful, a list of zero-trust application gateways that the client is allowed to connect to is determined.

[0051] The client's comprehensive authentication result and preset security detection policy are sent to each zero-trust application gateway in the zero-trust application gateway list.

[0052] The zero-trust application gateway is used to perform security checks on the data processing requests sent by the client according to the security detection policy, and when the detection is successful, send the data processing requests to the database system.

[0053] Sixthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0054] When a two-way secure transmission connection is established between the zero-trust controller and the client, multiple authentication methods are invoked to authenticate the client;

[0055] Based on the authentication results of each authentication method, a comprehensive authentication result is obtained for the client.

[0056] When the overall authentication result is successful, a list of zero-trust application gateways that the client is allowed to connect to is determined.

[0057] The client's comprehensive authentication result and preset security detection policy are sent to each zero-trust application gateway in the zero-trust application gateway list.

[0058] The zero-trust application gateway is used to perform security checks on the data processing requests sent by the client according to the security detection policy, and when the detection is successful, send the data processing requests to the database system.

[0059] Seventhly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0060] When a two-way secure transmission connection is established between the zero-trust controller and the client, multiple authentication methods are invoked to authenticate the client;

[0061] Based on the authentication results of each authentication method, a comprehensive authentication result is obtained for the client.

[0062] When the overall authentication result is successful, a list of zero-trust application gateways that the client is allowed to connect to is determined.

[0063] The client's comprehensive authentication result and preset security detection policy are sent to each zero-trust application gateway in the zero-trust application gateway list.

[0064] The zero-trust application gateway is used to perform security checks on the data processing requests sent by the client according to the security detection policy, and when the detection is successful, send the data processing requests to the database system.

[0065] The aforementioned data access control methods, devices, computer equipment, storage media, and computer program products, before a client accesses data in the database system, first verify whether a bidirectional transmission connection has been established between the zero-trust controller and the client, performing an initial security check on the client. If a bidirectional secure transmission connection is established between the zero-trust controller and the client, the client is authenticated using multiple authentication methods. A second security check is performed on the client based on the comprehensive authentication result. Compared to traditional methods, this significantly enhances the security of client login. Furthermore, when the comprehensive authentication result is successful, a list of zero-trust application gateways allowed for client connection is determined. The client's comprehensive authentication result and a preset security detection policy are sent to each zero-trust application gateway in the list. The zero-trust application gateways then perform a third security check on the client's data processing request according to the security detection policy. Upon successful detection, the data processing request is sent to the database system. Thus, before receiving a client's data processing request, the database system undergoes multiple layers of security checks, preventing malicious attacks exploiting vulnerabilities even if they exist within the database system. Attached Figure Description

[0066] Figure 1 This is an application environment diagram of a data access control method in one embodiment;

[0067] Figure 2 This is a flowchart illustrating a data access control method in one embodiment;

[0068] Figure 3 This is a flowchart illustrating the data access control method in another embodiment;

[0069] Figure 4 This is a flowchart illustrating the interaction between the zero-trust controller and the client in one embodiment;

[0070] Figure 5 This is a flowchart illustrating the interaction between the zero-trust controller, zero-trust application gateway, client, and database system in one embodiment.

[0071] Figure 6 This is a structural block diagram of a data access control device in one embodiment;

[0072] Figure 7 This is a structural block diagram of the data access control device in another embodiment;

[0073] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0074] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0075] The data access control method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, client 102 communicates with zero-trust controller 104 and zero-trust application gateway 106 via the network. Zero-trust controller 104 communicates with zero-trust application gateway 106 and database system 108 via the network. Zero-trust application gateway 106 communicates with database system 108 via the network. Zero-trust controller 104 can be implemented using a standalone server or a server cluster consisting of multiple servers. The functions of each component are described below:

[0076] Among them, the client 102 is mainly used to initiate data processing requests to the database system 108, perform multi-factor authentication, and monitor its own operating environment. The client component can be represented as an SDK (Software Development Kit), APP (Application), or Web front-end (World Wide Web).

[0077] The Zero Trust Application Gateway 106 is mainly used to monitor and manage the connection session between the client 102 and the database system 108. According to the security detection policy issued by the Zero Trust Controller 104, it performs detection and filtering control on the data processing requests of the client 102.

[0078] The zero-trust controller 104 is used to synchronize user and access permission information of client 102 (distributed local) with database system 108, and to perform permission authorization determination of client 102 by calling trust algorithm and external security policy library, permission authorization library and runtime environment library through policy engine.

[0079] The database system is a (distributed) database system component used to provide restricted and protected database system resources.

