A security agent authentication method, database system and storage medium

Abstract

The application discloses a security proxy authentication method, a database system and a storage medium, which are applied to a communication architecture comprising at least one proxy node and multiple working nodes, and the proxy node needs to be authenticated to the working node, and the method comprises the following steps: the proxy node acquires a login request initiated by a user through a client, and generates a first random value and returns the first random value to the client; a second md5 value is calculated, a third md5 value is calculated, and the authentication of the user by the proxy node is completed by comparing the second md5 value with the third md5 value; the proxy node initiates a proxy login request to the working node, so that the working node returns a second random value; the proxy node directly acquires a fourth md5 value, calculates a fifth md5 value based on the fourth md5 value and the second random value, and completes the authentication by comparing the fifth md5 value with a sixth md5 value. The application does not need to store the plaintext password of the user in the proxy node, and solves the security hidden danger that may be caused by the leakage of the plaintext password of the user in the prior art.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a secure proxy authentication method, database system, and storage medium. Background Technology

[0002] In some load balancing models, to simplify the system interface, such as... Figure 1 As shown, the internal topology of the system is hidden from the user. One or a few nodes provide services to the outside world (referred to as proxy nodes), while more nodes carry out the final processing (referred to as worker nodes).

[0003] Users typically need to be authenticated before they can use the services provided by the system. There are many server-side authentication methods, such as completing the authentication only through proxy nodes, or having the authentication message be passed through the proxy node and completed by the worker nodes. In some architectures, proxy nodes and worker nodes use the same level of service interface; for example, if both proxy nodes and worker nodes are database services, communication between users and proxy nodes, as well as between proxy nodes and worker nodes, is conducted through the database's front-end and back-end protocols. Figure 2 As shown, in this architecture, authentication is required between users and agent nodes, and between agent nodes and worker nodes.

[0004] Existing proxy authentication schemes include, for example, external data access implemented using the FDW module in PostgreSQL. Clients access data on an external database through the master database. The overall architecture is similar to the one mentioned above. The proxy node (master server) stores authentication data related to user passwords, used for authentication between the client and the proxy node. The proxy node also stores the user's plaintext password on the worker node (external server), used for authentication between the proxy node and the worker node.

[0005] Existing technical solutions, such as the FDW module in PostgreSQL, require storing users' plaintext passwords on the proxy node for MD5 authentication between the proxy and worker nodes. Storing user passwords in plaintext in the database poses significant security risks. For example, if the database is attacked or data is leaked, hackers can directly obtain user passwords in plaintext, causing serious consequences. Hackers could also use plaintext to infiltrate other systems registered by users, causing ongoing harm. Storing plaintext passwords in the database also risks leakage if database administrator privileges are compromised. Plaintext transmission and storage violate best practices for password security, increasing the risk of being cracked. Plaintext passwords are detrimental to account security management and password policy control. The long-term existence of plaintext passwords is a major security vulnerability. Summary of the Invention

[0006] This application provides a secure proxy authentication method, database system, and storage medium that eliminates the need to store users' plaintext passwords in the proxy node, thus resolving the security risks posed by the potential leakage of users' plaintext passwords in existing technologies.

[0007] This application provides a secure proxy authentication method, applied in a communication architecture comprising at least one proxy node and multiple worker nodes, wherein the proxy node needs to authenticate with the worker nodes. The secure proxy authentication method includes the following steps:

[0008] The proxy node obtains the login request initiated by the user through the client and generates a first random value to return to the client;

[0009] The client obtains a second MD5 value calculated based on the first random value and the first MD5 value related to the password. The proxy node calculates a third MD5 value based on the stored first MD5 value related to the user's password and the first random value, and compares the second MD5 value with the third MD5 value to complete the authentication of the user by the proxy node.

