A method and apparatus for database permission management

Abstract

The application discloses a database permission management method and device, and relates to the technical field of computers. A specific implementation of the method comprises the following steps: in response to receiving an access request sent by a client, obtaining a database identifier, a permission identifier and client information from the access request; checking the access request according to the client information, the database identifier and the permission identifier; and in the case of passing the check, forwarding the access request to a database corresponding to the database identifier. The implementation can realize permission control on different types of databases, realize unified management of database permissions, and realize fine-grained permission control, thereby improving the convenience of permission maintenance.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and in particular to a database permission management method and device. BACKGROUND

[0002] An application program can access data in a database by sending an access request to the database. Existing database software such as mysql, mango, etc. requires a database administrator to use a command to authorize an application program accessing the database, for example, MySQL requires using a grand command to authorize, and Mongo uses a db.createUser command to authorize a role.

[0003] However, the above-mentioned method requires the data administrator to have the operation and maintenance capability of different databases, and since there is no unified permission management platform, the maintenance convenience of each database is poor, and some databases cannot authorize specific commands, and cannot perform fine-grained permission control. SUMMARY

[0004] Therefore, the embodiments of the present application provide a database permission management method and device, which can perform permission control on different types of databases by verifying and forwarding an access request, implement unified management of database permissions, and achieve fine-grained permission control, thereby improving the convenience of permission maintenance.

[0005] To achieve the above-mentioned purpose, according to an aspect of an embodiment of the present application, a database permission management method is provided, comprising:

[0006] In response to receiving an access request sent by a client, obtaining a database identifier, a permission identifier and client information from the access request;

[0007] Verifying the access request according to the client information, the database identifier and the permission identifier;

[0008] If the verification is passed, forwarding the access request to a database corresponding to the database identifier.

[0009] Optionally, verifying the access request according to the client information, the database identifier and the permission identifier comprises:

[0010] Obtaining a permission rule, the permission rule comprising a corresponding relationship between client information, a database identifier and a permission identifier;

[0011] Obtaining a target database identifier and a target permission identifier corresponding to the client information in the access request from the permission rule;

[0012] According to the database identifier and the target permission identifier, the database identifier and the permission identifier in the access request are verified.

[0013] Optionally, before verifying the access request according to the client information, the database identifier and the permission identifier, the method further comprises:

[0014] The permission rule is sent by the gateway server, and the permission rule is sent to the gateway server after being configured by a gateway console.

[0015] Optionally, the client information in the access request comprises account information, and the client sends a login request to the gateway server before sending the access request, and the account information is verified by the gateway server and verified successfully.

[0016] Optionally, the permission rule further comprises a proxy port, the client information comprises client IP information, the database identifier comprises data source IP and data source port, and after receiving the permission rule sent by the gateway server, the method further comprises:

[0017] According to the permission rule, a mapping relationship between the client IP information and the proxy port and the data source IP and the data source port is generated, so that the access request is forwarded according to the mapping relationship.

[0018] Optionally, the access request indicates the proxy port, and forwarding the access request to the database corresponding to the database identifier comprises:

[0019] According to the client information and the proxy port, the data source IP and the data source port are determined.

[0020] According to the data source IP and the data source port, the access request is forwarded to the database.

[0021] Optionally, the method further comprises:

[0022] Listening to the number of access requests sent by the client within a preset time;

[0023] In a case where the number of access requests reaches a preset threshold, the access request is refused to be forwarded.

[0024] According to another aspect of the embodiment of the application, a database permission management device is provided, comprising:

[0025] An acquisition module acquires a database identifier, a permission identifier and client information from an access request sent by a client in response to receiving the access request.

[0026] a checking module configured to check the access request according to the client information, the database identifier, and the permission identifier;

[0027] a sending module configured to forward the access request to a database corresponding to the database identifier if the checking is passed.

[0028] According to another aspect of the embodiments of the present application, an electronic device is provided, comprising:

[0029] one or more processors;

[0030] a storage configured to store one or more programs,

[0031] When the one or more programs are executed by the one or more processors, the one or more processors implement the method for database permission management provided by the present application.