[0080] In the application scenario of this application, before accessing the database system, client 102 first establishes a bidirectional secure transmission connection with zero-trust controller 104, and then triggers a data access request to zero-trust controller 104. After receiving the data access request, zero-trust controller 104 calls multiple authentication methods to verify client 102, obtains the authentication result of each authentication method, and obtains a comprehensive authentication result for client 102 based on the authentication result of each authentication method. When the comprehensive authentication result is successful, a list of zero-trust application gateways that client 102 is allowed to connect is determined. The comprehensive authentication result of client 102 and the preset security detection policy are sent to each zero-trust application gateway in the list of zero-trust application gateways to inform the zero-trust gateway that client 102 has access rights. Thus, after receiving the data processing request sent by client 102, zero-trust application gateway 106 can perform security detection on the data processing request according to the security detection policy. When the detection is successful, the data processing request is sent to database system 108, and database system 108 executes the data processing request.

[0081] In one embodiment, such as Figure 2 As shown, a data access control method is provided, which is applied to... Figure 1 Taking the zero-trust controller 104 as an example, the following steps are included:

[0082] Step S210: With a two-way secure transmission connection established between the zero-trust controller and the client, various authentication methods are invoked to authenticate the client.

[0083] Authentication methods may include account password authentication, biometric authentication (such as facial recognition, fingerprint recognition, etc.), certificate authentication, mobile phone verification code, image verification code, and one-time password authentication (OTP). Certificate authentication may include PKI (Public Key Infrastructure) certificate authentication and CA certificate authentication.

[0084] The authentication result can include authentication success or authentication failure.

[0085] Specifically, before accessing the database system, client 102 first establishes a two-way secure transmission connection with zero trust controller 104, and then sends a data access request to zero trust controller 104. After receiving the data access request, zero trust controller 104 calls multiple authentication methods to perform security verification on client 102 and obtains the authentication result of each authentication method.

[0086] Step S220: Based on the authentication results of each authentication method, obtain the comprehensive authentication result for the client.

[0087] Specifically, in one implementation, the overall authentication result for client 102 can be determined as successful if all authentication methods result in successful authentication. Conversely, if at least one authentication method results in failed authentication, the overall authentication result for client 102 is determined as failed authentication.

[0088] In another implementation, a preset success rate can be used. When the proportion of successful authentication methods among all authentication methods is greater than or equal to the preset success rate, the overall authentication result for client 102 is determined to be successful. Conversely, when the proportion of successful authentication methods among all authentication methods is less than the preset success rate, the overall authentication result for client 102 is determined to be unsuccessful.

[0089] Step S230: When the overall authentication result is successful, determine the list of zero-trust application gateways that are allowed for client connections.

[0090] Specifically, the zero-trust application gateways that provide services to different clients will also be different. Therefore, if the overall authentication result for client 102 is determined to be successful, a list of zero-trust application gateways that client 102 is allowed to connect to can be further determined so that any zero-trust application gateway in the list can be used as a detection node for client 102 to communicate with database system 108.

[0091] Step S240: The client's comprehensive authentication result and preset security detection policy are sent to each zero-trust application gateway in the zero-trust application gateway list. The zero-trust application gateway is used to perform security detection on the data processing request sent by the client according to the security detection policy, and when the detection is successful, it sends the data processing request to the database system.

[0092] Data processing requests can be SQL requests. SQL, or Structured Query Language, is a database system query and programming language used to access, query, update, and manage relational database systems. Data processing requests can include data definition (schema, view, table, index), data manipulation (insert, delete, modify), data querying, and data control (security, integrity, concurrency, etc.).

[0093] In this step, the client's comprehensive authentication result is sent to the zero-trust application gateway. This serves to inform the zero-trust application gateway that client 102 has permission to access database system 108. When a connection request is received from client 102, a bidirectional secure transmission connection can be established to facilitate the subsequent receipt of data processing requests from client 102. Sending the security detection policy to the zero-trust application gateway serves as the basis for the gateway to perform security checks on the data processing requests sent by client 102.

[0094] Specifically, the zero-trust controller 104 can pre-invoke trust algorithms, security policy libraries, permission authorization libraries, and runtime environment libraries to determine multiple detection rules for data processing requests sent by clients to the database system, serving as security detection strategies. After determining the list of zero-trust application gateways that client 102 is allowed to connect to, the controller sends the comprehensive authentication result of client 102 and the determined security detection strategies to each zero-trust application gateway in the list. This allows any zero-trust application gateway to agree to establish a bidirectional secure transmission connection with client 102, receive data processing requests sent by client 102, and perform security checks on the data processing requests sent by client 102 according to the security detection strategies. If the checks pass, the controller sends the data processing request to the database system 108, which then executes the data processing request.

[0095] In the aforementioned data access control method, before the client accesses data in the database system, it first verifies whether a bidirectional transmission connection has been established between the zero-trust controller and the client, performing an initial security check on the client. If a bidirectional secure transmission connection is established between the zero-trust controller and the client, the client is authenticated using multiple authentication methods. A second security check is performed on the client based on the comprehensive authentication result. Compared to traditional methods, this significantly enhances the security of client login. Furthermore, when the comprehensive authentication result is successful, a list of zero-trust application gateways allowed for client connection is determined. The client's comprehensive authentication result and preset security detection policies are sent to each zero-trust application gateway in the list. The zero-trust application gateways then perform security checks on the data processing requests sent by the client according to the security detection policies, performing a third security check on the client. If the check passes, the data processing request is sent to the database system. Thus, before receiving the client's data processing request, the database system undergoes multiple layers of security checks, preventing malicious attacks exploiting vulnerabilities even if they exist within the database system.

