Method and management method for accessing business database

Abstract

The application discloses a business database access method and management and control method, and belongs to the field of data security. The method comprises the following steps: a client obtains channel configuration information of a target database through a bastion host, wherein the channel configuration information comprises channel address information between the bastion host and the target database; the client sends a first access request to the bastion host based on the channel address information, wherein the first access request carries the channel address information and an access condition; and the client receives an access result meeting the access condition, which is obtained by the bastion host from the target database based on the channel address information.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of data security, and particularly relates to a business database access method and a control method. BACKGROUND

[0002] Currently, in the application program in the field of mobile communication, application developers and testers deploy related application services for accessing target databases on local computers or personal servers to develop and test business functions. Among them, the operation content is recorded and audited afterwards mainly through the ways of starting database audit, traffic audit and business system log.

[0003] However, in the prior art, the application program directly connects the target database through the jdbc (Java Database Connectivity) / odbc (Open Database Connectivity) mode, which causes the security of the database to be not guaranteed. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a business database access method and a control method, which can solve the problem that the security of the database is not guaranteed.

[0005] In a first aspect, the embodiments of the present application provide a business database access method, which comprises: a client obtaining channel configuration information of a target database through a bastion host, wherein the channel configuration information comprises channel address information between the bastion host and the target database; the client sending a first access request to the bastion host based on the channel address information, wherein the first access request carries the channel address information and access conditions; and the client receiving an access result meeting the access conditions obtained by the bastion host from the target database based on the channel address information.

[0006] In a second aspect, the embodiments of the present application provide a business database control method, which comprises: a bastion host sending channel configuration information of a target database to a client, wherein the channel configuration information comprises channel address information between the bastion host and the target database; the bastion host receiving a first access request sent by the client, wherein the first access request carries the channel address information and access conditions; the bastion host sending a query command corresponding to the access conditions to the target database based on the channel address information; the bastion host receiving a query result returned by the target database; and the bastion host returning an access result to the client based on the query result.

[0007] In a third aspect, an embodiment of the present application provides a service database access system, which comprises: a client configured to perform the steps of the method according to the first aspect; and a bastion host configured to perform the steps of the method according to the second aspect.

[0008] In a fourth aspect, an embodiment of the present application provides a service database access apparatus, which comprises: an acquisition module configured to acquire, by a bastion host, channel configuration information of a target database, wherein the channel configuration information comprises channel address information between the bastion host and the target database; a sending module configured to send, to the bastion host, a first access request based on the channel address information, wherein the first access request carries the channel address information and an access condition; and a receiving module configured to receive an access result that satisfies the access condition and is acquired by the bastion host from the target database based on the channel address information.

[0009] In a fifth aspect, an embodiment of the present application provides a service database management and control apparatus, which comprises: a first sending module configured to send, to a client, channel configuration information of a target database, wherein the channel configuration information comprises channel address information between a bastion host and the target database; a first receiving module configured to receive a first access request sent by the client, wherein the first access request carries the channel address information and an access condition; a second sending module configured to send, to the target database, a query command corresponding to the access condition based on the channel address information; a second receiving module configured to receive a query result returned by the target database; and a returning module configured to return, to the client, an access result based on the query result.

[0010] In a sixth aspect, an embodiment of the present application provides an electronic device, which comprises a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and the programs or instructions are executed by the processor to implement the steps of the method according to the first aspect or the steps of the method according to the second aspect.

[0011] In a seventh aspect, an embodiment of the present application provides a readable storage medium, which stores programs or instructions, and the programs or instructions are executed by a processor to implement the steps of the method according to the first aspect or the steps of the method according to the second aspect.

[0012] In an eighth aspect, an embodiment of the present application provides a chip, which comprises a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is configured to run programs or instructions to implement the method according to the first aspect or the steps of the method according to the second aspect.

[0013] In a ninth aspect, an embodiment of the present application provides a computer program product stored in a storage medium, which is executed by at least one processor to implement the method in the first aspect, or implement the steps of the method in the second aspect.

[0014] In the embodiment of the present application, the client can obtain the channel configuration information of the target database through the bastion host, then send an access request carrying the channel configuration information and the access condition to the bastion host according to the channel configuration information, and finally receive the access result satisfying the access condition obtained by the bastion host from the target database. In the access method of the business database provided by the embodiment of the present application, the client obtains the channel configuration information of the target database through the bastion host, which can enable the client to dynamically obtain the information of the target database, and the client indirectly accesses the target database through the bastion host, thereby avoiding the problem that the security of the database cannot be guaranteed when the client directly accesses the database, and guaranteeing the security of the database. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 is a flowchart of an access method of a business database provided by an example embodiment of the present application;

[0016] Figure 2a is a schematic diagram of a target database directly accessed by an application program provided by an example embodiment of the present application;

