Database login method and system, medium, equipment and program product
By detecting the database connection timeout and intercepting requests, the unauthorized access problem caused by automatic reconnection of the database client is solved, ensuring the security of the database.
Patent Information
- Application Number
- CN202411409624.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-10
- Publication Date
- 2025-01-10
AI Technical Summary
The database client tool automatically reconnects after the connection timeout, resulting in the inability to effectively prevent unauthorized access, affecting database security.
When the detection database is accessed by the target account and the operation is not performed within the set time limit, the most recent access information is recorded, the network connection is marked as a login timeout, and the request is intercepted, which simulates the error packet, forcing the user to log in again.
Effectively prevent unauthorized access, ensure that only authenticated users can continue to access the database, and improve database security.
Smart Images
Figure CN119293849A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data processing, and in particular to a database login method, system, medium, device and program product. Background Art
[0002] The database itself supports idle client timeouts for performance optimization or to prevent unauthorized access. However, the database client tool will automatically reconnect to the database when it times out, without the need for manual login again. This cannot effectively prevent unauthorized access, which can easily lead to unauthorized access to data and affect database security. Summary of the invention
[0003] The purpose of the present application is to provide a database login method, a database login system, a computer-readable storage medium, an electronic device and a computer program product to prevent a database access tool from performing database operations after a connection timeout.
[0004] In order to solve the above technical problems, this application provides a database login method, and the specific technical solution is as follows:
[0005] When it is detected that no database operation is performed within a set period of time after the database is accessed by the target account, the latest access information of the target account is recorded;
[0006] Marking the network connection corresponding to the target account as login timeout according to the most recent access information;
[0007] For the network connection marked as login timeout, all database requests are intercepted, and the database is simulated to return an error data packet in response to the database request.
[0008] Optionally, also include:
[0009] Setting a timeout period for an account corresponding to the database in the database firewall;
[0010] The set duration is determined according to the timeout exit time.
[0011] Optionally, setting the timeout exit time of the account corresponding to the database in the firewall of the database includes:
[0012] In the firewall of the database, a timeout exit time of a database account determined based on the connection pool information of the database is set.
[0013] Optionally, after marking the network connection corresponding to the most recent access information as login timeout, the method further includes:
[0014] Generate a prompt message for re-login so that the database access tool can read the prompt message and re-generate a login window.
[0015] Optionally, recording the most recent access information of the target account includes:
[0016] The IP address information and port number information when the target account accesses the database are recorded.
[0017] Optionally, after marking the network connection corresponding to the most recent access information as login timeout, the method further includes:
[0018] If it is detected that the target account is reconnected to the database, obtaining the second IP address information and the second port number information of the current connection;
[0019] If the IP address information is consistent with the second IP address information, and the port number information is consistent with the second port number, the network connection corresponding to the target account is kept as login timeout;
[0020] If the IP address information is consistent with the second IP address information, and the port number information is inconsistent with the second port number, the network connection corresponding to the target account is maintained as a normal connection.
[0021] The present application also provides a database login system, including:
[0022] An information recording module, used to record the latest access information of the target account when it is detected that no database operation is performed within a set period of time after the database is accessed by the target account;
[0023] A connection marking module, configured to mark the network connection corresponding to the target account as a login timeout according to the most recent access information;
[0024] The request interception module is used to intercept all database requests for network connections marked as login timeout, and simulate the database returning an error data packet to respond to the database request.
[0025] The present application also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the database login method described above are implemented.
[0026] The present application also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the database login method as described above when calling the computer program in the memory.
[0027] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned database login method when executed.
[0028] The present application provides a database login method, comprising: when it is detected that no database operation is performed within a set time period after a database is accessed by a target account, recording the most recent access information of the target account; marking a network connection corresponding to the target account as a login timeout according to the most recent access information; for a network connection marked as a login timeout, intercepting all database requests, and simulating the database to return an error data packet to respond to the database request.
[0029] This application marks the database network connection as a network timeout after it exceeds the set duration, and simulates sending a database error return packet for each subsequent database request for the database connection with login timeout, rather than directly disconnecting the connection, forcing the user to log out of the current connection and log in again to continue operating the database, avoiding the use of the automatic reconnection function of the database access tool to prevent unauthorized access and ensure secure access to database data.