[0096] In an exemplary embodiment, when the comprehensive authentication result is successful, step S230 above determines the list of zero-trust application gateways that the client is allowed to connect, including: obtaining the application type of the client; querying a preset mapping table according to the application type to obtain the list of zero-trust application gateways that the client is allowed to connect; the mapping table stores the mapping relationship between various different application types and the corresponding list of zero-trust application gateways.

[0097] The application type can be understood as the application scenario of the client. For example, the application type can be banking, gaming, shopping, etc.

[0098] Specifically, different application types can correspond to different zero-trust application gateways. Therefore, when it is determined that the comprehensive authentication result of client 102 is successful, that is, client 102 can be allowed to send data processing requests, the application type of client 102 can be obtained. Based on the application type, the preset mapping relationship table can be queried to obtain the list of zero-trust application gateways that the client is allowed to connect to.

[0099] In this embodiment, a list of zero-trust application gateways that the client is allowed to connect to is determined based on the client's application type, so that the zero-trust application gateways in the list can establish communication connections with the client in the future.

[0100] In an exemplary embodiment, the bidirectional secure transmission connection between the zero-trust controller and the client is established in the following manner: in response to a connection request sent by the client carrying an authorization data packet, the authorization data packet is verified; when the verification is successful, a bidirectional secure transmission connection between the zero-trust controller and the client is established; when the verification fails, the authorization data packet is discarded and no response information is sent to the client.

[0101] Among them, the bidirectional secure transport connection can be an mTLS connection (Mutual Transport Layer Security).

[0102] Specifically, when client 102 establishes a bidirectional secure transmission connection with zero-trust controller 104, client 102 initiates a Single Packet Authorization (SPA) authorization packet, i.e., an authorization data packet, to zero-trust controller 104. This authorization data packet contains client 102's associated information, such as address and device information. Upon receiving the authorization data packet, zero-trust controller 104 verifies it. If verification is successful, i.e., the SPA single-packet authorization is successful, a bidirectional secure transmission connection is established between the zero-trust controller and the client, a key is negotiated, and bidirectional authentication is completed. If verification fails, i.e., the SPA single-packet authorization fails, zero-trust controller 104 directly discards the authorization data packet and does not send a response message to the client.

[0103] In this embodiment, a bidirectional secure transmission connection is established between the zero-trust controller and the client to achieve bidirectional authentication. This embodies the zero-trust security concept centered on the identity of the access subject and object, preventing client identity impersonation. When establishing a bidirectional secure transmission connection between the zero-trust controller and the client, a connection request is made using only a single authorization data packet, eliminating the need for multiple handshakes. This simplifies the connection establishment process, increases the connection establishment speed, and significantly reduces the network attack exposure surface through the SPA single-packet authorization mechanism. In the event of authentication failure, the zero-trust controller directly discards the authorization data packet without sending a response message to the client, thus preventing denial-of-service attacks on the client.

[0104] In one exemplary embodiment, before sending the client's comprehensive authentication result and preset security detection policy to each zero-trust application gateway in the zero-trust application gateway list, the method further includes: receiving a connection request carrying an authorization data packet sent by each zero-trust application gateway; each authorization data packet including information of the corresponding zero-trust application gateway; verifying each authorization data packet respectively, and determining the target zero-trust application gateway corresponding to the verified authorization data packet based on the verification result; and establishing a bidirectional secure transmission connection between the zero-trust controller and the target zero-trust application gateway.

[0105] Understandably, before the Zero Trust Controller sends the client's comprehensive authentication results and preset security detection policies to each Zero Trust Application Gateway in the Zero Trust Application Gateway list, it needs to establish a communication connection with each Zero Trust Application Gateway. Specifically, it needs to establish a two-way secure transmission connection. Only after the two-way secure transmission connection is established can data be transmitted with each Zero Trust Application Gateway.

[0106] In specific implementation, the process of establishing a bidirectional secure transmission connection between the zero-trust controller 104 and each zero-trust application gateway 106 is similar to establishing a bidirectional secure transmission connection between the zero-trust controller 104 and the client 102. Each zero-trust application gateway 106 initiates an SPA single-packet authorization, i.e., an authorization data packet, to the zero-trust controller 104. The authorization data packet contains information about the zero-trust application gateway, such as address information and device information. After receiving the authorization data packet, the zero-trust controller 104 can verify the authorization data packet. Based on the verification result, the target zero-trust application gateway corresponding to the successfully verified authorization data packet is determined, a bidirectional secure transmission connection is established between the zero-trust controller and each zero-trust application gateway, a key is negotiated, and bidirectional identity authentication is completed. Furthermore, for authorization data packets that fail to be verified, the zero-trust controller 104 directly discards the authorization data packet and does not send a response information to the zero-trust application gateway corresponding to the failed authorization data packet.