[0017] Figure 2b is a schematic diagram of a target database dynamically connected by an application program provided by an example embodiment of the present application;

[0018] Figure 3 is a flowchart of a management and control method of a business database provided by an example embodiment of the present application;

[0019] Figure 4 is a flowchart of another management and control method of a business database provided by an example embodiment of the present application;

[0020] Figure 5 is a structural schematic diagram of an access system of a business database provided by an example embodiment of the present application;

[0021] Figure 6 is a structural schematic diagram of an access device of a business database provided by an example embodiment of the present application;

[0022] Figure 7 is a structural schematic diagram of a management and control device of a business database provided by an example embodiment of the present application;

[0023] Figure 8 is a schematic diagram of a target database accessed by an application program provided by an example embodiment of the present application;

[0024] Figure 9a FIG. 1 is a schematic diagram of a configuration database connection management process according to an example embodiment of the present application;

[0025] Figure 9b FIG. 2 is a schematic diagram of an application program dynamically obtaining a target database access channel process according to an example embodiment of the present application;

[0026] Figure 9c FIG. 3 is a schematic diagram of an application program dynamic access process according to an example embodiment of the present application;

[0027] Figure 10 FIG. 4 is a structural block diagram of an electronic device according to an example embodiment of the present application;

[0028] Figure 11 FIG. 5 is a structural block diagram of a computer device according to an example embodiment of the present application. DETAILED DESCRIPTION

[0029] The technical solutions in the embodiments of the present application will be clearly described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art belong to the scope of protection of the present application.

[0030] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than that illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of a kind and are not limited in number, for example, the first object can be one or more. In addition, "and / or" in the specification and claims indicates at least one of the connected objects, and the character " / ", generally indicates that the objects before and after are in an "or" relationship.

[0031] In the prior art, the developers and testers of an application program usually deploy relevant application services on a local computer or a personal server, so as to develop and test business functions. These services usually need to access a target database, and the target database often contains some sensitive data due to the need for business scenario testing. Figure 2a As shown, when the application program directly accesses the target database, the operation content is recorded and audited afterwards mainly by starting business operation logs, database audit logs and traffic audit. The process is as follows:

[0032] Step 1, the application program starts communication by establishing an access connection with the target database through jdbc / odbc, and the connection configuration information of the target database is usually in the configuration file of the application program.

[0033] Step 2, in order to realize the audit of operation, one is to start the audit function on the database; the other is to take the flow audit mode, deploy the flow audit device of the database, and audit the database access through the bypass mirror mode.

[0034] The current technical solution can only be used for post-operation audit in the case of direct access of the application program to the target database, and cannot be controlled and audited in the mode of dynamic connection of the application program to the target database, which is extremely dangerous to the user data stored in the database. The existing control technology of the application program connecting the database mainly has the following defects:

[0035] (1) Audit log cannot be traced back to the person: the application program accesses the target database by using a production account (non-personal account), and after data leakage, it is difficult to trace back to the specific leakage position by relying on the log record of the front-end system and the database level log.

[0036] (2) Large performance consumption of audit mode: when the application program accesses the database for audit, the database starts audit, which greatly increases the system load, which is difficult in a telecom-level system. When taking the flow audit mode, due to the limited performance of a single audit device, multiple devices are needed to load, which is high in cost.

[0037] (3) Risk of database account password leakage: the application program accesses the database, and the account password is saved in the configuration file, which has the risk of being obtained and leaked by the development and operation personnel.

[0038] (4) Control scene support defects: the application program directly accesses the target database through jdbc / odbc, and cannot realize the use mode of the application program dynamically obtaining the final target database by querying the configuration database as shown in Figure 2b , or needs to be reformed in a large range, which is low in control efficiency and large in code reformation amount.

[0039] The access method and control method of the business database provided by the embodiments of the present application will be described in detail in combination with the accompanying drawings and specific embodiments and application scenarios.

[0040] Figure 1 An access method of a business database provided by an example embodiment of the present application is shown, the method 100 can be executed by an electronic device, which can be a mobile phone, a computer, or other terminal device, and the specific embodiments of the present application are not limited. As shown in Figure 1 , the method mainly includes the following steps:

[0041] S101: The client obtains the channel configuration information of the target database through the bastion host.

[0042] The channel configuration information includes the channel address information between the bastion host and the target database. In this embodiment, the client does not directly access the target database, but first obtains the channel configuration information of the target database through the bastion host. The channel configuration information obtained by the client includes the channel address information between the bastion host and the target database, which can be a specific channel IP address and port number. That is to say, in this embodiment, the client does not obtain the address information of the target database from the bastion host, but rather the address information of the channel through which the bastion host accesses the target database.

[0043] In one alternative implementation, the client obtaining the channel configuration information of the target database through the bastion host may include the following steps:

[0044] Step 1: The client sends a second access request to the bastion host, wherein the second access request is used to request channel configuration information corresponding to the target database, and the second access request carries the identification information of the target database.