[0010] The proxy node initiates a proxy login request to the worker node, so that the worker node returns a second random value;

[0011] The proxy node directly obtains the fourth MD5 value, and calculates the fifth MD5 value based on the fourth MD5 value and the second random value, wherein the fourth MD5 value is stored when the proxy node initiates the creation of a login user to the worker node;

[0012] The fifth MD5 value is sent to the worker node so that the worker node can compare the fifth MD5 value with the sixth MD5 value to complete the authentication. The sixth MD5 value is calculated based on the seventh MD5 value and the second random value. The seventh MD5 value is stored by the worker node when the proxy node initiates the creation of a login user.

[0013] Optionally, the client calculates a second MD5 value based on the first random value and the first MD5 value related to the password, including: concatenating the first random value and the first MD5 value related to the password, and calculating the concatenated MD5 value as the second MD5 value.

[0014] Optionally, the fourth MD5 value is calculated based on the plaintext password of the user being created when the proxy node initiates the creation of the login user to the worker node.

[0015] Optionally, the following user creation process may also be included:

[0016] A first user is created on the agent node based on user instructions, and a first MD5 value is calculated based on the password used to create the first user; and

[0017] The agent node creates a second user on the worker node and calculates a fourth MD5 value based on the password of the user who created the second user.

[0018] Optionally, if the password used by the worker node to create the second user is the same as the password used by the user to create the first user, the first MD5 value of the proxy node is the same as the fourth MD5 value, and the user's plaintext password is not stored.

[0019] If the password used by the agent node to create a second user is different from the password used by the user to create the first user, the agent node establishes a mapping relationship between the first and second users, but does not store the user's plaintext password.

[0020] Optionally, if the password used by the agent node to create the second user is different from the password used by the user to create the first user, the agent node can directly obtain the fourth MD5 value based on the established mapping relationship.

[0021] This application also proposes a database system, which includes a communication architecture comprising at least one proxy node and multiple worker nodes. The database system includes a processor and a memory, and the memory stores a computer program. When the computer program is executed by the processor, it implements the steps of the aforementioned secure proxy authentication method.

[0022] This application also proposes a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the aforementioned security proxy authentication method.

[0023] The authentication method of this application embodiment does not require storing the user's plaintext password in the proxy node, thus solving the security risks caused by the possible leakage of the user's plaintext password in the prior art.

[0024] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0025] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0026] Figure 1 This refers to the load balancing model in existing technologies;

[0027] Figure 2 This is a schematic diagram of the authentication process in the existing load balancing model.

[0028] Figure 3 This is a schematic diagram of the basic process of the security proxy authentication method in this application embodiment;

[0029] Figure 4 A user flow diagram is created for the security proxy authentication method in this application embodiment;

[0030] Figure 5 This is a schematic diagram of the user authentication process for the security proxy authentication method in this application embodiment;

[0031] Figure 6 This is a schematic diagram of the proxy authentication process for the security proxy authentication method in this application embodiment. Detailed Implementation

[0032] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0033] This application provides a secure proxy authentication method applied to a communication architecture comprising at least one proxy node and multiple worker nodes. The proxy node needs to authenticate with the worker nodes; that is, authentication is required between the user and the proxy node, and between the proxy node and the worker nodes. Authentication between the proxy node and the worker nodes is equivalent to the proxy node acting as a proxy for the client to authenticate with the worker nodes; this is referred to as proxy authentication in this embodiment. This application is tailored to this architecture and specifically for MD5 authentication. The secure proxy authentication method of this application includes the following steps:

[0034] In step S301, the proxy node obtains the login request initiated by the user through the client and generates a first random value to return to the client. For example, when the client authenticates with the proxy node, such as... Figure 4 , Figure 5 The proxy node generates a first random value (called salt) and sends it to the client so that the client can calculate the password-related MD5 value (which is consistent with the one stored on the server when the user is created). Then, the client concatenates the obtained MD5 value with salt and performs an MD5 operation, and sends the final MD5 value to the proxy node.

[0035] In step S302, the client obtains a second MD5 value calculated based on the first random value and the first MD5 value related to the password, and the proxy node calculates a third MD5 value based on the stored first MD5 value related to the user's password and the first random value, and compares the second MD5 value and the third MD5 value to complete the authentication of the user by the proxy node.