[0032] According to still another aspect of the embodiments of the present application, a computer readable medium is provided, which stores a computer program, and the program is executed by a processor to implement the method for database permission management provided by the present application.

[0033] The method for database permission management provided by the embodiments of the present application has the following advantages or beneficial effects: After receiving an access request sent by a client, the database identifier, the permission identifier, and the client information are obtained from the access request, the access request is checked according to the database identifier, the permission identifier, and the client information, and the access request is forwarded to a corresponding database if the checking is passed. The method controls the permission of database connection by forwarding the access request, realizes the unified permission management of different types of databases, and can realize fine-grained permission control, so that the permission maintenance is more convenient, and the problem that the operation and maintenance personnel need to be familiar with the authorization instructions of multiple data sources and the permission maintenance is difficult in the related art is solved.

[0034] The further effects of the above-mentioned non-conventional optional mode will be described in the following combined with the specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0035] The accompanying drawings are used to better understand the present application, and do not constitute an improper limitation on the present application. Among them:

[0036] Figure 1 is a schematic diagram of the main process of a method for database permission management according to an embodiment of the present application;

[0037] Figure 2 is a schematic diagram of the main process of another method for database permission management according to an embodiment of the present application;

[0038] Figure 3is a schematic diagram of the main flow of another method of database permission management according to an embodiment of the present application;

[0039] Figure 4 is a schematic diagram of the main modules of an apparatus of database permission management according to an embodiment of the present application;

[0040] Figure 5 is an exemplary system architecture diagram to which embodiments of the present application can be applied;

[0041] Figure 6 is a structural schematic diagram of a computer system of a terminal device or a server suitable for implementing embodiments of the present application. DETAILED DESCRIPTION

[0042] Exemplary embodiments of the present application are described below with reference to the accompanying drawings, which include various details of the embodiments of the present application to assist in understanding, and should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. Also, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0043] Figure 1 is a schematic diagram of the main flow of a method of database permission management according to an embodiment of the present application, as shown in Figure 1 the method of database permission management includes the following steps:

[0044] Step S101: In response to receiving an access request sent by a client, obtaining a database identifier, a permission identifier and client information from the access request;

[0045] Step S102: Verifying the access request according to the client information, the database identifier and the permission identifier;

[0046] Step S103: If the verification is passed, forwarding the access request to a database corresponding to the database identifier.

[0047] In embodiments of the present application, the method of database permission management can be used to verify access requests sent to a database, so as to implement permission management of database access. The database can be any type of database, such as mysql, mango, oracle, etc. The execution subject of the method of database permission management can be a proxy server, such as Nginx (a high-performance HTTP and reverse proxy web server) or other self-developed proxy servers.

[0048] In the embodiment of the present application, after receiving the access request sent by the client, the access request is parsed, the access request includes a data packet, the database identifier, the permission identifier and the client information are obtained by parsing the data packet, that is, the access request indicates the database, that is, the data source, the client information and the permission to be executed to be accessed, the database identifier can include the ID of the database, and can also include the data source address such as the data source IP and the data source port, the client information can include the client identifier and the client IP, and the permission identifier is the access permission to the database corresponding to the database identifier, for example, the database is mysql, the permission identifier can be the identifier indicating the select read operation, the insert, update and delete write operation, the alter table structure modification command and the like; for example, the database is mongo, the permission identifier can be the identifier indicating the find, findOne, group, remove, save and the like, that is, the permission identifier can indicate the identifier of the fine-grained permission in different databases.

[0049] In the embodiment of the present application, as shown in Figure 2 The access request is verified according to the client information, the database identifier and the permission identifier, including:

[0050] Step S201: Obtain the permission rule, the permission rule includes the corresponding relationship between the client information, the database identifier and the permission identifier;

[0051] Step S202: Obtain the target database identifier and the target permission identifier corresponding to the client information in the access request from the permission rule;

[0052] Step S203: Verify the database identifier and the permission identifier in the access request according to the database identifier and the target permission identifier.