[0045] Step 2: The client receives the query results returned by the bastion host, wherein the query results include the channel configuration information of the target database.

[0046] In the above implementation, when the client obtains the channel configuration information of the target database through the bastion host, it can first send a second access request to the bastion host, which carries the target database identifier and is dedicated to requesting the channel configuration information corresponding to the target database. Then, it can receive the query result returned by the bastion host containing the channel configuration information of the target database. Thus, it can request the corresponding channel configuration information from the bastion host according to the target database that needs to be accessed.

[0047] Optionally, the channel configuration information may further include the client's account information and password information. The channel configuration information of the target database obtained by the client includes the client's account information and password information, thereby allowing the client's connection to the target database to be traced back to the individual, facilitating tracking and recording, and reducing the risk of data leakage. Furthermore, this account information and password information are configured by the bastion host, ensuring that the client user cannot obtain this information, preventing leakage of account and password information, and further guaranteeing database security.

[0048] S102: The client sends a first access request to the bastion host based on the channel address information.

[0049] The first access request carries the channel address information and the access condition. The client sends the first access request to the bastion host by obtaining the channel address information between the bastion host and the target database in the channel configuration information of the target database. The first access request sent by the client carries the channel address information and the access condition. The channel address information is the channel address information between the bastion host and the target database, and the access condition can be a query condition of data that the user needs to obtain from the target database. For example, if the target database stores a field of “date of birth”, the access condition can be all personnel with the date of birth after 2000.

[0050] Optionally, in the case that the channel configuration information further includes the account information of the client and the password information of the client, the first access request can further include the account information of the client and the password information of the client, so that the bastion host can know the account for accessing the target database. In addition, in the subsequent audit process, the specific operator can be located, which is convenient for recording and tracing.

[0051] S103: The client receives an access result that satisfies the access condition and is obtained by the bastion host from the target database based on the channel address information.

[0052] In the specific implementation, after sending the first access request, the client can receive an access result that satisfies the access condition and is obtained by the bastion host from the target database based on the channel address information. For example, for the first access request with the access condition of all personnel with the date of birth after 2000, the returned access result can be a name list, and the personnel on the list are personnel with the date of birth after 2000 stored in the target database.

[0053] Optionally, in actual application, the target database can have some sensitive data, such as data related to user safety or commercial sensitivity. The result obtained from the target database can be processed according to the sensitive data, and therefore, the access result returned by the bastion host can also be data after desensitization processing. For example, the target database can store information such as the name, date of birth, and ID number of personnel. Since the ID number is sensitive data, the bastion host can delete the ID numbers of personnel born after 2000 and return only the names of the personnel born after 2000 to the client, so as to ensure the safety of the data.

[0054] The method for accessing a service database provided by the embodiments of the present application includes the following steps: a client obtains channel configuration information of a target database through a bastion host, and then sends a first access request to the bastion host, and finally receives a result obtained from the target database and satisfying an access condition. The client does not directly contact the target database, but dynamically obtains the channel configuration information of the target database, and then receives the access result, which can reduce the consumption of equipment, save costs, and avoid the problem that the security of the database cannot be guaranteed when the client directly accesses the database, thereby ensuring the security of the database.

[0055] Figure 3 A method for managing and controlling a service database is shown, which can be executed by an electronic device acting as a bastion host between a client and a database. The electronic device can be a terminal device such as a mobile phone or a computer, and the specific embodiments of the present application are not limited. As shown in the figure, the method mainly includes the following steps: Figure 3

[0056] S301: The bastion host sends channel configuration information of a target database to a client.

[0057] The channel configuration information includes channel address information between the bastion host and the target database.

[0058] In the embodiments of the present application, the bastion host sends channel configuration information of a target database to a client, and the channel configuration information includes channel address information between the bastion host and the target database, such as the IP address and port number of the channel. The bastion host can access the corresponding target database through the corresponding channel address information.

[0059] S302: The bastion host receives a first access request sent by the client.

[0060] The first access request carries the channel address information and an access condition.

[0061] In the embodiments of the present application, after the client sends a first access request, the bastion host receives the first access request from the client carrying the channel address information and the access condition.

[0062] ​Optionally, in order to facilitate auditing, the bastion host records the access record of the client in the operation log after receiving the first access request, wherein the access record comprises: the account information of the client, the access time, the channel address information and the access condition. For example, the bastion host can record the access record of the client in the operation log after determining that the client has the permission to access the target database, for example, the account information of the client, the access time, the target database accessed, the channel address information, the access condition, etc. can be recorded, which facilitates subsequent auditing, so that the specific operator can be located when data leakage occurs, facilitating tracing.

[0063] S303: The bastion host sends a query command corresponding to the access condition to the target database based on the channel address information.