[0107] In this embodiment, a bidirectional secure transmission connection is established between the zero-trust controller and each zero-trust application gateway to achieve bidirectional authentication. This embodies the zero-trust security concept centered on the identity of the access subject and object, preventing "man-in-the-middle attacks" by impersonating zero-trust application gateways. When establishing a bidirectional secure transmission connection between the zero-trust controller and each zero-trust application gateway, a connection request is made using only a single authorization data packet, eliminating the need for multiple handshakes. This simplifies the connection establishment process, increases the connection establishment speed, and significantly reduces the network attack surface through the SPA single-packet authorization mechanism. If authentication fails, the zero-trust controller directly discards the authorization data packet without sending a response message to the zero-trust application gateway corresponding to the failed authorization data packet, thus preventing denial-of-service attacks against such gateways.

[0108] In an exemplary embodiment, after determining the list of zero-trust application gateways that the client is allowed to connect to when the comprehensive authentication result is successful in step S230, the method further includes: sending the list of zero-trust application gateways to the client; the client is used to establish a bidirectional secure transmission connection with any zero-trust application gateway in the list of zero-trust application gateways, and to send a data processing request to the zero-trust application gateway after the bidirectional secure transmission connection is established.

[0109] Specifically, after determining the list of zero-trust application gateways that the client 102 is allowed to connect to, the zero-trust controller 104, in addition to sending the client 102's comprehensive authentication result and preset security detection policy to each zero-trust application gateway in the list, also needs to send the list of zero-trust application gateways to the client 102 to notify the client 102 which zero-trust application gateways it can establish communication connections with. After receiving the list of zero-trust application gateways, the client 102 can initiate SPA single-packet authorization to any zero-trust application gateway in the list. When the SPA single-packet authorization is successful, a bidirectional secure transmission connection is established with that zero-trust application gateway. Then, through the bidirectional secure transmission connection, a data processing request is sent to the corresponding zero-trust application gateway, causing the zero-trust application gateway to perform security detection on the data processing request. If the detection is successful, the data processing request is forwarded to the database system 108, causing the database system 108 to execute the data processing request.

[0110] In this embodiment, after determining the list of zero-trust application gateways that are allowed for client connection, the zero-trust controller also needs to send the list of zero-trust application gateways to the client so that the client can know which zero-trust application gateways it can establish a communication connection with, and thus establish a communication connection with them to transmit data processing requests.

[0111] In an exemplary embodiment, after obtaining the comprehensive authentication result for the client based on the authentication result of each authentication method in step S220, the method further includes: synchronizing the comprehensive authentication result to the database system; the database system is used to execute the client's data processing request if the comprehensive authentication result indicates successful authentication.

[0112] In specific implementation, after determining the comprehensive authentication result for the client 102, the zero trust controller 104 not only synchronizes the comprehensive authentication result to each zero trust application gateway in the zero trust application gateway list, but also synchronizes the comprehensive authentication result to the database system 108, so that the database system can determine whether to execute the data processing request of the client 102 based on the comprehensive authentication result.

[0113] In this embodiment, by synchronizing the comprehensive authentication result to the database system, the database system can promptly execute the client's data processing request if the comprehensive authentication result indicates successful authentication.

[0114] In one embodiment, such as Figure 3 As shown, a data access control method is provided, which is applied to... Figure 1 Taking the Zero Trust Application Gateway 106 as an example, the following steps are included:

[0115] Step S310: Receive the comprehensive authentication result and preset security detection strategy for the client sent by the zero trust controller; the comprehensive authentication result is obtained by the zero trust controller based on the authentication results of multiple authentication methods, and the authentication results of multiple authentication methods are obtained by the zero trust controller after authenticating the client by calling multiple authentication methods when a bidirectional secure transmission connection is established with the client.

[0116] Specifically, before accessing the database system, client 102 establishes a bidirectional secure transmission connection with zero-trust controller 104, and then sends a data access request to zero-trust controller 104. After receiving the data access request, zero-trust controller 104 invokes multiple authentication methods to perform security verification on client 102, obtaining the authentication result of each authentication method. Based on the authentication results of each authentication method, a comprehensive authentication result for client 102 is obtained. Then, when the comprehensive authentication result is successful, a list of zero-trust application gateways allowed for client 102 to connect is determined, and the comprehensive authentication result of client 102 and the preset security detection policy are sent to each zero-trust application gateway in the list. Thus, each zero-trust application gateway receives the comprehensive authentication result and the preset security detection policy sent by zero-trust controller 104.

[0117] Step S320: When the overall authentication result is successful, establish a bidirectional secure transmission connection with the client.

[0118] Specifically, when the Zero Trust Application Gateway 106 determines that the overall authentication result for client 102 is successful, it can determine that client 102 has the right to access database system 108. Then, it can establish a bidirectional secure transmission connection with the client so that client 102 can send data processing requests through the bidirectional secure transmission connection.