[0053] In the embodiment of the present application, after obtaining the database identifier, the permission identifier and the client information, the access request is verified to determine whether to forward or intercept the access request, if the verification is passed, the access request is forwarded to the database corresponding to the database identifier, if the verification is not passed, the access request is rejected, that is, the access request is intercepted, and the prompt information of no permission access is returned to the client.

[0054] In the embodiment of the present application, the access request can be verified according to the permission rule. First, the permission rule is acquired, which can be acquired from the storage module of the proxy server. The permission rule includes the correspondence between the client information, the database identifier and the permission identifier, that is, the permission rule indicates the client that can execute a command or some commands on a certain database. For the client information acquired in the access request, the target database identifier and the target permission identifier corresponding to the client information are acquired from the permission rule. It is judged whether the database identifier in the access request is the target database identifier or one of the target database identifiers. If yes, it is judged whether the permission identifier in the access request is the target permission identifier or one of the target permission identifiers. If yes, the verification is passed, and the forwarding of the access request can be executed.

[0055] If the target database identifier corresponding to the client information cannot be acquired from the permission rule, it indicates that the client does not have access permission, and the verification is not passed. If the database identifier in the access request is different from the target database identifier or is not any one of the target database identifiers, the verification is not passed. If the database identifier in the access request is the same as or one of the target database identifiers, and the permission identifier in the access request is different from or not any one of the target permission identifiers, the verification is not passed, and the access request is intercepted. The permission rule can realize the unified permission verification of the access request of any type of database, and realize the unified control and management of the permission.

[0056] In the embodiment of the present application, before the access request is verified according to the client information, the database identifier and the permission identifier, the permission rule configured by the gateway console and sent to the gateway server is received. That is, the permission rule is configured by the gateway console, and then sent to the gateway server. After the gateway server receives the permission rule configured by the gateway console, the permission rule is sent to the proxy server, so that the proxy server verifies the access request according to the permission rule.

[0057] In the embodiment of the present application, the client information in the access request includes account information. Before the access request is sent, the client sends a login request to the gateway server, and the account information is verified by the gateway server and passed. That is, the client sends a login request or a registration request to the gateway server, and reports the account information to the gateway server, so that the gateway server verifies or authenticates the account information. After the verification is passed, the client can send an access request to the proxy server.

[0058] In the embodiment of the present application, the permission rule further comprises a proxy port, the client information comprises client IP information, the database identifier comprises a data source IP and a data source port, and after receiving the permission rule sent by the gateway server, the method further comprises: generating a mapping relationship between the client IP information and the proxy port and the data source IP and the data source port according to the permission rule, so as to forward the access request according to the mapping relationship.

[0059] In the embodiment of the present application, the gateway console configures the permission rule, the permission rule comprises a corresponding relationship among the client information, the database identifier and the permission identifier, the client information comprises account information, and can further comprise client IP information, that is, the gateway console configures the database that can be accessed by the client IP or the account information and the command permission possessed by the client IP or the account information. The permission rule further comprises a proxy port, that is, after the gateway server verifies the account information of the client, the client can send an access request to the proxy port of the proxy server. After receiving the permission rule, the proxy server can generate a mapping relationship between the client IP information and the proxy port and the data source IP and the data source port, that is, the mapping of client IP:proxy port→data source IP:data source port. The proxy port can be randomly generated by the gateway server.

[0060] In the embodiment of the present application, the access request indicates the proxy port, as shown in Figure 3 The method of forwarding the access request to the database corresponding to the database identifier comprises:

[0061] Step S301: determining the data source IP and the data source port according to the client information and the proxy port;

[0062] Step S302: forwarding the access request to the database according to the data source IP and the data source port.

