A method and system for modifying password of database

Abstract

The present application relates to the technical field of databases, and discloses a method and system for modifying a password of a database, the method comprising: creating a password modification task; calling a password modification server to generate a password modification strategy; the password modification server first signs and then encrypts the password modification strategy to obtain an intermediate strategy; the password modification server sends the intermediate strategy to the password modification client, and the password modification client decrypts and unsigns the intermediate strategy to obtain the password modification strategy; performs a network detection, verifies the password modification strategy once after the network detection passes, performs a password modification operation, verifies the modified password twice to obtain a password modification result, refreshes an application connection pool, first signs and then encrypts the password modification result to obtain an intermediate result, and reports the intermediate result to the password modification server; the password modification server first decrypts and then unsigns the intermediate result to obtain a password modification result, and sends the latest password to the main application end for storage; the new password after the password modification can be notified to the modified application side in time, and the password modification application business is not interrupted.

Description

Technical Field

[0001] The present application relates to the technical field of databases, and in particular to a method and system for modifying a password of a database. Background Art

[0002] xPAM is a privileged account management system that focuses on the management of privileged accounts. It aims to solve the account management problems faced by enterprises in the process of digital transformation, ensure data security and business continuity, and is suitable for all types of enterprises and organizations, especially those with large IT assets and complex account management systems.

[0003] xPAM supports functions such as adding, deleting, modifying, checking, and patrolling privileged accounts, and can display the results of account discovery and patrolling, including the number of risky accounts and risky assets. It supports single and batch password changes for privileged accounts, as well as automatic filling and login of privileged account passwords. It also provides a password safe function for storing and managing automatically modified account passwords to ensure the security and accessibility of passwords. It also supports customized password change time policies and password rules to meet the security needs of different enterprises.

[0004] When changing the password of an account, especially a senior account, the following steps are required: creating a password change task, verifying the password, changing the password, verifying the password, and storing the password. These steps are performed in the main application of xPAM. However, the new password after the password change cannot be notified to the application in time. The application itself needs to obtain the new password through the API and access the database or third-party configuration module through the API. When the password of the application's database or the third-party configuration module it relies on changes, when the network fluctuates, the application will fail when trying to obtain authorization with the old password, causing the application service to be interrupted. This leads to the situation where the application service is interrupted due to the password change. Summary of the invention

[0005] In order to avoid application service interruption caused by password modification during network fluctuations, the present application provides a database password modification method and system.

[0006] In a first aspect, the present application provides a method for modifying a password of a database, which adopts the following technical solution:

[0007] A method for modifying a database password comprises the following steps:

[0008] Create a password change task on the main application side;

[0009] The main application terminal calls the encryption server terminal in response to the encryption task to generate an encryption policy on the encryption server terminal;

[0010] The encryption server first signs and then encrypts the encryption policy to obtain an intermediate policy;

[0011] The decryption server sends the intermediate policy to the decryption client, and the decryption client first decrypts and then unsigns the intermediate policy to obtain the decryption policy;

[0012] The decryption client performs a network test, and after the network test passes, the decryption policy is verified once, and after the verification succeeds, the decryption operation is performed, and the modified password is verified twice to obtain the decryption result, and after the verification succeeds twice, the application connection pool is refreshed, and then the decryption result is signed and encrypted to obtain an intermediate result, and the intermediate result is reported to the decryption server;

[0013] The encryption service end first decrypts and then unsigns the intermediate result to obtain the encryption result, and based on the encryption result, sends the latest password to the main application end for storage.

[0014] By adopting the above technical solution, through an independent encryption server and encryption client, the encryption process is not dependent on the program interface or client provided by a third party; the encryption policy process is intervened based on network detection, thereby reducing the adverse impact of network fluctuations on the encryption operation, realizing password verification on the asset side, decoupling the main encryption process and password verification, and the correctness of the application encryption does not depend on the instantaneous network stability. The new password after the encryption is changed can be notified to the application side of the encryption being changed in time, and the encryption application business is uninterrupted.

[0015] Optionally, the network detection step includes the following sub-steps:

[0016] Execute the preset test command to obtain the network response time and packet loss rate;

[0017] Calculating a network test value based on the response time and packet loss rate;

[0018] When the network test value is greater than the preset first network reference value, the network detection passes, otherwise the network detection fails; wherein, the creation frequency value of the encryption task in the preset set time period is obtained, and the first network reference value is adjusted according to the creation frequency value. The larger the creation frequency value, the larger the first network reference value, and the smaller the creation frequency value, the smaller the first network reference value.

[0019] By adopting the above technical solution, the results of network detection are adjusted according to the creation frequency value of the encryption task, which can make the results of network detection more referenceable and reduce the adverse effects of network fluctuations on the encryption operation.

[0020] Optionally, the method further comprises the following steps:

[0021] When the network test value is greater than a preset second network reference value, the encryption client and the encryption server adjust the encryption window period, the larger the network test value is, the longer the encryption window period is, and the smaller the network test value is, the shorter the encryption window period is;

[0022] The second network reference value is greater than the first network reference value; wherein the second network reference value is adjusted according to the response time, the longer the response time is, the larger the second network reference value is, and the shorter the response time is, the smaller the second network reference value is.

[0023] By adopting the above technical solution, when the result of the network detection is passed, the excellence of the network is compared through the second network reference value, and the encryption window period is adjusted in turn, and the compared network reference value is also adjusted, so that the encryption operation can be optimized as the network is optimized.