[0064] In a specific implementation, after the bastion host receives the first access request, the bastion host sends a query command to the target database according to the channel address information between the bastion host and the target database carried in the first access request. The query command corresponds to the access condition carried in the first access request. The query command can be a query instruction matched with the target database, for example, an SQL instruction. The query command corresponding to the access condition can obtain the query result satisfying the access condition.

[0065] S304: The bastion host receives the query result returned by the target database.

[0066] In the embodiment of the application, the bastion host can receive the query result returned by the target database after sending the query command. The query result satisfies the query command corresponding to the access condition.

[0067] S305: The bastion host returns an access result to the client based on the query result.

[0068] In a specific implementation, the bastion host returns the access result of the first access request sent by the client to the client according to the query result after receiving the query result returned by the target database.

[0069] For example, for the first access request with the above-mentioned access condition of all personnel with the birth date after 2000, the bastion host can send a query command to the target database: birth date>2000, so as to obtain the record of the target database with the birth date>2000.

[0070] Optionally, the bastion host can return the access result to the client after processing the query result returned by the target database, for example, deleting the ID number in the record with the birth date>2000, and returning the record with the deleted ID number to the client as the access result.

[0071] In the embodiment of the present application, the bastion host sends the channel configuration information of the target database to the client, then receives the first access request sent by the client, then sends the query command to the target database according to the channel address information and the access condition in the first access request, then receives the query result returned by the target database and returns the access result of the first access request to the client according to the query result. The management and control method of the business database provided by the present application can access the target database by dynamically obtaining the target database address information and can process the query result to some extent, so as to avoid sensitive data and save resources.

[0072] Figure 4 Another management and control method of a business database provided by an example embodiment of the present application is shown, the method 400 can be executed by an electronic device, which can be a terminal device such as a mobile phone or a computer, and the specific embodiment of the present application is not limited. As shown in the figure, Figure 4 The method mainly includes the following steps:

[0073] S4011: The bastion host receives the second access request sent by the client.

[0074] The second access request is used to request the channel configuration information corresponding to the target database, and the second access request carries the identification information of the target database.

[0075] In the specific implementation mode, the bastion host first receives the second access request sent by the client for requesting the channel configuration information corresponding to the target database, and the second access request carries the identification information of the target database, so that the target database can be further determined.

[0076] S4012: The bastion host determines that the client has the access right to the target database.

[0077] In the embodiment of the present application, the bastion host confirms whether the client has the access right to the target database after receiving the second access request.

[0078] Specifically, before the bastion host receives the first access request sent by the client, that is, before step S402 is executed, the method further includes: the bastion host sets an access control policy for the client, wherein the access control policy is used to configure the access right of the client to the target database.

[0079] Before the next step S402 is executed, the bastion host sets an access control policy for the client in the embodiment of the present application, for example, an access time policy and an address policy, so as to perform fine access control and operation audit. The access control policy is used to configure the access right of the client to the target database.

[0080] Specifically, the bastion host determines that the client has the permission to access the target database, including: the bastion host determines that the client has the permission to access the target database based on the access control policy.

[0081] In the embodiments of the present application, the bastion host determines that the client has the permission to access the target database based on the access control policy set for the client, for example, a time policy of access is set, if the access is not performed within the time set in advance, the client does not have the permission to access the target database. The address policy of access is similar, which is used for the bastion host to determine that the client has the permission to access the target database.

[0082] S4013: The bastion host obtains the channel address information corresponding to the target database through the configuration database.

[0083] The configuration database records the channel address information between the bastion host and at least one database. After receiving the second access request sent by the client and determining the permission of the client, the bastion host obtains the channel address information between the bastion host and the target database by accessing the configuration database. The configuration database accessed by the bastion host records the channel address information between the bastion host and at least one database, which can include the channel address information between the bastion host and the target database that the client wants to obtain.

[0084] S4014: The bastion host sends the channel configuration information to the client based on the channel address information. Specifically, before the bastion host sends the channel configuration information to the client based on the channel address information, the method further includes: in the case that the bastion host does not obtain the channel address information corresponding to the target database through the configuration database, the bastion host requests the service bus to allocate the channel address information between the bastion host and the target database.

[0085] Optionally, if the bastion host does not obtain the channel address information corresponding to the target database through the configuration database in step S4013, the configuration database does not record the channel address information between the bastion host and the target database, the bastion host can request the service bus to allocate the channel address information between the bastion host and the target database.

[0086] In the specific implementation, the bastion host sends the channel configuration information to the client based on the channel address information, including: the bastion host assigns account information and password information to the client; and the bastion host sends the channel configuration information to the client, wherein the channel configuration information includes the channel address information, the account information and the password information. When the bastion host returns the access result of the second access request for requesting the channel configuration information corresponding to the target database, the account information and the password information are assigned to the client first, and then the channel configuration information including the channel address information, the account information and the password information is sent to the client. Not only can the operation process of accessing the database be located to the person, but also the multiple information can be sent together to save the cost.