[0119] Step S330: In response to the data processing request sent by the client based on the bidirectional secure transmission connection, perform security detection on the data processing request according to the security detection policy.

[0120] Specifically, after receiving a data processing request sent by client 102, the zero-trust application gateway 106, in order to ensure the security of the database system, can first perform security checks on the data processing request according to the security detection policy sent by the zero-trust controller 104 to determine whether client 102 has engaged in identity fraud or other similar activities.

[0121] Step S340: When the detection passes, a data processing request is sent to the database system; the database system executes the data processing request and obtains the execution result.

[0122] Specifically, when the detection passes, indicating that the client 102 is secure, the data processing request can be forwarded to the database system 108, so that the database system 108 can execute the data processing request and obtain the execution result. After obtaining the execution result, the database system 108 will return the execution result to the zero-trust application gateway 106.

[0123] Step S350: Receive the execution result returned by the database system and forward the execution result to the client.

[0124] Specifically, after receiving the execution result returned by the database system 108, the zero-trust application gateway 106 can forward the execution result to the client 102, thereby enabling the client 102 to access the database system 104.

[0125] The data access control method provided in this embodiment allows the zero-trust application gateway to perform detection and filtering control on data processing requests sent by clients according to the security detection policy issued by the zero-trust controller. This can prevent out-of-scope commands from passing through, ensuring that the database system completes the verification by the zero-trust application gateway before receiving any commands. Thus, even if the data system has vulnerabilities, it can still prevent malicious attacks that exploit these vulnerabilities.

[0126] In an exemplary embodiment, after responding to the data processing request sent by the client based on the bidirectional secure transmission connection in step S330, and performing security detection on the data processing request according to the security detection policy, the method further includes: when the detection fails, filtering the data processing request and sending a notification message to the client; the notification message is used to prompt the client that the security detection has failed.

[0127] Specifically, after performing a security check on the data processing request from client 102 according to the security detection policy, if the check fails, it indicates that the data processing request from client 102 is risky. Therefore, the zero-trust application gateway can filter out the data processing request and even terminate the connection to the database system 108, for example, if the detection reveals that the data processing request has been injected with an attack. While filtering out the data processing request, a notification message can also be sent to client 102 to inform it that the security check failed.

[0128] In this embodiment, when the security check on the client's data processing request fails, the data processing request is filtered out, thereby avoiding attacks on the database system and ensuring the security of the database system.

[0129] In one exemplary embodiment, the method further includes: sending the detection result of the data processing request and the associated information of the data processing request to the zero trust controller; the zero trust controller is used to update the security detection policy according to the detection result and the associated information, and send the updated security detection policy to the zero trust trust gateway.

[0130] Specifically, after receiving the detection results for the data processing request, the Zero Trust Application Gateway 106 can send the detection results and related information of the data processing request, such as relevant context information, to the Zero Trust Controller 104. This enables the Zero Trust Controller 104 to update the security detection policy based on the detection results and related information, and then send the updated security detection policy to the Zero Trust Trust Gateway 106 to achieve dynamic access control.

[0131] In this embodiment, by sending the detection results and associated information of the data processing request to the zero-trust controller, the zero-trust controller updates the security detection policy based on the detection results and associated information, and sends the updated security detection policy to the zero-trust trust gateway. This enables dynamic updating of the security detection policy, thereby achieving dynamic access control of client SQL requests and improving the security of the database system.

[0132] In one embodiment, to facilitate understanding of the embodiments of this application by those skilled in the art, specific examples will be described below in conjunction with the accompanying drawings.

[0133] refer to Figure 4The flowchart illustrates the interaction between the zero-trust controller and the client, including the following steps:

[0134] (1) The Zero Trust Controller and the Zero Trust Application Gateway establish an mTLS (mutual TLS) connection, negotiate the key, and complete mutual authentication.

[0135] (2) The client initiates SPA single-packet authorization to the zero-trust controller. If the SPA single-packet authorization fails, the zero-trust controller directly discards the SPA single packet and does not respond to the client; if the SPA single-packet authorization is successful, the client establishes an mTLS (mutual TLS) connection with the zero-trust controller, negotiates the key, and completes mutual authentication.

[0136] (3) The zero-trust controller calls the (single-factor) authentication authorization module involved in the multi-factor authentication (MFA) strategy to verify the relevant client information.

[0137] (4) The authentication activities marked in 4.1-4.4 (account password authentication, PKI certificate authentication, face authentication, other optional authentication) are optional and can be performed concurrently. Whether or not an authentication activity is selected depends on whether the zero trust controller client's multi-factor authentication strategy includes this authentication.

[0138] (5) The zero-trust controller summarizes the authentication activity results marked in 4.1-4.4 to obtain the comprehensive authentication result and judges whether the client meets the multi-factor authentication strategy.

[0139] (6) If the Zero Trust Controller determines that the client does not meet the multi-factor authentication policy, the client authentication fails, and the Zero Trust Controller sends an authentication failure message to the client.