[0024] Optionally, the method further comprises the following steps:

[0025] Obtaining the amount of parallel encryption tasks that overlap the encryption window period in the current time period;

[0026] The encryption window period is shifted on the time axis to generate a task volume change trend value:

[0027] The translation amount of the encryption window period is adjusted according to the task volume change trend. The larger the task volume change trend value is, the smaller the translation amount is, and the smaller the task volume change trend value is, the larger the translation amount is. The vector direction of the task volume change trend value and the vector direction of the translation amount are set in the same direction.

[0028] By adopting the above technical solution, the translation amount is adjusted according to the changing trend of the current decryption task volume, so as to optimize the uniform distribution of the decryption tasks in the whole system.

[0029] Optionally, the method further comprises the following steps:

[0030] Establishing a heartbeat connection between the encryption server and the encryption client;

[0031] Adaptively adjusting the sending interval of the heartbeat packets of the heartbeat connection according to the network test value; the larger the network test value, the longer the sending interval, and the smaller the network test value, the shorter the sending interval;

[0032] The number of the heartbeat packets is adjusted according to the length of the decryption window period. The longer the decryption window period is, the larger the heartbeat packet is; the shorter the decryption window period is, the smaller the heartbeat packet is.

[0033] By adopting the above technical solution, the heartbeat connection can maintain the normal interaction between the decryption server and the decryption client, adjust the sending interval according to the network conditions, and adjust the heartbeat packet according to the decryption window period, so that the heartbeat connection can be adaptively adjusted as the network conditions and the decryption window period change.

[0034] Optionally, the method further comprises the following steps:

[0035] The password-changing client actively requests a password from the password-changing server, wherein the active request instruction is embedded in the heartbeat packet;

[0036] The encryption server parses the heartbeat packet in response to the active request, extracts the active request instruction from the heartbeat packet, and pushes the password to the encryption client according to the active request instruction.

[0037] By adopting the above technical solution and using heartbeat packets to carry instructions, it is possible to maximize the use of network resources and improve the utilization rate of network resources.

[0038] Optionally, the method further comprises the following steps:

[0039] If the decryption window period is greater than the preset reference window period, the actively requested instruction is embedded in the heartbeat packet; otherwise, the actively requested instruction is divided into N equal parts and placed in order in the subsequent heartbeat packets sent in sequence; wherein, the longer the decryption window period is, the smaller N is, and the shorter the decryption window period is, the larger N is.

[0040] By adopting the above technical solution, the embedding method of the active request instruction is adjusted according to the encryption window period, so that the active request instruction can be successfully sent under different network conditions.

[0041] Optionally, the method further comprises the following steps:

[0042] The encryption server actively requests the encryption client to push the encryption policy;

[0043] The encryption client agrees to push the active request of the encryption policy, and the encryption server sends the encryption policy to the encryption client in response to the agreement operation;

[0044] The encryption client obtains the encryption policy;

[0045] The method further comprises the steps of:

[0046] The encryption client generates the encryption result and actively reports the encryption result to the encryption server;

[0047] After receiving the encryption result, the encryption service actively requests the main application to report the encryption result; the main application agrees to the active request to report the encryption result, and the encryption service sends the encryption result and the latest password to the main application in response to the agreement operation.

[0048] By adopting the above technical solution, compared with directly transmitting data, the active request method can realize data transmission when the network conditions are good.

[0049] Optionally, the method further comprises the following steps:

[0050] The password changing client refreshes the application connection pool;

[0051] Adjusting the refresh cycle of the application connection pool according to the network test value, the larger the network test value is, the shorter the refresh cycle is, and the smaller the network test value is, the longer the refresh cycle is;

[0052] Alternatively, the refresh period of the application connection pool is adjusted according to the amount of parallel decryption tasks. The larger the amount of parallel decryption tasks, the shorter the refresh period; the smaller the amount of parallel decryption tasks, the longer the refresh period.

[0053] By adopting the above technical solution, the refresh frequency of the application connection pool is adjusted according to the network conditions, and the latter adjusts the refresh period of the application connection pool according to the amount of parallel decryption tasks. The refresh characteristics can be adjusted according to the actual situation, so that the application connection pool can be adapted to the decryption operation, which is conducive to the smooth progress of the decryption operation.

[0054] In a second aspect, the present application provides a database password modification system, which adopts the following technical solution:

[0055] A database password modification system comprises a processor, wherein a program of any one of the above database password modification methods is run in the processor.

[0056] In summary, the present application includes at least one of the following beneficial technical effects: through an independent decryption server and decryption client, the decryption process is not dependent on the program interface or client provided by a third party; based on network detection, the decryption policy process is intervened, thereby reducing the adverse impact of network fluctuations on the decryption operation, realizing password verification on the asset side, decoupling the main decryption process and password verification, and the correctness of the application decryption does not depend on the instantaneous network stability. The new password after the decryption can be notified to the application side of the decryption in time, and the decryption application business is uninterrupted. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 The present invention is a step-by-step diagram of a method for changing a database password.

[0058] Figure 2 This is the current xPAM software encryption flow chart.

[0059] Figure 3 yes Figure 2 The main flow chart in .

[0060] Figure 4 This is a workflow diagram of KeyLinker in the embodiment of the present application.

[0061] Figure 5 It is a sub-step diagram of the network detection steps.

[0062] Figure 6 It is a step diagram for adjusting the shift amount of the encryption window period according to the changing trend of the task volume.

[0063] Figure 7 It is a step diagram for adjusting the number of the heartbeat packets according to the length of the encryption window period. DETAILED DESCRIPTION

[0064] Embodiments of the present application are described in detail below, examples of which are shown in the accompanying drawings.