[0087] S402: The bastion host receives the first access request sent by the client.

[0088] The first access request carries the channel address information and the access condition.

[0089] This step is the same as S302 in Figure 3 , and details are referable to the related description above, which will not be repeated here.

[0090] S403: The bastion host sends a query command corresponding to the access condition to the target database based on the channel address information.

[0091] This step is the same as S303 in Figure 3 , and details are referable to the related description above, which will not be repeated here.

[0092] S404: The bastion host receives the query result returned by the target database.

[0093] This step is the same as S304 in Figure 3 , and details are referable to the related description above, which will not be repeated here.

[0094] S405: The bastion host returns an access result to the client based on the query result.

[0095] Specifically, the bastion host returns an access result to the client based on the query result, including: the bastion host obtains information meeting the access control policy from the query result as the access result of the first access request based on the access control policy. The bastion host obtains information meeting the access control policy from the query result as the access result of the first access request according to the set access control policy. The access control policy can be a time policy of access or an address policy of access, and the access result returned by the bastion host meets the set access control policy.

[0096] Figure 5 The access system of the business database provided by an example embodiment of the present application is shown, which comprises a client 501 and a bastion host 502.

[0097] The client 501 is configured to perform the steps of the access method of the business database, and the bastion host 502 is configured to perform the steps of the management and control method of the business database.

[0098] The access method of the business database provided by the embodiment of the present application can be performed by an access device of the business database. In the embodiment of the present application, the access method of the business database is performed by the access device of the business database, and the access device of the business database provided by the embodiment of the present application is described.

[0099] Figure 6 The structure diagram of the access device of the business database provided by an example embodiment of the present application is shown. The device can implement all or part of the content in the example embodiment shown in Figure 1 The access device of the business database 600 comprises an obtaining module 601, a sending module 602 and a receiving module 603, as shown in Figure 6

[0100] In the embodiment of the present application, the obtaining module 601 is configured to obtain the channel configuration information of the target database through the bastion host, wherein the channel configuration information comprises the channel address information between the bastion host and the target database; the sending module 602 is configured to send a first access request to the bastion host based on the channel address information, wherein the first access request carries the channel address information and an access condition; and the receiving module 603 is configured to receive an access result that satisfies the access condition and is obtained by the bastion host from the target database based on the channel address information.

[0101] In the embodiment of the present application, the obtaining module 601 obtains the channel configuration information of the target database through the bastion host, which comprises sending a second access request to the bastion host, wherein the second access request is used to request the channel configuration information corresponding to the target database, and the second access request carries the identification information of the target database; and receiving the query result returned by the bastion host, wherein the query result comprises the channel configuration information of the target database.

[0102] Specifically, the channel configuration information further comprises the account information of the client and the password information of the client.

[0103] ​​The business database management method provided in this application can be executed by a business database management device. This application uses the example of a business database management device executing the business database management method to illustrate the business database management device provided in this application.

[0104] Figure 7 This illustration shows a schematic diagram of a management and control device for a business database provided in an exemplary embodiment of this application. This device can achieve the following: Figure 3 , Figure 4 All or part of the content in any of the illustrated embodiments, such as Figure 7 As shown, the management and control device 700 of the business database includes: a first sending module 701, a first receiving module 702, a second sending module 703, a second receiving module 704, and a return module 705.

[0105] In this embodiment, a first sending module 701 is used to send channel configuration information of a target database to a client, wherein the channel configuration information includes channel address information between the bastion host and the target database. A first receiving module 702 is used to receive a first access request sent by the client, wherein the first access request carries the channel address information and access conditions. A second sending module 703 is used to send a query command corresponding to the access conditions to the target database based on the channel address information. A second receiving module 704 is used to receive the query results returned by the target database. A return module 705 is used to return access results to the client based on the query results. The return module 705 is used to obtain information satisfying the access control policy from the query results as the access results based on the access control policy and return it to the client.

[0106] In an optional implementation, the first sending module 701 sends channel configuration information of the target database to the client, including: receiving a second access request sent by the client, wherein the second access request is used to request channel configuration information corresponding to the target database, and the second access request carries the identification information of the target database; determining that the client has permission to access the target database; obtaining the channel address information corresponding to the target database through the configuration database, wherein the configuration database records the channel address information between the bastion host and at least one database; and sending the channel configuration information to the client based on the channel address information.

[0107] In an optional implementation, the first sending module 701 is further configured to request the service bus to allocate the channel address information between the bastion host and the target database in a case where the channel address information corresponding to the target database is not acquired through the configuration database.

[0108] In an optional implementation, the second sending module 703 sends a query command corresponding to the access condition to the target database based on the channel address information, including: allocating account information and password information for the client; and sending the channel configuration information to the client, where the channel configuration information includes the channel address information, the account information and the password information.