[0030] The present application also provides a database login system, a computer-readable storage medium, an electronic device and a computer program product, which have the above-mentioned beneficial effects and are not described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS
[0031] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.
[0032] Figure 1 A flowchart of a database login method provided in an embodiment of the present application;
[0033] Figure 2 A schematic diagram of using a command line to access a database provided in an embodiment of the present application;
[0034] Figure 3 A schematic diagram of the structure of a database login system provided in an embodiment of the present application;
[0035] Figure 4 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0036] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0037] The object information involved in this application, including but not limited to the object device information, object personal information, etc., and data, including but not limited to data used for analysis, stored data, displayed data, etc., are all information and data authorized by the object or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the laws, regulations and standards of relevant countries and regions.
[0038] See also Figure 1 , Figure 1 A flowchart of a database login method provided in an embodiment of the present application, the method comprising:
[0039] S101: When it is detected that no database operation is performed within a set time after a database is accessed by a target account, the latest access information of the target account is recorded;
[0040] S102: Marking the network connection corresponding to the target account as login timeout according to the most recent access information;
[0041] S103: For the network connection marked as login timeout, intercept all database requests and simulate the database returning an error data packet to respond to the database request.
[0042] The connection timeout exit function on many database firewalls is also similar to the implementation logic of the database. It has no effect on unauthorized access. You can continue to perform SQL operations in the original SQL operation interface without entering a username and password. SQL operations are a standardized language for managing relational databases, including data definition, data query, data update, and data control. The database firewall is also called a database security gateway. It is deployed in front of the database. All traffic accessing the database first passes through the database firewall, and is forwarded to the database after being released through rule matching. This application does not limit the use of database access tools. It is a tool for connecting to the database to perform SQL operations, such as MySQL connection tools Navicat and DBeaver.
[0043] In the prior art, taking MySQL database as an example, MySQL has parameters interactive_timeout and wait_timeout. Interactive_timeout and wait_timeout are two parameters of the MySQL server, which are used to control the timeout of interactive and non-interactive connections respectively. Among them, interactive_timeout is used to set the timeout of interactive connection, that is, the time limit for users to interact with the server (such as executing queries, updates, etc.). When an interactive connection has no activity during this time, the server will automatically close the connection. The default value is usually 8 hours (28800 seconds). Wait_timeout is used to set the timeout of non-interactive connection, that is, the time limit for users to connect to the server but not perform any operations. When a non-interactive connection has no activity during this time, the server will automatically close the connection. The default value is usually 8 hours (28800 seconds).
[0044] These two parameters can be set in the MySQL configuration file (my.cnf or my.ini), or dynamically set through the command line. If no further operation is performed within 8 hours after the sql operation, the database will initiate a connection exit. Here, the command line method is used to demonstrate the phenomenon of executing sql after the idle client timeout exit time set by the database is reached. Other database access tools are similar, and the command line outputs specific information, which is more intuitive.
[0045] Access MySQL through the command line, log in to the database and wait for a timeout. Execute select 1 from dual and find that the connection is disconnected (actually the connection with the database has been disconnected due to a timeout). Automatically try to reconnect (no need to re-enter the username and password to log in). After the connection is successful, execute the SQL operation to obtain the result. To truly prevent unauthorized access, you need to re-enter the username and password before you can access the database. See Figure 2 , Figure 2 A schematic diagram of using a command line to access a database provided in an embodiment of the present application. Figure 2 Taking MySQL database as an example, it prompts that MySQL server has gone away, that is, the connection is disconnected, and prompts that it is trying to reconnect. At the same time, the Connection id of this connection is given.
[0046] It can be seen that the timeout logout of the database itself and the disconnection of the database on other database firewalls achieve the purpose of timeout logout. The old connection that has timed out is disconnected, but the new connection automatically generated by the database access tool can perform SQL operations. That is, the authorized person operates the database through the database access tool and then does not operate for a period of time, reaching the timeout time, and walks away for a while. The unauthorized person sees that the tool has not been turned off, and can continue to operate and execute SQL even if the connection has timed out. In order to improve data security and ensure that only authenticated users can access the database, this application records the recent access information of the target account when it is detected that the database is accessed by the target account and no database operation is performed within the set time. The recent access information may include access-related information of the last successful connection to the database, such as access time and network connection-related information. The network connection-related information may be the IP address information and port number information when the target account accesses the database, such as the four-tuple information, namely sip / sport / dip / dport, which are the source IP address, source port number, destination IP address, and destination port number, respectively.