[0065] In the description of this specification, the description with reference to the terms "certain embodiments", "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0066] The present application embodiment discloses a method for modifying a password of a database, referring to Figure 1 , Figure 2 , Figure 3 and Figure 4 , including the following steps:

[0067] Create a password change task on the main application side. On the main application side, the administrator or the system automatically generates a password change task. This task contains the basic information of the target database, the new password information, and the time requirements for task execution. The basic information of the target database includes the database address, port, current user name, etc.

[0068] The main application calls the encryption server in response to the encryption task to generate an encryption policy on the encryption server. When the encryption task is created and ready to be executed, the main application calls the encryption server. This call can be implemented through HTTP requests, message queues or other IPC mechanisms. The main application constructs the corresponding request parameters based on the information of the encryption task and sends them to the specified interface of the encryption server. After receiving the encryption request from the main application, the encryption server generates a specific encryption policy based on the information in the request and predefined rules or policies. This policy may include the encryption method and storage method of the password, whether the old password verification is required, the complexity requirements of the password, the expiration time of the password, etc. The encryption server parses the request parameters and generates an encryption policy in combination with the internal configuration or rule engine. This policy can exist in the form of a data structure or object and be passed to the subsequent encryption execution process. Among them, data structures such as JSON, XML, etc.

[0069] Among them, the encryption server actively requests the encryption client to push the encryption policy.

[0070] The encryption client agrees to push the active request for the encryption policy, and the encryption server responds to the consent operation by sending the encryption policy to the encryption client. The encryption client obtains the encryption policy. Compared with direct data transmission, the active request method can realize data transmission under good network conditions.

[0071] Specifically, the decryption server signs the decryption policy first and then encrypts it to obtain the intermediate policy. The signature calculated by the signature algorithm is to verify the integrity of the message, and the encryption algorithm is to ensure the confidentiality of the message. Signing first and then encrypting is to ensure the accuracy of the original content. If encrypted first, the encrypted value will change with the change of the random factor. At this time, it is meaningless to verify the integrity of the encrypted ciphertext, because only the integrity of the encrypted ciphertext can be verified, and the integrity of the encrypted ciphertext can be verified through the decryption process. During the signature verification process, the hash value of the encrypted ciphertext is calculated and compared with the hash value sent by the client. It can only verify whether the ciphertext has been tampered with, but cannot verify whether the original content has been tampered with.

[0072] Specifically, the specific algorithm of signing first and then encrypting is explained as follows:

[0073] Among them, the signing algorithm is used to verify the integrity of the message and ensure that the message has not been tampered with during transmission. Common algorithms include: RSA, ECDSA (Elliptic Curve Digital Signature Algorithm), DSA (Digital Signature Algorithm), etc.

[0074] Signature Process:

[0075] Input: original decryption policy, i.e. the message to be signed.

[0076] Steps: Use the private key to hash the original decryption policy (such as using SHA-256). The private key is only held by the decryption server to generate a hash value. Use the private key to sign the hash value to generate a digital signature.

[0077] Output: original decryption policy and corresponding digital signature.

[0078] The signature algorithm ensures that only the decryption server that holds the corresponding private key can generate a valid signature. The recipient, such as the decryption client, can use the public key to verify the authenticity of the signature and thus confirm the integrity of the message.

[0079] Among them, the purpose of encryption algorithm (encryption) is to protect the confidentiality of the message and ensure that the message cannot be read by unauthorized parties during transmission. Common algorithms: AES (Advanced Encryption Standard), RSA (although also used for signatures, but here the encryption speed is slower when used as asymmetric encryption, usually used for small amount of data encryption or key exchange), SM4 (National Secret Algorithm), etc.

[0080] Encryption process:

[0081] Input: original decryption policy and corresponding digital signature.

[0082] Steps: Combine the original decryption policy and digital signature into a message body, which needs to be spliced ​​or encapsulated in a certain format. Use a symmetric encryption algorithm (such as AES) and a randomly generated key (symmetric key) to encrypt the message body and generate ciphertext. In addition, you can also choose to use the public key of an asymmetric encryption algorithm (such as RSA) to encrypt the symmetric key and generate key ciphertext so that the recipient can safely obtain the symmetric key.

[0083] Output: ciphertext and key ciphertext.

[0084] In practical applications, the encrypted ciphertext and the encrypted key are usually transmitted at the same time, if asymmetric encryption is used, the symmetric key is encrypted so that the receiver can decrypt and verify the integrity and authenticity of the message.

[0085] The decryption server sends the intermediate policy to the decryption client, and the decryption client decrypts and then unsigns the intermediate policy to obtain the decryption policy.

[0086] The purpose of the decryption algorithm is to convert the encrypted ciphertext back to the original plaintext, that is, the message before encryption. Common algorithms: Select the corresponding decryption algorithm according to the algorithm used for encryption. If AES (Advanced Encryption Standard) is used for encryption, AES is also used for decryption; if other symmetric encryption algorithms are used, the same algorithm should be used for decryption.

[0087] Decryption process:

[0088] Input: The encrypted ciphertext is transmitted together with the key ciphertext if the key is encrypted by asymmetric encryption.

[0089] Steps: If the key is encrypted by asymmetric encryption, first use the private key to decrypt the key ciphertext to obtain the symmetric key. Use the obtained symmetric key to decrypt the encrypted ciphertext to obtain the decrypted message body; the message body contains the original decryption policy and the corresponding digital signature.

[0090] Output: Decrypted message body.

[0091] During the decryption process, you need to ensure that the key used matches the key used for encryption, otherwise the decryption cannot be correct.

[0092] The purpose of the decryption algorithm is to verify the integrity and authenticity of the decrypted message and ensure that the message has not been tampered with during transmission. Commonly used algorithms: digital signature verification algorithms corresponding to the signature algorithm. If RSA is used for signing, RSA is also used for verification; if ECDSA is used, ECDSA is also used for verification.