[0140] (7) If the Zero Trust Controller determines that the client meets the multi-factor authentication policy, the client authentication is successful. The Zero Trust Controller determines the list of Zero Trust application gateways that the client is allowed to connect to and notifies each Zero Trust application gateway in the list and the client.

[0141] (8) The client initiates SPA single-packet authorization to the Zero Trust Application Gateway. If the SPA single-packet authorization fails, the Zero Trust Application Gateway directly discards the SPA single packet and does not respond to the client; if the SPA single-packet authorization is successful, the client and the Zero Trust Application Gateway establish mTLS (mutual TLS connection), negotiate the key, and complete mutual authentication.

[0142] refer to Figure 5 The diagram illustrates the interaction flow between the zero-trust controller, zero-trust application gateway, client, and database system, including the following steps:

[0143] (1) The zero trust controller synchronizes the client's permission information with the database system.

[0144] (2) The zero trust controller calls the trust algorithm, security policy library, permission authorization library and runtime environment library to determine the security detection policy and distribute it to the zero trust application gateway.

[0145] (3) The client initiates SQL requests (including data definition (schema, view, table, index), data manipulation (add, delete, modify), data query, data control (security, integrity, concurrency, etc.)) to the zero-trust application gateway.

[0146] (4) The Zero Trust Application Gateway detects SQL requests according to the security detection policy, judges the compliance of the client's database system SQL requests, and makes access authorization decisions.

[0147] (5) If the Zero Trust Application Gateway analysis and matching result is "reject", the Zero Trust Application Gateway filters the SQL request and may even terminate the database system connection (for example, because the analysis found an SQL injection attack) and notify the client that the SQL request was rejected.

[0148] (6) If the Zero Trust Application Gateway analyzes and matches the decision result as “Allow”, then the Zero Trust Application Gateway forwards the “Allow” message and the SQL request to the database system.

[0149] (7) The database system executes the client's SQL request and obtains the SQL execution result.

[0150] (8) The database system returns the SQL execution result to the zero-trust application gateway.

[0151] (9) Zero Trust Application Gateway forwards SQL execution results to the client.

[0152] (10) The Zero Trust Application Gateway reports the processing results and related context information of the client's SQL request to the Zero Trust Controller.

[0153] (11) After the zero trust controller collects relevant information, it updates the security detection policy and distributes it to the zero trust application gateway to realize dynamic access control.

[0154] The data access control method provided in this application has the following beneficial effects:

[0155] (1) Two-way identity authentication is performed between the client, the zero trust application gateway, and the zero trust controller, which reflects the security concept of zero trust security based on the identity of the access subject and object, and prevents the client identity from being impersonated and the impersonation of the zero trust application gateway to carry out "man-in-the-middle attacks". At the same time, the SPA single packet authorization mechanism can significantly reduce the network attack exposure surface.

[0156] (2) Perform multi-factor authentication on the client. In addition to the traditional database system account password, use one or two additional authentication methods, such as mobile phone verification code, image verification code, OTP (One Time Password), CA certificate, or even biometric authentication such as face recognition and fingerprint recognition, which greatly enhances the security of client login.

[0157] (3) The Zero Trust Application Gateway performs detection and filtering control on client SQL requests based on the security detection policy issued by the Zero Trust Controller. It has better real-time performance, higher efficiency, and better reflects the superiority of distributed systems.

[0158] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0159] Based on the same inventive concept, this application also provides a data access control device for implementing the data access control method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more data access control device embodiments provided below can be found in the limitations of the data access control method described above, and will not be repeated here.

[0160] In one embodiment, such as Figure 6 As shown, a data access control device is provided, including: a client authentication module 610, a result determination module 620, a list determination module 630, and an information sending module 640, wherein:

[0161] The client authentication module 610 is used to authenticate the client by calling various authentication methods when a two-way secure transmission connection is established between the zero-trust controller and the client.

[0162] The result determination module 620 is used to obtain a comprehensive authentication result for the client based on the authentication result of each authentication method;

[0163] The list determination module 630 is used to determine the list of zero-trust application gateways that are allowed for client connection when the overall authentication result is successful.

[0164] The information sending module 640 is used to send the client's comprehensive authentication result and preset security detection policy to each zero-trust application gateway in the zero-trust application gateway list; the zero-trust application gateway is used to perform security detection on the data processing request sent by the client according to the security detection policy, and send the data processing request to the database system when the detection is successful.

[0165] In one embodiment, the list determination module 630 is further configured to obtain the application type of the client; based on the application type, query a preset mapping table to obtain a list of zero-trust application gateways that the client is allowed to connect to; the mapping table stores the mapping relationships between various different application types and their corresponding zero-trust application gateway lists.

[0166] In one embodiment, the apparatus further includes a first connection establishment module, configured to verify the authorization data packet in response to a connection request carrying an authorization data packet sent by the client; when the verification is successful, establish a bidirectional secure transmission connection between the zero-trust controller and the client; when the verification fails, discard the authorization data packet and do not send a response message to the client.