[0109] In an optional implementation, the method further includes: setting an access control policy for the client, where the access control policy is used to configure the access right of the client to the target database.

[0110] In an optional implementation, determining that the client has the right to access the target database includes:

[0111] determining that the client has the right to access the target database based on the access control policy; and / or,

[0112] based on the query result, returning an access result to the client, including: based on the access control policy, obtaining information meeting the access control policy from the query result as the access result, and returning the access result to the client.

[0113] In an optional implementation, the method further includes: recording an access record of the client in an operation log, where the access record includes: account information of the client, an access time, the channel address information and the access condition.

[0114] Based on the access method and the management and control method of the service database provided in the embodiments of the present application, the configuration database connection management and control device, the target database management and control device and the application program dynamic access target database device are used to dynamically acquire the target database, so that the security of the database can be ensured when the application program accesses the target database.

[0115] In the above implementation manners, the configuration database connection management device and the dynamic target database management device can be used to implement S101 and S301 and S4011 to S4014, and an access policy for configuring access to the target database is set for the user. The application program dynamic target database access device can be used to implement S102, S103, S302 to S305, and S402 to S405, and finally the application program can obtain the query result meeting the access control policy.

[0116] Specifically, first, the configuration database connection management device is used, and the application program accesses the configuration database through a pre-applied instruction channel to obtain configuration information of dynamic data; then, the dynamic target database management device parses the database data packet in the process of dynamically returning the final target database from the configuration database, and identifies the address information and access port (channel address information) of the dynamic database; finally, the address of the original target database actually accessed by the business system is replaced with the address of the instruction channel of the bastion host, so that the business system accesses the dynamic database through the instruction channel.

[0117] In the embodiments of the present application, as shown in Figure 8 When the development or test personnel perform the operation of accessing the target database on the application program, the three devices of the configuration database connection management device, the dynamic target database management device, and the application program dynamic target database access device are implemented in the following steps:

[0118] Step 1: Channel application.

[0119] Step 2: Channel address configuration.

[0120] Step 3: Connection channel.

[0121] Step 4: Query target database address.

[0122] Step 5: Return target database address.

[0123] Step 6: Target database address channel application.

[0124] Step 7: Target channel address return.

[0125] Step 8: Target channel connection.

[0126] Step 9: Target database connection.

[0127] In one specific implementation, the development or test personnel sends a channel application to the configuration database connection management device, and then the configuration database connection management device applies for, allocates and creates a personal channel, and the development or test personnel configures a target database channel address of an application program. The application program establishes a connection channel to the application program dynamic access target database device. The application program dynamic access target database device accesses the configuration library to query a target database address, and then the configuration library returns the target database address to the dynamic access target database management device, which then applies for a target database address channel to the configuration database connection management device and obtains specific information. Then the dynamic access target database management device returns the target channel address to the application program, the application program dynamic access target database device connects to the target channel, and finally the application program dynamic access target database device connects to the target database, which can be queried by a SQL statement to obtain a query result.

[0128] In the embodiment of the application, the configuration database connection management device can realize permission management and access strategy control of an application program accessing a configuration database, and is the basis for managing and controlling the application program dynamic access target database. The dynamic access target database management device realizes channel establishment of the application program accessing business data, inherits the access control strategy of the application program accessing data, and is a necessary condition for the application program dynamic access target database.

[0129] In one specific implementation, the configuration database connection management device realizes the functions as shown in Figure 9a After the application program accesses the storage target database information configuration instruction channel, the 4A system returns the corresponding instruction channel access IP and port. The user replaces the IP address and port in the original application program accessing the configuration database configuration with the IP and port (channel address information) of the applied instruction channel. In the process of applying for the instruction channel, the 4A security administrator can set access control strategies, such as access time strategies and access address strategies, to perform fine access control and operation auditing.

[0130] Further, a schematic diagram of the dynamic access target database channel process is as shown in Figure 9bAs shown, the application program accesses the configuration database through the instruction channel to achieve the dynamic configuration of the target database jdbc when the application program is initialized. When the instruction channel parses the application program to query the target database configuration information, the data packet returned by the database is parsed to obtain the target library (for example: target database A, target database B, target database C) information, including: database type, access IP, access address, connection driver, etc., and the service bus is notified to create the corresponding instruction channel for the target database that cannot be queried. The service bus returns the instruction channel information (main information: IP, port) corresponding to each target database, wherein instruction channel A corresponds to target database A, instruction channel B corresponds to target database B, and instruction channel C corresponds to target database C. That is, in the case where the bastion host does not obtain the channel address information corresponding to the target database through the configuration database, the bastion host requests the service bus to allocate the channel address information between the bastion host and the target database. If the IP and port information of the target database cannot be queried in the configuration database, the service bus can allocate the IP and port of the target database.