[0093] Unpacking process:

[0094] Input: The decrypted message body, which contains the original decryption policy and the corresponding digital signature.

[0095] Steps: Extract the original decryption policy and the corresponding digital signature from the decrypted message body. Hash the original decryption policy using the same hash algorithm (such as SHA-256) as used for signing to generate a new hash value. Verify the digital signature using the public key of the decryption server, and compare the hash value generated during the verification process with the extracted hash value to see if they are consistent.

[0096] Output: Verification result, either success or failure.

[0097] The public key used in the verification process must correspond to the private key used for signing to ensure the validity of the verification.

[0098] in, Figure 4 The following is the KeyLinker workflow diagram, where the encryption server is called Client and the encryption client is called Server.

[0099] Change the password of the client to perform network detection. Figure 5 , the network detection step includes the following sub-steps:

[0100] Execute the preset test command to obtain the network response time and packet loss rate;

[0101] The network test value is calculated based on the response time and the packet loss rate. The algorithm used to calculate the network test value is a weighted average algorithm, for example:

[0102] Assume that the response time weight is 0.6, in milliseconds (ms); the packet loss rate weight is 0.4, in percentage (%). The test data is: response time: 50ms; packet loss rate: 2%; then, the network test value is 30.008. In order to simplify the calculation, the data involved in the calculation is dimensionless.

[0103] When the network test value is greater than the preset first network reference value, the network test passes, otherwise the network test fails; wherein, the creation frequency value of the encryption task in the preset set time period is obtained, and the first network reference value is adjusted according to the creation frequency value. The larger the creation frequency value, the larger the first network reference value, and the smaller the creation frequency value, the smaller the first network reference value.

[0104] Assume that the preset first network reference value is 100; the initial adjustment coefficient is 1; creation frequency value: Assume that in a set time period, such as a day, the creation frequency value of the encryption task can be 10, 50, 100, etc. Use a simple linear relationship to calculate the adjustment coefficient. For example, for every increase of 10 creation frequencies, the adjustment coefficient increases by 0.1. When the frequency value is 10, the adjustment coefficient is 1; when the frequency value is 50, it increases by 40, so the adjustment coefficient is 1.4.

[0105] When the network test value is greater than the preset second network reference value, the encryption client and the encryption server adjust the encryption window period. The larger the network test value, the longer the encryption window period, and the smaller the network test value, the shorter the encryption window period.

[0106] For example, the preset second network reference value is 150, and the basic value of the decryption window period is 10 minutes, which is the default length of the decryption window period when there is no network delay or under certain conditions. When the network test value is 200, 1 minute is added for every 10 units; the decryption window period is 10+100 / 10=20 minutes.

[0107] The second network reference value is greater than the first network reference value; wherein the second network reference value is adjusted according to the response time, the longer the response time is, the larger the second network reference value is; the shorter the response time is, the smaller the second network reference value is. For example, assuming that when the response time is 300 milliseconds, the second network reference value is 200; when the response time is 400 milliseconds, the second network reference value is 250.

[0108] Adjusting the network detection results according to the creation frequency value of the encryption task can make the network detection results more referenceable and reduce the adverse effects of network fluctuations on the encryption operation. When the network detection result is passed, the network's excellence is compared with the second network reference value, and the encryption window period is adjusted in turn, and the compared network reference value is also adjusted, so that the encryption operation can be optimized along with the optimization of the network.

[0109] Reference Figure 6 , get the amount of parallel decryption tasks with overlapping decryption windows in the current time period; it means that in the same time period, there are multiple decryption tasks trying to be executed, resulting in the overlap of these tasks in time.

[0110] Shift the encryption window on the time axis, and generate the task volume change trend value after the shift: To optimize the network load and reduce conflicts, the encryption window can be moved forward or backward on the time axis. The task volume change trend value reflects the increase or decrease of the task volume.

[0111] The shift amount of the encryption window period is adjusted according to the trend of task volume change. The larger the task volume change trend value, the smaller the shift amount, and the smaller the task volume change trend value, the larger the shift amount. The vector direction of the task volume change trend value and the vector direction of the shift amount are set in the same direction.

[0112] The current time period is from T0 to T1. During this time period, there are 3 overlapping encryption tasks, which are scheduled to start at T0+5, T0+10, and T0+15 minutes respectively, and each task lasts 10 minutes. Try to shift the window period forward to see how the task volume changes.

[0113] Here are the steps:

[0114] Step 1: Initial state:

[0115] The start time of the encryption task: T0+5, T0+10, T0+15;

[0116] Duration: 10 minutes each.

[0117] Step 2: Shift the window period:

[0118] Suppose we try to shift the window period forward by 3 minutes, that is, the start time of all tasks is advanced by 3 minutes;

[0119] The new task start time becomes: T0+2, T0+7, T0+12.

[0120] Step 3: Calculate the task volume change trend value:

[0121] Before the translation, the number of minutes of task overlap in the time period from T0 to T1 is: 5, from T0+10 to T0+15, because T0+5 to T0+10 do not overlap with other tasks;

[0122] After the shift, the number of minutes of task overlap becomes: 8, from T0+7 to T0+15, because all tasks have partial overlap;

[0123] The trend value, simplified as the change in the number of minutes of overlap, is -3, indicating an increase in overlap.

[0124] Step 4: Adjust the translation amount:

[0125] Since the trend value is negative, that is, the overlap increases, the translation amount needs to be increased to reduce the overlap;

[0126] Suppose we decide to move forward another 2 minutes;

[0127] The new task start time becomes: T0, T0+5, T0+10;

[0128] At this time, the number of overlapping minutes is reduced to 5, with only T0+5 to T0+10 overlapping.