[0063] In the embodiment of the present application, after generating the mapping relationship between the client IP information and the proxy port and the data source IP and the data source port, the data source IP and the data source port can be determined according to the client IP information and the proxy port, it can be judged whether the data source IP and the data source port are same as the database identifier in the access request, if yes, the verification is passed, and the access request can be forwarded to the corresponding database according to the data source IP and the data source port, so as to execute the operation command.

[0064] In the embodiment of the present application, the method for database permission management can further include: listening to the number of access requests sent by the client within a preset time; and in the case that the number of access requests reaches a preset threshold, the access request is rejected. That is, by listening to the access request sent by the client, the number of access requests executed within a preset time is counted, and when the number of access requests within the preset time reaches the preset threshold, the access request is rejected, the flow is controlled, the pressure of the database is reduced, and the stability of the database is ensured.

[0065] In the embodiment of the present application, the method for database permission management can further include: for each access request, recording the database identifier and the permission identifier corresponding to the access request, counting the number of access requests executed within a preset time, and also counting the response time of each access request, and for each database identifier and permission identifier, calculating the QPS (Queries Per Second) of each access request, thereby realizing the statistics of user operation.

[0066] The method for database permission management in the embodiment of the present application, after receiving the access request sent by the client, obtains the database identifier, the permission identifier and the client information from the access request, checks the access request according to the database identifier, the permission identifier and the client information, and forwards the access request to the corresponding database if the checking is passed. The method realizes the unified permission management of different types of databases by forwarding the access request for the permission control of database connection, and can realize fine-grained permission control, and the permission maintenance is more convenient, thereby solving the problem that the operation and maintenance personnel need to be familiar with the authorization instructions of multiple data sources and the permission maintenance is difficult in the related art.

[0067] According to still another aspect of the embodiments of the present application, as shown in Figure 4 A device 400 for database permission management is provided, which includes:

[0068] The obtaining module 401 obtains the database identifier, the permission identifier and the client information from the access request in response to receiving the access request sent by the client;

[0069] The checking module 402 checks the access request according to the client information, the database identifier and the permission identifier;

[0070] The sending module 403 forwards the access request to the database corresponding to the database identifier if the checking is passed.

[0071] In the embodiment of the present application, the checking module 402 is further configured to: obtain a permission rule, the permission rule comprising a correspondence between the client information, the database identifier and the permission identifier; obtain the target database identifier and the target permission identifier corresponding to the client information in the access request from the permission rule; and check the database identifier and the permission identifier in the access request according to the database identifier and the target permission identifier.

[0072] In the embodiment of the present application, the checking module 402 is further configured to: receive the permission rule sent by the gateway server before checking the access request according to the client information, the database identifier and the permission identifier, wherein the permission rule is sent to the gateway server after being configured by the gateway console.

[0073] In the embodiment of the present application, the client information in the access request comprises account information, and the client sends a login request to the gateway server before sending the access request, wherein the account information is checked by the gateway server and passes the check.

[0074] In the embodiment of the present application, the permission rule further comprises a proxy port, the client information comprises client IP information, and the database identifier comprises a data source IP and a data source port, and the checking module 402 is further configured to: generate a mapping relationship between the client IP information and the proxy port and the data source IP and the data source port according to the permission rule after receiving the permission rule sent by the gateway server, so as to forward the access request according to the mapping relationship.

[0075] In the embodiment of the present application, the access request indicates the proxy port, and the sending module 403 is further configured to: determine the data source IP and the data source port according to the client information and the proxy port; and forward the access request to the database according to the data source IP and the data source port.

[0076] In the embodiment of the present application, the database permission management apparatus further comprises a counting module configured to: listen to the number of access requests sent by the client within a preset time; and refuse to forward the access request in the case that the number of access requests reaches a preset threshold.

[0077] According to another aspect of the embodiment of the present application, an electronic device is provided, comprising: one or more processors; a storage device configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the database permission management method provided by the present application.

[0078] According to still another aspect of the embodiment of the present application, a computer readable medium is provided, and the computer readable medium stores a computer program, when the computer program is executed by a processor, the database permission management method provided by the present application is implemented.