[0131] In one specific implementation, the flowchart of the application program dynamically accessing the target database is as shown in Figure 9c As shown, when the foreground business of the application program needs to access the target database, the information in the above-mentioned jdbc dynamic configuration is used to access the business database, the target database is accessed through the instruction channel, the access strategy can be verified when the database connection is established, the target database is accessed by sending SQL statements and detailed operation log records are recorded for subsequent operation audit, and finally the query results obtained by satisfying the access control strategy are received and returned to the application program.

[0132] The embodiment of the application makes up for the defect that the application program cannot dynamically access multiple target databases in the fine access control of the prior art. The instruction channel of the application program accesses the configuration database to dynamically obtain detailed configuration information of the target database and dynamically establish an access instruction channel. The application program can access the target database based on the jdbc dynamic configuration. In this way, the business system can be zero- transformed, that is, the access control and subsequent audit of the business data can be dynamically accessed. The instruction channel established by the embodiment has the characteristics of "building as needed, destroying after use", which can ensure the security of the database.

[0133] The service database access apparatus and the service database management and control apparatus in the embodiments of the present application can be electronic devices or components in electronic devices, such as integrated circuits or chips. The electronic devices can be terminals or other devices other than terminals. For example, the electronic devices can be mobile phones, tablet computers, notebook computers, palmtop computers, vehicle-mounted electronic devices, mobile Internet devices (MIDs), augmented reality (AR) / virtual reality (VR) devices, robots, wearable devices, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), and can also be servers, network attached storage (NAS), personal computers (PCs), televisions (TVs), cashiers, or self-service machines, and the like. The embodiments of the present application are not limited in this regard.

[0134] The service database access apparatus and the service database management and control apparatus in the embodiments of the present application can be devices with an operating system. The operating system can be an Android operating system, an ios operating system, or other possible operating systems, and the embodiments of the present application are not limited in this regard.

[0135] The service database access apparatus provided in the embodiments of the present application can implement each process of the method embodiments, and the service database management and control apparatus provided in the embodiments of the present application can implement each process of the method embodiments, and the embodiments of the present application are not repeated here. Figure 1 Figure 3 Figure 4 To avoid repetition, each process of the method embodiments is not repeated here.

[0136] Optionally, as shown in Figure 10 , the embodiments of the present application further provide an electronic device 1000, which includes a processor 1001 and a memory 1002, and the memory 1002 stores programs or instructions that can run on the processor 1001. When the programs or instructions are executed by the processor 1001, each step of the above-mentioned service database access method and service database management and control method embodiments is implemented, and the same technical effects are achieved. To avoid repetition, each step is not repeated here.

[0137] It should be noted that the electronic device in the embodiments of the present application includes the mobile electronic device and the non-mobile electronic device described above.

[0138] It should be noted that the electronic device in the embodiments of the present application includes the mobile electronic device and the non-mobile electronic device described above.​Figure 11 A structural block diagram of a computer device 1100 is shown according to an example embodiment of the present application. The computer device 1100 can be a smartphone, a tablet computer, a notebook computer, a desktop computer, a smart watch, a television, or the like. The computer device 1100 can also be referred to as a user device, a portable terminal, a laptop terminal, a desktop terminal, or other names.

[0139] Generally, the computer device 1100 includes a processor 1101 and a memory 1102.

[0140] The processor 1101 can include one or more processing cores, such as a 4-core processor, an 8-core processor, or the like. The processor 1101 can be implemented in at least one of a hardware form of a DSP (Digital Signal Processing), an FPGA (Field-Programmable Gate Array), a PLA (Programmable Logic Array). The processor 1101 can also include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also referred to as a CPU (Central Processing Unit). The coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 1101 can be integrated with a GPU (Graphics Processing Unit) for rendering and drawing content required to be displayed by a display screen. In some embodiments, the processor 1101 can further include an AI (Artificial Intelligence) processor for processing computing operations related to machine learning.

[0141] The memory 1102 can include one or more computer-readable storage media, which can be non-transitory. The memory 1102 can also include a high-speed random access memory, and a non-volatile memory such as one or more disk storage devices, flash storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 1102 is used to store at least one instruction for being executed by the processor 1101 to implement all or part of the steps of the access method of a business database and the management and control method of a business database according to the method embodiments of the present application.

[0142] In some embodiments, the computer device 1100 may also optionally include: a peripheral device interface 1103 and at least one peripheral device. The processor 1101, memory 1102, and peripheral device interface 1103 can be connected via a bus or signal line. Each peripheral device can be connected to the peripheral device interface 1103 via a bus, signal line, or circuit board. Specifically, the peripheral device includes at least one of: a radio frequency circuit 1104, a display screen 1105, a camera assembly 1106, an audio circuit 1107, and a power supply 1108.