[0167] In one embodiment, the above-mentioned apparatus further includes a second connection establishment module, configured to receive connection requests carrying authorized data packets sent by each zero-trust application gateway; each authorized data packet includes information of the corresponding zero-trust application gateway; each authorized data packet is verified, and the target zero-trust application gateway corresponding to the verified authorized data packet is determined based on the verification result; a bidirectional secure transmission connection is established between the zero-trust controller and the target zero-trust application gateway.

[0168] In one embodiment, the above-mentioned apparatus further includes a list sending module for sending a list of zero-trust application gateways to the client; the client is used to establish a bidirectional secure transmission connection with any zero-trust application gateway in the list of zero-trust application gateways, and send a data processing request to the zero-trust application gateway after the bidirectional secure transmission connection is established.

[0169] In one embodiment, the above-mentioned apparatus further includes a result synchronization module for synchronizing the comprehensive authentication result to the database system; the database system is used to execute the client's data processing request when the comprehensive authentication result is successful.

[0170] In another embodiment, such as Figure 7 As shown, a data access control device is also provided, including: an information receiving module 710, a connection establishment module 720, a request detection module 730, a request sending module 740, and a result forwarding module 750, wherein:

[0171] The information receiving module 710 is used to receive the comprehensive authentication result and preset security detection strategy sent by the zero trust controller for the client; the comprehensive authentication result is obtained by the zero trust controller based on the authentication results of multiple authentication methods, and the authentication results of multiple authentication methods are obtained by the zero trust controller after calling multiple authentication methods to authenticate the client when a bidirectional secure transmission connection is established with the client;

[0172] The connection establishment module 720 is used to establish a bidirectional secure transmission connection with the client when the overall authentication result is successful.

[0173] The request detection module 730 is used to respond to data processing requests sent by the client based on a bidirectional secure transmission connection and to perform security detection on the data processing requests according to a security detection strategy.

[0174] The request sending module 740 is used to send a data processing request to the database system when the detection passes; the database system is used to execute the data processing request and obtain the execution result.

[0175] The result forwarding module 750 is used to receive the execution results returned by the database system and forward the execution results to the client.

[0176] In one embodiment, the above-described apparatus further includes a request filtering module, used to filter data processing requests and send notification information to the client when the detection fails; the notification information is used to prompt the client that the security detection has failed.

[0177] In one embodiment, the result forwarding module 750 is further configured to send the detection result and the associated information of the data processing request to the zero trust controller; the zero trust controller is configured to update the security detection policy based on the detection result and the associated information, and send the updated security detection policy to the zero trust trust gateway.

[0178] Each module in the aforementioned data access control device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0179] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database system. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database system stores data used in the data access control process. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements a data access control method.

[0180] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0181] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0182] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0183] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0184] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0185] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, database systems, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The database systems involved in the embodiments provided in this application may include at least one of relational database systems and non-relational database systems. Non-relational database systems may include, but are not limited to, blockchain-based distributed database systems. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0186] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0187] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A data access control method, characterized in that, Applied to a zero-trust controller, the method includes: Before the client accesses the database system, in response to the connection request carrying the authorization data packet sent by the client, the authorization data packet is verified. When the verification is successful, a two-way secure transmission connection is established between the zero trust controller and the client. With the two-way secure transmission connection established, multiple authentication methods are invoked to authenticate the client. Based on the authentication results of each authentication method, a comprehensive authentication result is obtained for the client. When the comprehensive authentication result is successful, the application type of the client is obtained; based on the application type, a preset mapping table is queried to obtain a list of zero-trust application gateways that the client is allowed to connect to. The client's comprehensive authentication result and preset security detection policy are sent to each of the zero-trust application gateways in the zero-trust application gateway list. The comprehensive authentication result is used to indicate to each zero-trust application gateway that the client has permission to access the database system, so that after receiving the data processing request sent by the client, any zero-trust application gateway performs a security detection on the data processing request according to the security detection policy, and if the detection passes, sends the data processing request to the database system. The data processing request is sent by the client when a bidirectional secure transmission connection has been established with any of the zero-trust application gateways. Receive the detection results returned by the zero-trust application gateway and the association information of the data processing request, and update the security detection policy according to the detection results and the association information of the data processing request.

2. The method according to claim 1, characterized in that, The mapping table stores the mapping relationships between various application types and their corresponding zero-trust application gateway lists.

3. The method according to claim 1, characterized in that, The step of responding to a connection request carrying an authorization data packet sent by the client, after verifying the authorization data packet, further includes: When verification fails, the authorization data packet is discarded and no response information is sent to the client.

4. The method according to claim 1, characterized in that, Before sending the client's comprehensive authentication result and preset security detection policy to each zero-trust application gateway in the zero-trust application gateway list, the method further includes: Receive connection requests carrying authorization data packets sent by each of the zero-trust application gateways; each authorization data packet includes information about the corresponding zero-trust application gateway; Each authorized data packet is verified separately, and the target zero-trust application gateway corresponding to the verified authorized data packet is determined based on the verification results; Establish a bidirectional secure transmission connection between the zero-trust controller and the target zero-trust application gateway.