[0129] Step 5: Vector direction:

[0130] In this case, the direction of the translation vector is always forward, that is, the positive direction of the time axis, because the overlap is reduced by advancing the task start time.

[0131] Adjusting the translation amount according to the changing trend of the current decryption task volume can optimize the uniform distribution of decryption tasks in the entire system.

[0132] Reference Figure 7, establish a heartbeat connection between the encryption server and the encryption client. Adaptively adjust the sending interval of the heartbeat packet of the heartbeat connection according to the network test value. The larger the network test value, the longer the sending interval, and the smaller the network test value, the shorter the sending interval. Among them, the heartbeat connection is a mechanism for regularly sending short messages, namely heartbeat packets, between the client and the server to detect whether the other party is still online and responsive. In the encryption service, the heartbeat connection helps to ensure that the encryption server can timely understand the status of the encryption client and make corresponding adjustments when the network conditions change. Among them, the network test value is obtained through a network test tool, such as ping, traceroute, or a custom network quality monitoring program, and the current network test value is obtained. The value comprehensively reflects factors such as network delay, packet loss rate, and bandwidth. Regarding the setting of the sending interval, when the network test value is large, it means that the network condition is not good, and the sending interval of the heartbeat packet is increased to reduce the network load and avoid unnecessary traffic consumption. When the network test value is small, it means that the network condition is good, and the sending interval of the heartbeat packet is shortened to check the status of the other party more frequently to ensure that connection problems are discovered in time. Among them, the heartbeat packet should contain enough information for the receiver to judge the status of the sender, such as timestamp, sequence number, current status code, etc. At the same time, some checksum or signature mechanism can be added to ensure the integrity and authenticity of the data.

[0133] The number of heartbeat packets is adjusted according to the length of the decryption window. The longer the decryption window, the larger the heartbeat packet, and the shorter the decryption window, the smaller the heartbeat packet. The size of the heartbeat packet is dynamically adjusted according to the length of the decryption window. The longer the decryption window, the longer the decryption operation takes to complete. Therefore, the amount of information carried in the heartbeat packet can be increased, such as the current decryption progress, expected completion time, etc., but at the same time, it should be noted that it should not be too large to avoid increasing the network burden. On the contrary, when the decryption window is short, the heartbeat packet can be kept small and only contain necessary status information.

[0134] The password change client actively requests the password from the password change server, wherein the actively requested instruction is embedded in the heartbeat packet; by directly embedding, the instruction identifier indicating the active request for the password is directly added in the fixed field or the reserved extension field of the heartbeat packet, such as a specific code, flag bit or command word. This method is suitable for situations where the instruction is short and the heartbeat packet structure allows. If the heartbeat packet is designed with the ability to carry additional data payload, the active request instruction can be encapsulated as part of the payload. This method allows the transmission of more complex instructions or the inclusion of additional parameters. In addition, in order to ensure the security of data transmission, the instruction can also be encrypted before being embedded in the heartbeat packet. Only the recipient holding the correct key can decrypt and identify the instruction content. At the same time, verification mechanisms such as checksums or digital signatures can be added to the heartbeat packet to ensure that the heartbeat packet has not been tampered with during transmission.

[0135] The encryption server parses the heartbeat packet in response to the active request, extracts the active request instruction from the heartbeat packet, and pushes the password to the encryption client according to the active request instruction. After receiving the heartbeat packet, the encryption server first performs basic packet format verification and integrity check. Then, the instruction part is parsed according to the structure and encryption method of the heartbeat packet. If the instruction of the active password request is identified, the corresponding processing is performed according to the business logic, such as querying the database, generating a password, etc. After the encryption server processes the active request, the generated password is returned to the encryption client in a secure manner, such as after encryption, through an independent response packet or in the payload of the next heartbeat packet. If the password is transmitted in an encrypted manner, ensure that the encryption client has the corresponding decryption capability.

[0136] If the encryption window period is greater than the preset reference window period, the active request instruction will be embedded in the heartbeat packet; otherwise, the active request instruction will be divided into N parts and placed in order in the subsequent heartbeat packets sent in sequence; the longer the encryption window period is, the smaller N is, and the shorter the encryption window period is, the larger N is.

[0137] Split logic: When the decryption window is longer than the preset reference window, it means that there is more time for data transmission and error retry. At this time, the actively requested instruction can be completely embedded in a heartbeat packet and sent to reduce the number of transmissions and reduce the complexity. When the decryption window is short, in order to avoid the entire request being delayed due to a single transmission failure, the actively requested instruction can be divided into N parts and then placed in the subsequent heartbeat packets in sequence. Each heartbeat packet carries a part of the instruction until all parts are sent.

[0138] Determination of N: The size of N can be dynamically calculated based on the specific length of the decryption window and the interval between heartbeat packets. Generally speaking, the longer the decryption window, the smaller N can be set; conversely, the shorter the decryption window, the larger N needs to be set to disperse the transmission risk. At the same time, factors such as the maximum load limit of the heartbeat packet and the transmission efficiency need to be considered to comprehensively determine the specific value of N. For example, assuming that the instruction size is 1200 bytes and the maximum load of the heartbeat packet is 500 bytes, then N is 3, which means that the instruction needs to be divided into 3 parts and embedded in 3 consecutive heartbeat packets for transmission.

[0139] The heartbeat connection can maintain the normal interaction between the decryption server and the decryption client. The heartbeat packet can be used to carry instructions to maximize the use of network resources and improve the utilization rate of network resources. The embedding method of the active request instruction can be adjusted according to the decryption window period, so that the active request instruction can be successfully sent under different network conditions. The sending interval can be adjusted according to the network conditions, and the heartbeat packet can be adjusted according to the decryption window period, so that the heartbeat connection can be adaptively adjusted with the changes in the network conditions and the decryption window period.