[0047] There is no limitation on the set duration here, and it can be set by those skilled in the art. Specifically, the timeout exit time of the database corresponding account can be set in the firewall of the database, and the set duration can be further determined according to the timeout exit time. For example, the timeout exit time can be set to not less than 5 minutes, and the corresponding set duration can be regarded as 8 minutes or 10 minutes. When setting the timeout exit time, it can also be set based on the connection pool information of the database. The configuration of the connection pool is also one of the important factors affecting the database timeout. The connection pool reduces the overhead of frequent creation and destruction of connections by maintaining a certain number of database connections, thereby improving the efficiency of database access. When configuring the connection pool, parameters such as the maximum number of connections, the minimum number of connections, and the connection timeout are usually set. Reasonable configuration of these parameters can effectively improve system performance and prevent waste of resources.
[0048] After that, the network connection between the target account and the database is marked as login timeout. It should be noted that the marking object is the network connection relationship between the target account and the database. If the target account accesses multiple databases at the same time through the database access tool, and only some of the databases do not perform database operations within the set time, then only the network connection between the target account and the databases that have not performed database operations can be marked as login timeout. However, the target account is not marked as login timeout to avoid affecting the target account's access to other databases.
[0049] In a feasible implementation, the recent access information may include the target account's access information to all databases, for example, after the user logs in to the target account through the database access tool, he accesses multiple databases in parallel. If there is any database that has not been accessed by the target account and no database operation has been performed within a set time period, it can be obtained whether the target account has not performed any database operation on all databases within the set time period. If so, all network connections can be marked as login timeouts. If there are database operations on some databases within the set time period, a person skilled in the art can choose whether to directly mark the network connection that has not performed any operation for more than the set time period as login timeouts.
[0050] For the network connection marked as login timeout, all database requests are intercepted, and the database is simulated to return an error data packet to respond to the database request. At this time, the network connection with login timeout receives its database request normally, but intercepts and discards the database request, and simulates the format of the database response data packet to return an error data packet. At this time, a prompt message for re-login can be generated so that the database access tool can read the prompt message and regenerate the login window. The prompt message can be included in the error data packet.
[0051] In the embodiment of the present application, after the network connection of the database exceeds the set time, it will be marked as a network timeout, and each subsequent database request of the database connection with login timeout will simulate the sending of a database error return packet instead of directly disconnecting the connection, forcing the user to log out of the current connection and log in again to continue operating the database, avoiding the use of the automatic reconnection function of the database access tool, to prevent unauthorized access, and ensure secure access to database data.
[0052] In a feasible embodiment, based on the above embodiment, after marking the network connection corresponding to the most recently accessed information as a login timeout, if it is detected that the target account is reconnected to the database, the second IP address information and the second port number information of the current connection are obtained. Thereafter, the determination of the IP address information and the port number information is performed, that is, if the same target account is reconnected within a short period of time, its IP address usually does not change, but the port information after reconnection usually changes.
[0053] Therefore, if the IP address information is consistent with the second IP address information, and the port number information is consistent with the second port number, the network connection corresponding to the target account is kept as login timeout;
[0054] If the IP address information is consistent with the second IP address information, and the port number information is inconsistent with the second port number, keep the network connection corresponding to the target account as a normal connection.
[0055] An exemplary application process of the present application is described below:
[0056] The first step is to connect the database firewall in series in front of the database and set the setting duration to 10 minutes.
[0057] Step 2: After the user uses the database access tool to connect to the database and perform database operations, if no operation is performed within 10 minutes, the database firewall will record the most recent access time of each database connection.
[0058] Step 3: After 10 minutes, the user performs database operations.
[0059] 1. The database firewall determines that the last database operation on the current database connection has exceeded 10 minutes.
[0060] 2. Mark the network connection (sip / sport / dip / dport, source IP address, source port number, destination IP address, destination port number) as login timeout; for the network connection with login timeout, intercept and discard the current SQL request data packet (do not forward it to the database server).