5. The method according to claim 1, characterized in that, After obtaining the list of zero-trust application gateways that the client is allowed to connect, the following is also included: The client sends the list of zero-trust application gateways to the client; the client is used to establish a bidirectional secure transmission connection with any zero-trust application gateway in the list of zero-trust application gateways, and send a data processing request to the zero-trust application gateway after the bidirectional secure transmission connection is established.

6. The method according to any one of claims 1 to 5, characterized in that, After obtaining the comprehensive authentication result for the client based on the authentication results of each authentication method, the method further includes: The comprehensive authentication result is synchronized to the database system; the database system is used to execute the client's data processing request if the comprehensive authentication result indicates successful authentication.

7. A data access control method, characterized in that, Applied to zero-trust application gateways, the method includes: The system receives a comprehensive authentication result and a preset security detection strategy for the client from the zero-trust controller. The comprehensive authentication result is obtained by the zero-trust controller based on the authentication results of multiple authentication methods. The authentication results of the multiple authentication methods are obtained by the zero-trust controller after authenticating the client by calling multiple authentication methods when a bidirectional secure transmission connection has been established with the client. When the overall authentication result indicates successful authentication, a bidirectional secure transmission connection is established with the client; the overall authentication result is used to indicate to the client that it has permission to access the database system. In response to a data processing request sent by a client based on the bidirectional secure transmission connection, the data processing request is subjected to security detection according to the security detection strategy; When the detection passes, the data processing request is sent to the database system; the database system executes the data processing request and obtains the execution result. Receive the execution result returned by the database system and forward the execution result to the client; It also includes: sending the detection result of the data processing request and the associated information of the data processing request to the zero trust controller; the zero trust controller is used to update the security detection policy according to the detection result and the associated information, and send the updated security detection policy to the zero trust credit gateway.

8. The method according to claim 7, characterized in that, The step of responding to a data processing request sent by a client based on the bidirectional secure transmission connection, and after performing security checks on the data processing request according to the security detection strategy, further includes: When the security check fails, the data processing request is filtered and a notification is sent to the client; the notification is used to inform the client that the security check has failed.

9. A data access control device, characterized in that, The device includes: The client authentication module is used to verify the authorization data packet sent by the client in response to the connection request carrying the authorization data packet before the client accesses the database system. When the verification is successful, a bidirectional secure transmission connection is established between the zero trust controller and the client. When the bidirectional secure transmission connection is established, multiple authentication methods are invoked to authenticate the client. The result determination module is used to obtain a comprehensive authentication result for the client based on the authentication result of each authentication method. The list determination module is used to obtain the application type of the client when the comprehensive authentication result is successful; and to query a preset mapping table according to the application type to obtain a list of zero-trust application gateways that the client is allowed to connect to. The information sending module is used to send the client's comprehensive authentication result and preset security detection policy to each zero-trust application gateway in the zero-trust application gateway list; the comprehensive authentication result is used to indicate to each zero-trust application gateway that the client has the permission to access the database system, so that after receiving the data processing request sent by the client, any zero-trust application gateway performs a security detection on the data processing request according to the security detection policy, and if the detection passes, sends the data processing request to the database system; the data processing request is sent by the client when a bidirectional secure transmission connection has been established with any of the zero-trust application gateways; The policy update module is used to receive the detection results returned by the zero-trust application gateway and the association information of the data processing request, and update the security detection policy according to the detection results and the association information of the data processing request.

10. A data access control device, characterized in that, The device includes: The information receiving module is used to receive the comprehensive authentication result and preset security detection strategy for the client sent by the zero trust controller; the comprehensive authentication result is obtained by the zero trust controller based on the authentication results of multiple authentication methods, and the authentication results of multiple authentication methods are obtained by the zero trust controller after authenticating the client by calling multiple authentication methods when a bidirectional secure transmission connection is established with the client; The connection establishment module is used to establish a bidirectional secure transmission connection with the client when the comprehensive authentication result is successful; the comprehensive authentication result is used to indicate to the client that it has permission to access the database system. The request detection module is used to respond to a data processing request sent by the client based on the bidirectional secure transmission connection, and to perform security detection on the data processing request according to the security detection strategy. The request sending module is used to send the data processing request to the database system when the detection passes; the database system is used to execute the data processing request and obtain the execution result. The result forwarding module is used to receive the execution result returned by the database system and forward the execution result to the client; and to send the detection result of the data processing request and the association information of the data processing request to the zero trust controller; the zero trust controller is used to update the security detection policy according to the detection result and the association information, and send the updated security detection policy to the zero trust trust gateway.

11. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the data access control method according to any one of claims 1 to 8.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the data access control method according to any one of claims 1 to 8.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the data access control method according to any one of claims 1 to 8.

Images