[0079] Figure 5An exemplary system architecture 500 in which the method for database permission management or the apparatus for database permission management of embodiments of the present application can be applied is shown.

[0080] As shown in Figure 5 The system architecture 500 can include terminal devices 501, 502, 503, a network 504 and a server 505. The network 504 is a medium for providing a communication link between the terminal devices 501, 502, 503 and the server 505. The network 504 can include various connection types, such as wired, wireless communication links or fiber optic cables, etc.

[0081] The users can use the terminal devices 501, 502, 503 to interact with the server 505 through the network 504 to receive or send messages, etc. Various communication client applications can be installed on the terminal devices 501, 502, 503, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0082] The terminal devices 501, 502, 503 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers and desktop computers, etc.

[0083] The server 505 can be a server providing various services, such as a background management server providing support for shopping websites browsed by users using the terminal devices 501, 502, 503 (only as an example). The background management server can analyze and process received product information query requests and other data, and feed back the processing results (such as target push information, product information - only as examples) to the terminal devices.

[0084] It should be noted that the method for database permission management provided by embodiments of the present application is generally executed by the server 505, and accordingly, the apparatus for database permission management is generally provided in the server 505.

[0085] It should be understood that Figure 5 The number of terminal devices, networks and servers in

[0086] Reference is made below to Figure 6 which shows a structural schematic diagram of a computer system 600 of a terminal device suitable for use to implement embodiments of the present application. Figure 6 The terminal device shown is only an example and should not bring any limitation to the functions and use range of embodiments of the present application.

[0087] As shown in Figure 6As shown, the computer system 600 includes a central processing unit (CPU) 601 which can perform various appropriate actions and processes according to programs stored in a read only memory (ROM) 602 or loaded into a random access memory (RAM) 603 from a storage section 608. In the RAM 603, various programs and data required for the operation of the system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0088] Connected to the I / O interface 605 are an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a display device such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as necessary. A removable recording medium 611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 610 as necessary, so that a computer program read therefrom is installed into the storage section 608 as necessary.

[0089] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program comprising program code for performing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable recording medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-described functions defined in the system of the present disclosure are performed.

[0090] It should be noted that the computer-readable medium shown in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or component, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or component. In the present application, the computer-readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, which carries computer-readable program code. Such a propagated data signal can take various forms, including but not limited to an electromagnetic signal, an optical signal or any suitable combination of the above. The computer-readable signal medium can also be any computer-readable medium other than the computer-readable storage medium, which can send, propagate or transmit a program for use by or in conjunction with an instruction execution system, device or component. The program code contained on the computer-readable medium can be transmitted by any suitable medium, including but not limited to wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0091] The flowcharts and block diagrams in the drawings illustrate the possible implementation architectures, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a program segment or a part of code containing one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different order than that shown in the drawings. For example, two blocks that are shown in succession can actually be executed substantially in parallel, and sometimes in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams or flowcharts, and the combination of blocks in the block diagrams or flowcharts, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0092] The modules described in the embodiments of the present application can be implemented in the form of software or in the form of hardware. The described modules can also be arranged in a processor, for example, a processor can be described as including an acquisition module, a verification module and a sending module. In some cases, the names of these modules do not constitute a limitation on the modules themselves, for example, the acquisition module can also be described as "a module that acquires the database identifier, the permission identifier and the client information from the access request in response to receiving the access request sent by the client".

[0093] As another aspect, the present application also provides a computer readable medium, which can be included in the device described in the above embodiments, or can exist independently without being assembled into the device. The computer readable medium carries one or more programs, which, when executed by the device, cause the device to include: acquiring the database identifier, the permission identifier and the client information from the access request in response to receiving the access request sent by the client; verifying the access request according to the client information, the database identifier and the permission identifier; and forwarding the access request to the database corresponding to the database identifier in the case of passing the verification.