[0140] After the network detection is passed, the encryption policy is verified once, and the encryption operation is performed after the verification is successful.

[0141] In a verification, in addition to the previously mentioned verification of user identity, permissions, password change window, request instructions and parameters, system status and resources, some additional security mechanisms can also be added, such as:

[0142] Behavioral pattern analysis: Analyze the user's historical password-changing behavior to determine whether the current request conforms to the user's regular operation pattern, such as password-changing frequency, time pattern, etc.

[0143] Device information verification: Verify whether the device that initiates the password change request is the same as the user's commonly used device to prevent account theft.

[0144] The modified password is verified twice to obtain the result of the password change. The secondary verification is mainly performed on the modified password to ensure its security and compliance:

[0145] Password complexity re-verification: Recheck whether the new password meets the complexity requirements, such as length, combination of uppercase and lowercase letters, numbers, special characters, etc.

[0146] Password history check: Confirm that the new password is different from the user's historical passwords to avoid reusing old passwords.

[0147] Blacklist and whitelist verification: Compare the new password with the preset password blacklist, which contains known insecure passwords, to ensure that the new password is not on it; at the same time, you can also compare the new password with the whitelist. Although this is not a required step, it can serve as an additional security layer.

[0148] Password policy compliance check: Double-check that the new password complies with the password policy requirements of the system or organization.

[0149] After the second verification is successful, the application connection pool is refreshed. Then, the encryption result is signed and encrypted to obtain the intermediate result, and the intermediate result is reported to the encryption server.

[0150] Among them, the specific algorithm for refreshing the application connection pool is as follows:

[0151] S1, adjust the refresh cycle according to the network test value;

[0152] Calculation example:

[0153] Assume that the network test value (NetworkTestValue, NTV) is an integer between 0 and 100, indicating the stability and performance of the current network. Set a base refresh interval (BaseRefreshInterval, BRI), and then adjust this interval according to NTV.

[0154] Basic refresh cycle: BRI = 60 minutes, that is, the connection pool is refreshed every 60 minutes.

[0155] Adjustment factor: AF=1-(NTV / 100).

[0156] Actual refresh cycle: ActualRI=BRI×AF.

[0157] Example:

[0158] When NTV=10, AF=1-(10 / 100)=0.9, ActualRI=60×0.9=54 minutes.

[0159] When NTV=90, AF=1-(90 / 100)=0.1, ActualRI=60×0.1=6 minutes.

[0160] S2, adjust the refresh cycle according to the amount of parallel encryption tasks;

[0161] Calculation example:

[0162] Assume that Concurrent Password Change Tasks (CPCT) is a positive integer, which represents the number of password change tasks being performed simultaneously in the current system. Set a basic refresh cycle and threshold to adjust the cycle.

[0163] Basic refresh cycle: BRI = 60 minutes.

[0164] Task volume threshold: Threshold=10.

[0165] Adjust the algorithm:

[0166] If CPCT<=Threshold, the basic refresh cycle is used.

[0167] If CPCT>Threshold, the refresh cycle is shortened by a certain percentage (such as 5%) for each additional task that exceeds the threshold.

[0168] Example:

[0169] When CPCT=5, the basic refresh cycle is used, which is 60 minutes.

[0170] When CPCT=15, 5 tasks exceed the threshold. Assuming that each task causes the refresh cycle to be shortened by 5%, the ActualRI=60×(1-0.05×5)=57 minutes.

[0171] Among them, the specific algorithm of signing first and then encrypting is as follows:

[0172] S1, Signature: Use a digital signature algorithm, such as RSA or ECDSA, to sign the decryption result. First, the decryption result, such as the hash value of the new password, is hashed, and then the hash value is signed using the private key. The signature result is attached to the decryption result to ensure the integrity of the data and the reliability of the source.

[0173] S2, Encryption: Use symmetric encryption algorithms, such as AES, or asymmetric encryption algorithms, such as RSA, but usually used to encrypt shorter keys, to encrypt the signed data. When encrypting, the key or public key agreed upon in advance by the server and the client can be used. The encrypted data, that is, the intermediate result, is secure, and only the entity with the corresponding key can decrypt and verify its content.

[0174] The step of refreshing the application connection pool by the encrypted client also includes: adjusting the refresh period of the application connection pool according to the network test value, the larger the network test value, the shorter the refresh period, the smaller the network test value, the longer the refresh period.

[0175] For example, the basic settings:

[0176] Base Refresh Interval (BRI): Set to 60 minutes, which means that the connection pool is refreshed every 60 minutes when there is no network fluctuation.

[0177] Network Test Value (NTV): An integer between 0 and 100 that quantifies the stability and performance of the current network.

[0178] Adjustment Factor (AF): Calculated based on NTV and used to adjust BRI.

[0179] Calculation formula:

[0180] AF=1-(NTV / 100)^k, where k is an adjustment factor used to control the impact of NTV on AF. The larger k is, the more significant the impact of NTV on AF is.

[0181] Actual refresh interval (ARI): ARI = BRI × AF.

[0182] Calculation example:

[0183] Case 1: The network is in good condition:

[0184] NTV = 90;

[0185] Assume k=2;

[0186] AF=1-(90 / 100)^2=1-0.81=0.19;

[0187] ARI = 60 × 0.19 = 11.4 minutes;

[0188] Conclusion: When the network condition is good, the connection pool is refreshed every 11 minutes to ensure the timeliness and validity of the connection.