[0143] In some embodiments, the computer device 1100 further includes one or more sensors 1109. The one or more sensors 1109 include, but are not limited to: an accelerometer 1110, a gyroscope 1111, a pressure sensor 1112, an optical sensor 1113, and a proximity sensor 1114.

[0144] Those skilled in the art will understand that Figure 11 The structure shown does not constitute a limitation on the computer device 1100 and may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0145] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described embodiments of the business database access method and the business database management method, and can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0146] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0147] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled. The processor is used to run programs or instructions to implement the various processes of the above-mentioned methods for accessing and managing business databases, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0148] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0149] The embodiment of the present application provides a computer program product, the program product is stored in a storage medium, the program product is executed by at least one processor to realize each process of the method embodiment of the access method of the service database and the management and control method of the service database, and the same technical effects can be achieved, to avoid repetition, here no longer tedious.

[0150] It should be noted that in this paper, the term "include", "contain" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes the elements inherent in such process, method, article or device. Without more limitations, the element defined by the sentence "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the method and device in the embodiments of the present application is not limited to the order of the functions shown or discussed, but can also include the functions performed in a substantially simultaneous manner or in the opposite order according to the functions involved, for example, the described method can be performed in an order different from the described order, and various steps can also be added, omitted or combined. In addition, the features described with reference to some examples can be combined in other examples.

[0151] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by means of software and necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a plurality of instructions for making a terminal (which can be a mobile phone, computer, server, or network equipment, etc.) execute the method described in each embodiment of the present application.

[0152] The embodiments of the present application are described above in combination with the drawings, but the present application is not limited to the above-mentioned specific embodiments, the above-mentioned specific embodiments are only illustrative, not limiting, and those skilled in the art can make many forms under the inspiration of the present application without departing from the scope of the present application and the protection scope of the claims.

Claims

1. A method for accessing a business database, characterized in that, include: The client obtains the channel configuration information of the target database through the bastion host, wherein the channel configuration information includes the channel address information between the bastion host and the target database; The client sends a first access request to the bastion host based on the channel address information, wherein the first access request carries the channel address information and access conditions; The client receives the access result obtained by the bastion host from the target database based on the channel address information, which meets the access conditions.

2. The method according to claim 1, characterized in that, The client obtains the channel configuration information for the target database through the bastion host, including: The client sends a second access request to the bastion host, wherein the second access request is used to request channel configuration information corresponding to the target database, and the second access request carries the identification information of the target database; The client receives the query results returned by the bastion host, wherein the query results include the channel configuration information of the target database.

3. The method according to claim 1 or 2, characterized in that, The channel configuration information also includes: the client's account information and the client's password information.

4. A method for managing and controlling a business database, characterized in that, include: The bastion host sends the channel configuration information of the target database to the client, wherein the channel configuration information includes the channel address information between the bastion host and the target database; The bastion host receives a first access request sent by the client, wherein the first access request carries the channel address information and access conditions; Based on the channel address information, the bastion host sends a query command corresponding to the access conditions to the target database; The bastion host receives the query results returned by the target database; Based on the query results, the bastion host returns the access results to the client.

5. The method according to claim 4, characterized in that, The bastion host sends the target database channel configuration information to the client, including: The bastion host receives a second access request sent by the client, wherein the second access request is used to request channel configuration information corresponding to the target database, and the second access request carries the identification information of the target database; The bastion host determines that the client has permission to access the target database; The bastion host obtains the channel address information corresponding to the target database through a configuration database, wherein the configuration database records the channel address information between the bastion host and at least one database; The bastion host sends the channel configuration information to the client based on the channel address information.

6. The method according to claim 5, characterized in that, Before the bastion host sends the channel configuration information to the client based on the channel address information, the method further includes: If the bastion host fails to obtain the channel address information corresponding to the target database through the configuration database, the bastion host requests the service bus to allocate channel address information between the bastion host and the target database.

7. The method according to claim 5 or 6, characterized in that, Based on the channel address information, the bastion host sends the channel configuration information to the client, including: The bastion host assigns account information and password information to the client; The bastion host sends the channel configuration information to the client, wherein the channel configuration information includes the channel address information, the account information, and the password information.

8. The method according to any one of claims 4 to 6, characterized in that, Before the bastion host receives the first access request sent by the client, the method further includes: The bastion host sets access control policies for the client, wherein the access control policies are used to configure the client's access permissions to the target database.

9. The method according to claim 8, characterized in that, The bastion host determines that the client has permission to access the target database by: the bastion host determining, based on the access control policy, that the client has permission to access the target database; and / or, The bastion host returns access results to the client based on the query results, including: the bastion host obtains information that satisfies the access control policy from the query results as the access results based on the access control policy, and returns it to the client.

10. The method according to claim 7, characterized in that, After the bastion host receives the first access request sent by the client, the method further includes: the bastion host recording the client's access record in the operation log, wherein the access record includes: the client's account information, access time, channel address information, and access conditions.

Images