[0094] According to the technical scheme of the embodiments of the present application, the database permission management method, after receiving the access request sent by the client, acquires the database identifier, the permission identifier and the client information from the access request, verifies the access request according to the database identifier, the permission identifier and the client information, and forwards the access request to the corresponding database in the case of passing the verification. The method realizes unified permission management of different types of databases by forwarding the access request for permission control of database connection, can realize fine-grained permission control, and is more convenient for permission maintenance, and solves the problem of difficulty in permission maintenance for operation and maintenance personnel who need to be familiar with authorization instructions of multiple data sources in the related art.

[0095] The above specific embodiments do not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made depending on design requirements and other factors. Any modification, equivalent replacement and improvement made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A method of database rights management, characterized by, The application is applied to a proxy server, and comprises: In response to receiving an access request sent by a client from a proxy port, database identification, permission identification, client information, and the proxy port are obtained from the access request; the permission identification is an identification of an access permission for a database type corresponding to the database identification, the client information includes client IP information, and the database identification includes a data source IP and a data source port; The access request is verified according to the client information, the database identification, and the permission identification, including: obtaining a permission rule, the permission rule including a corresponding relationship among the client information, the database identification, and the permission identification and the proxy port; wherein the proxy port is randomly generated by a gateway server; target database identification and target permission identification corresponding to the client information in the access request are obtained from the permission rule; and the database identification and the target permission identification are used to verify the database identification and the permission identification in the access request; In the case of passing the verification, the access request is forwarded to a database corresponding to the database identification according to the proxy port and the permission rule, including: determining a data source IP and a data source port according to the client information and the proxy port; determining whether the data source IP and the data source port are the same as the database identification in the access request, and if so, forwarding the access request to the database according to the data source IP and the data source port; Before verifying the access request according to the client information, the database identification, and the permission identification, the method further comprises: receiving the permission rule sent by the gateway server, the permission rule being sent to the gateway server after being configured by a gateway console; and generating a mapping relationship between client IP information and a proxy port and a data source IP and a data source port according to the permission rule, so as to forward the access request according to the mapping relationship.

2. The method of claim 1, wherein, The client information in the access request includes account information, and the client sends a login request to the gateway server before sending the access request, and the account information is verified by the gateway server and passes the verification.

3. The method of claim 1, wherein, The method further comprises: Listening to the number of access requests sent by the client within a preset time; In the case that the number of access requests reaches a preset threshold, the access request is refused to be forwarded.

4. An apparatus for database privilege management, the apparatus comprising: The application is applied to a proxy server, and comprises: An obtaining module obtains database identification, permission identification, client information, and a proxy port from an access request sent by a client in response to receiving the access request from a proxy port; the permission identification is an identification of an access permission for a database type corresponding to the database identification, the client information includes client IP information, and the database identification includes a data source IP and a data source port; A verification module verifies the access request according to the client information, the database identification, and the permission identification. The sending module forwards the access request to a database corresponding to the database identifier according to the proxy port and the permission rule in the case of passing the checking, and includes: determining a data source IP and a data source port according to the client information and the proxy port; judging whether the data source IP and the data source port are same as the database identifier in the access request, if yes, forwarding the access request to the database according to the data source IP and the data source port; The checking module is further used for: receiving the permission rule sent by the gateway server, the permission rule being sent to the gateway server after being configured by a gateway console; generating a mapping relationship between client IP information and a proxy port and a data source IP and a data source port according to the permission rule, so as to forward the access request according to the mapping relationship; obtaining a permission rule, the permission rule including a corresponding relationship among client information, a database identifier and a permission identifier and a proxy port; wherein the proxy port is randomly generated by the gateway server; obtaining a target database identifier and a target permission identifier corresponding to the client information in the access request from the permission rule; checking the database identifier and the permission identifier in the access request according to the database identifier and the target permission identifier.

5. An electronic device, comprising: comprising: one or more processors; a memory device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method of any one of claims 1-3.

6. A computer readable medium having stored thereon a computer program, characterized in that The program is executed by the processor to implement the method of any one of claims 1-3.

Images