[0189] Case 2: Poor network conditions:

[0190] NTV=30;

[0191] Assume k=2;

[0192] AF=1-(30 / 100)^2=1-0.09=0.91;

[0193] ARI = 60 × 0.91 = 54.6 minutes;

[0194] Conclusion: When the network condition is poor, refresh the connection pool approximately every 55 minutes to reduce refresh failure or resource waste caused by network problems.

[0195] Alternatively, the refresh cycle of the application connection pool is adjusted according to the amount of parallel encryption tasks. The larger the amount of parallel encryption tasks, the shorter the refresh cycle; the smaller the amount of parallel encryption tasks, the longer the refresh cycle.

[0196] For example, the basic settings:

[0197] Basic Refresh Interval (BRI): Also set to 60 minutes.

[0198] Concurrent Password Change Tasks (CPCT): The number of password change tasks currently being performed simultaneously in the system.

[0199] Task volume threshold (Threshold): Set to 10, that is, when CPCT exceeds 10, the refresh cycle starts to be adjusted.

[0200] Adjustment Step (AS): The number of minutes that the refresh cycle is shortened each time the CPCT exceeds the threshold.

[0201] Calculation formula:

[0202] If CPCT<=Threshold, then ARI=BRI.

[0203] If CPCT>Threshold, then ARI=BRI-((CPCT-Threshold)×AS), but ARI should not be less than a minimum refresh period, such as 5 minutes.

[0204] Calculation example:

[0205] Case 1: Low parallel task volume:

[0206] CPCT=5;

[0207] ARI=BRI=60 minutes, because CPCT did not exceed the threshold;

[0208] Conclusion: Under low parallel task volume, the basic refresh cycle remains unchanged.

[0209] Case 2: Medium parallel workload:

[0210] CPCT=15;

[0211] Assume AS = 2 minutes;

[0212] ARI = BRI - ((15 - Threshold) × AS) = 60 - (5 × 2) = 50 minutes;

[0213] Conclusion: Under moderate parallel task volume, refresh the connection pool every 50 minutes to better adapt to the task load.

[0214] Case 3: High parallel workload:

[0215] CPCT=30;

[0216] Assume AS = 2 minutes, but set the minimum refresh period to 10 minutes to prevent excessive refresh;

[0217] ARI = max (BRI - ((30 - Threshold) × AS), 10) = max (60 - (20 × 2), 10) = 20 minutes.

[0218] Conclusion: Under high parallel task volume, refresh the connection pool every 20 minutes to ensure that the system can handle a large number of password change requests in time. At the same time, set a minimum refresh cycle to prevent resource waste caused by excessive refresh.

[0219] The refresh frequency of the application connection pool is adjusted according to the network conditions. The latter adjusts the refresh cycle of the application connection pool according to the amount of parallel encryption tasks. The refresh characteristics can be adjusted according to the actual situation to make the application connection pool adapt to the encryption operation, which is conducive to the smooth progress of the encryption operation.

[0220] The decryption client generates the decryption result and actively reports it to the decryption server. After receiving the decryption result, the decryption server actively requests the main application to report the decryption result; the main application agrees to the active request to report the decryption result, and the decryption server sends the decryption result and the latest password to the main application in response to the agreement. Compared with direct data transmission, the active request method can realize data transmission when the network conditions are good.

[0221] Specifically, the encryption server first decrypts and then unsigns the intermediate result to obtain the encryption result. Based on the encryption result, the latest password is sent to the main application for storage.

[0222] Among them, the specific algorithm for decryption first:

[0223] S1, Select encryption algorithm: During the encryption phase, the encryption client usually uses a symmetric encryption algorithm or an asymmetric encryption algorithm, such as RSA, but it is usually used to encrypt shorter keys or data blocks. To simplify the explanation, it is assumed that the AES encryption algorithm is used.

[0224] S2, obtain the decryption key: The encryption server needs to have the same decryption key or the corresponding private key as the encryption client, where the decryption key is in the case of AES; the corresponding private key is in the case of RSA encryption key. These keys should be pre-exchanged and stored in a secure environment.

[0225] S3, decryption process:

[0226] S31, Initialization Vector (IV): If you are using a block cipher such as AES and choose a mode such as CBC, you also need an initialization vector (IV). The IV is usually transmitted with the ciphertext and is unique for each encryption session.

[0227] S32, decryption algorithm execution: using the decryption key and IV, decrypt the received encrypted data. The specific implementation of the decryption algorithm depends on the selected encryption algorithm.

[0228] S33, decryption result verification: After decryption, the decryption result should be verified to be in the expected format, such as checking for padding errors or data integrity check failures.

[0229] Among them, the specific algorithm for re-interpreting the signature is:

[0230] S1, Verify signature algorithm: During the signing phase, the encryption client will use a digital signature algorithm to sign the encryption result or its hash value; digital signature algorithms such as RSA, ECDSA, etc. The encryption server needs to know and use the corresponding verification algorithm.

[0231] S2, Get the public key: The encryption server needs to have the public key of the encryption client if the public key encryption / private key signature scheme is used. The public key is usually exchanged and stored through a secure channel during system initialization.

[0232] S3, decryption process:

[0233] S31, Verify signature: Use the public key to verify the signature. This usually involves inputting the signature into a verification algorithm along with the expected message, such as the hash value of the decrypted result, to check whether the signature is valid.

[0234] S32, Hash value comparison: If the signature verification passes, the encryption server will calculate the hash value of the encryption result and compare it with the hash value contained in the signature. This step ensures that the encryption result has not been tampered with during transmission.

[0235] S33, result processing: If the hash value comparison is successful, the encryption server can consider the encryption result to be credible and continue the subsequent processing flow, such as sending the latest password to the main application.