[0036] Specifically, the proxy node retrieves the stored password's MD5 hash and salt, concatenates them, performs an MD5 hash, and compares the result with the MD5 hash sent by the client. If the results match, authentication succeeds; otherwise, authentication fails. The above steps describe the authentication process between the client and the proxy node. The following describes the proxy authentication process between the proxy node and the worker node.

[0037] In step S303, the proxy node initiates a proxy login request to the worker node, so that the worker node returns a second random value.

[0038] In step S304, the proxy node directly obtains the fourth MD5 value, and calculates the fifth MD5 value based on the fourth MD5 value and the second random value. The fourth MD5 value is stored by the proxy node when it initiates the creation of a login user with the worker node. In this application, the proxy node does not store the plaintext password during the user creation process, but instead calculates and saves the MD5 value, thus allowing the proxy node to directly obtain the fourth MD5 value.

[0039] In step S305, the fifth MD5 value is sent to the working node so that the working node can compare the fifth MD5 value with the sixth MD5 value to complete the authentication. The sixth MD5 value is calculated based on the seventh MD5 value and the second random value. The seventh MD5 value is stored by the working node when the proxy node initiates the creation of a login user.

[0040] In this application's architecture, the proxy node simultaneously acts as both the client and server for authentication. Between the client and the proxy node, the proxy node functions as the server; between the proxy node and the worker nodes, the proxy node acts as the client. In the authentication method of this application embodiment, the plaintext password is used to generate its MD5 value during client authentication. This MD5 value can be directly used for authentication with the server. It eliminates the need to store the user's plaintext password in the proxy node, thus resolving the security risks associated with the potential leakage of plaintext passwords in existing technologies.

[0041] In some embodiments, the client calculates a second MD5 value based on the first random value and a first MD5 value related to the password, including: concatenating the first random value and the first MD5 value related to the password, and calculating the concatenated MD5 value as the second MD5 value.

[0042] In some embodiments, the fourth MD5 value is calculated based on the plaintext password of the user being created when the proxy node initiates the creation of the login user to the worker node.

[0043] In some embodiments, such as Figure 6 As shown, the user creation process also includes the following:

[0044] A first user is created on the agent node based on user instructions, and a first MD5 value is calculated based on the password used to create the first user; and

[0045] The agent node creates a second user on the worker node and calculates a fourth MD5 value based on the password of the user who created the second user.

[0046] In some embodiments, if the password used by the agent node to create the second user is the same as the password used by the user to create the first user, the first MD5 value is the same as the fourth MD5 value, and the user's plaintext password is not stored.

[0047] If the password used by the agent node to create a second user is different from the password used by the user to create the first user, the agent node establishes a mapping relationship between the first and second users, but does not store the user's plaintext password.

[0048] In some embodiments, if the password used by the agent node to create the second user is different from the password used by the user to create the first user, the agent node directly obtains the fourth MD5 value based on the established mapping relationship.

[0049] like Figure 6 As shown, an exemplary proxy authentication process is as follows:

[0050] After the proxy node passes the normal MD5 authentication, it performs proxy authentication for the worker node.

[0051] Query the user mapping relationships recorded in the "Create User Mapping Process" and find the user "user name1" on the corresponding work node.

[0052] The proxy node sends a proxy login request to the worker node. This message is the same as a normal authentication message. The worker node generates a random value (called salt) and sends it to the proxy node.

[0053] The proxy node queries the MD5 value of the password recorded in the "Create User Mapping Process" and stores the MD5 value when creating the user. Then, it concatenates the obtained MD5 value with salt, performs an MD5 operation, and sends the final MD5 value to the worker node.

[0054] The worker node retrieves the stored password-related MD5 hash and salt, concatenates them, performs an MD5 hash operation, and compares the result with the MD5 hash sent by the client. If the comparison results match, authentication is successful; otherwise, authentication fails.