[0236] In the five main processes of the encryption business in the main application side, the encryption task and storage password are executed on the encryption server on the application side, and the verification password and encryption are executed on the encryption client on the asset side. In this way, the business is decoupled, the reliability of encryption is improved, and the timely notification of the encryption result is guaranteed. Through independent encryption server and encryption client, the encryption process does not depend on the program interface or client provided by a third party; based on network detection, the process of encryption policy is intervened, thereby reducing the adverse impact of network fluctuations on the encryption operation, realizing password verification on the asset side, decoupling the main encryption process and password verification, and the correctness of the application encryption does not depend on the instantaneous network stability. The new password after the encryption is changed can be notified to the application side of the encryption being changed in time, and the encryption application business is uninterrupted.

[0237] An embodiment of the present application further discloses a database password modification system, comprising a processor, wherein a program of the database password modification system described in any one of the above items is run in the processor.

[0238] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in the field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for modifying a password of a database, characterized in that: The steps include: Create a password change task on the main application side; The main application terminal calls the encryption server terminal in response to the encryption task to generate an encryption policy on the encryption server terminal; The encryption server first signs and then encrypts the encryption policy to obtain an intermediate policy; The decryption server sends the intermediate policy to the decryption client, and the decryption client first decrypts and then unsigns the intermediate policy to obtain the decryption policy; The decryption client performs a network test, and after the network test passes, the decryption policy is verified once, and after the verification succeeds, the decryption operation is performed, and the modified password is verified twice to obtain the decryption result, and after the verification succeeds twice, the application connection pool is refreshed, and then the decryption result is signed and encrypted to obtain an intermediate result, and the intermediate result is reported to the decryption server; The encryption server first decrypts and then unsigns the intermediate result to obtain an encryption result, and based on the encryption result, sends the latest password to the main application end for storage; The network detection step includes the following sub-steps: Execute the preset test command to obtain the network response time and packet loss rate; Calculating a network test value based on the response time and packet loss rate; When the network test value is greater than a preset first network reference value, the network test is passed, otherwise the network test is failed; wherein, a creation frequency value of the encryption task in a preset set time period is obtained, and the first network reference value is adjusted according to the creation frequency value, the larger the creation frequency value, the larger the first network reference value, and the smaller the creation frequency value, the smaller the first network reference value; When the network test value is greater than a preset second network reference value, the encryption client and the encryption server adjust the encryption window period, the larger the network test value is, the longer the encryption window period is, and the smaller the network test value is, the shorter the encryption window period is; The second network reference value is greater than the first network reference value; wherein the second network reference value is adjusted according to the response time, the longer the response time is, the larger the second network reference value is, and the shorter the response time is, the smaller the second network reference value is; Obtaining the amount of parallel encryption tasks that overlap the encryption window period in the current time period; The encryption window period is shifted on the time axis to generate a task volume change trend value: The translation amount of the encryption window period is adjusted according to the task volume change trend. The larger the task volume change trend value is, the smaller the translation amount is, and the smaller the task volume change trend value is, the larger the translation amount is. The vector direction of the task volume change trend value and the vector direction of the translation amount are set in the same direction.

2. The method for modifying a database password according to claim 1, characterized in that: The method further comprises the steps of: Establishing a heartbeat connection between the encryption server and the encryption client; Adaptively adjusting the sending interval of the heartbeat packets of the heartbeat connection according to the network test value; the larger the network test value, the longer the sending interval, and the smaller the network test value, the shorter the sending interval; The number of the heartbeat packets is adjusted according to the length of the decryption window period. The longer the decryption window period is, the larger the heartbeat packet is; the shorter the decryption window period is, the smaller the heartbeat packet is.

3. The method for modifying a database password according to claim 2, characterized in that: The method further comprises the steps of: The password-changing client actively requests a password from the password-changing server, wherein the active request instruction is embedded in the heartbeat packet; The encryption server parses the heartbeat packet in response to the active request, extracts the active request instruction from the heartbeat packet, and pushes the password to the encryption client according to the active request instruction.

4. The method for modifying a database password according to claim 3, characterized in that: The method further comprises the steps of: If the decryption window period is greater than the preset reference window period, the actively requested instruction is embedded in the heartbeat packet; otherwise, the actively requested instruction is divided into N equal parts and placed in order in the subsequent heartbeat packets sent in sequence; wherein, the longer the decryption window period is, the smaller N is, and the shorter the decryption window period is, the larger N is.

5. The method for modifying a database password according to any one of claims 1 to 4, characterized in that: The method further comprises the steps of: The encryption server actively requests the encryption client to push the encryption policy; The encryption client agrees to push the active request of the encryption policy, and the encryption server sends the encryption policy to the encryption client in response to the agreement operation; The encryption client obtains the encryption policy; The method further comprises the steps of: The encryption client generates the encryption result and actively reports the encryption result to the encryption server; After receiving the encryption result, the encryption service actively requests the main application to report the encryption result; the main application agrees to the active request to report the encryption result, and the encryption service sends the encryption result and the latest password to the main application in response to the agreement operation.

6. The method for modifying a database password according to claim 1, characterized in that: The method further comprises the steps of: The password changing client refreshes the application connection pool; Adjusting the refresh cycle of the application connection pool according to the network test value, the larger the network test value is, the shorter the refresh cycle is, and the smaller the network test value is, the longer the refresh cycle is; Alternatively, the refresh period of the application connection pool is adjusted according to the amount of parallel decryption tasks. The larger the amount of parallel decryption tasks, the shorter the refresh period; the smaller the amount of parallel decryption tasks, the longer the refresh period.

7. A database password modification system, characterized in that: The method comprises a processor, wherein a program of the method for modifying the password of a database as claimed in any one of claims 1 to 6 is run in the processor.

Images