[0055] Compared to existing authentication methods, this application's proxy authentication directly obtains the MD5 hash of the user created during the "User Mapping Creation Process." The MD5 hash of the user created during this process is calculated from the plaintext password. The proxy node acts as a server-side client in the "User Mapping Creation Process." Considering the characteristics of the proxy node, the applicant chooses to store the MD5 hash of the user's password, directly using this MD5 hash for authentication with the worker node, thus avoiding the storage of the user's plaintext password. This application's method eliminates the need to store the user's plaintext password, avoiding the risk of plaintext password leakage and ensuring system security and user privacy.

[0056] This application also proposes a database system, which includes a communication architecture comprising at least one proxy node and multiple worker nodes. The database system includes a processor and a memory, and the memory stores a computer program. When the computer program is executed by the processor, it implements the steps of the aforementioned secure proxy authentication method.

[0057] This application also proposes a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the aforementioned security proxy authentication method.

[0058] It should be noted that, in the embodiments of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0059] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0060] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0061] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims. All of these forms are within the protection scope of this application.

Claims

1. A secure proxy authentication method, applied in a communication architecture comprising at least one proxy node and multiple worker nodes, wherein the proxy node needs to authenticate with the worker nodes, characterized in that, The security agent authentication method includes the following steps: The proxy node obtains the login request initiated by the user through the client and generates a first random value to return to the client; The client obtains a second MD5 value calculated based on the first random value and a first MD5 value related to the password. The proxy node calculates a third MD5 value based on the stored first MD5 value related to the user's password and the first random value, and compares the second MD5 value with the third MD5 value to complete the authentication of the user by the proxy node. The proxy node initiates a proxy login request to the worker node, so that the worker node returns a second random value; The proxy node directly obtains the fourth MD5 value, and calculates the fifth MD5 value based on the fourth MD5 value and the second random value, wherein the fourth MD5 value is stored when the proxy node initiates the creation of a login user to the worker node; The fifth MD5 value is sent to the worker node so that the worker node can compare the fifth MD5 value with the sixth MD5 value to complete the authentication. The sixth MD5 value is calculated based on the seventh MD5 value and the second random value. The seventh MD5 value is stored by the worker node when the proxy node initiates the creation of a login user.

2. The secure proxy authentication method as described in claim 1, characterized in that, The client calculates a second MD5 value based on the first random value and the first MD5 value related to the password, including: concatenating the first random value and the first MD5 value related to the password, and calculating the concatenated MD5 value as the second MD5 value.

3. The secure proxy authentication method as described in claim 1, characterized in that, The fourth MD5 value is calculated based on the plaintext password of the user being created when the proxy node initiates the creation of the login user to the worker node.

4. The secure proxy authentication method as described in claim 3, characterized in that, This also includes the following user creation process: A first user is created on the agent node based on user instructions, and a first MD5 value is calculated based on the password used to create the first user; and The agent node creates a second user on the worker node and calculates a fourth MD5 value based on the password of the user who created the second user.

5. The secure proxy authentication method as described in claim 4, characterized in that, If the password used by the agent node to create a second user is the same as the password used by the user to create the first user, the first MD5 value of the agent node is the same as the fourth MD5 value, and the user's plaintext password is not stored. If the password used by the agent node to create a second user is different from the password used by the user to create the first user, the agent node establishes a mapping relationship between the first and second users, but does not store the user's plaintext password.

6. The secure proxy authentication method as described in claim 5, characterized in that, When the password used by the agent node to create the second user is different from the password used by the user to create the first user, the agent node directly obtains the fourth MD5 value based on the established mapping relationship.

7. A database system, characterized in that, The communication architecture includes at least one proxy node and multiple worker nodes. The database system includes a processor and a memory. The memory stores a computer program, which, when executed by the processor, implements the steps of the secure proxy authentication method as described in any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the security proxy authentication method as described in any one of claims 1 to 6.

Images