[0061] 3. Simulate the database to return an error packet, which indicates that the connection has timed out and that you need to log in again. Return the constructed error packet to the client. This step only simulates the blocking of a single database operation, blocking the current database operation request.
[0062] Step 4: The user sees an error message on the database access tool that prompts him to log in again. If he does not log out again and continues to click to perform database operations in the database access tool window, the database firewall will check the connection based on sip / sport / dip / dport and determine that the connection has timed out before, and will continue to intercept and discard the current SQL request data packet and send an error data packet. As long as you do not reconnect, the error data packet will continue to be sent.
[0063] Step 5: After the user sees the error message prompting him to log in again, he closes the current connection and logs in again. The source IP address of the new connection remains unchanged, but the source port is updated. The database firewall determines that the new connection has not timed out and allows the current data packet to be forwarded to the database server.
[0064] See also Figure 3 , Figure 3 This is a schematic diagram of the structure of a database login system provided in an embodiment of the present application. The present application also provides a database login system, including:
[0065] An information recording module, used to record the latest access information of the target account when it is detected that no database operation is performed within a set period of time after the database is accessed by the target account;
[0066] A connection marking module, configured to mark the network connection corresponding to the target account as a login timeout according to the most recent access information;
[0067] The request interception module is used to intercept all database requests for network connections marked as login timeout, and simulate the database returning an error data packet to respond to the database request.
[0068] Based on the above embodiments, as a preferred embodiment, it also includes:
[0069] The time setting module is used to set the timeout exit time of the account corresponding to the database in the firewall of the database; and determine the set duration according to the timeout exit time.
[0070] Based on the above embodiment, as a preferred embodiment, the time setting module includes:
[0071] A timeout exit setting unit is used to set a timeout exit time of a database account determined based on the connection pool information of the database in the firewall of the database.
[0072] Based on the above embodiments, as a preferred embodiment, it also includes:
[0073] The prompt module is used to generate prompt information for re-login, so that the database access tool can read the prompt information and regenerate the login window.
[0074] Based on the above embodiment, as a preferred embodiment, the information recording module includes:
[0075] The recording unit is used to record the IP address information and port number information when the target account accesses the database.
[0076] Based on the above embodiments, as a preferred embodiment, it also includes:
[0077] A reconnection detection module is used to obtain the second IP address information and the second port number information of the current connection if it is detected that the target account is reconnected to the database; if the IP address information is consistent with the second IP address information, and the port number information is consistent with the second port number, keep the network connection corresponding to the target account as a login timeout; if the IP address information is consistent with the second IP address information, and the port number information is inconsistent with the second port number, keep the network connection corresponding to the target account as a normal connection.
[0078] The present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed, the steps provided in the above embodiment can be implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.
[0079] The present application also provides an electronic device, see Figure 4 , a structural diagram of an electronic device provided in an embodiment of the present application, such as Figure 4 As shown, a processor 1410 and a memory 1420 may be included.
[0080] Among them, the processor 1410 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 1410 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 1410 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 1410 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 1410 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.
[0081] The memory 1420 may include one or more computer-readable storage media, which may be non-transitory. The memory 1420 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 1420 is at least used to store the following computer program 1421, wherein, after the computer program is loaded and executed by the processor 1410, it can implement the relevant steps in the database login method performed by the electronic device side disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 1420 may also include an operating system 1422 and data 1423, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 1422 may include Windows, Linux, Android, etc.
[0082] In some embodiments, the electronic device may further include a display screen 1430 , an input / output interface 1440 , a communication interface 1450 , a sensor 1460 , a power source 1470 , and a communication bus 1480 .
[0083] certainly, Figure 4 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of the present application. In actual applications, the electronic device may include Figure 4 More or fewer components than shown, or combinations of certain components.
[0084] The present application also provides a computer program product, including a computer program, which implements the steps of the database login method described in the above embodiment when executed.
[0085] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the system provided in the embodiment, since it corresponds to the method provided in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.
[0086] Specific examples are used herein to illustrate the principles and implementation methods of the present application, and the description of the above embodiments is only used to help understand the method and core ideas of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.
[0087] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.
Claims
1. A database login method, characterized in that: include: When it is detected that no database operation is performed within a set period of time after the database is accessed by the target account, the latest access information of the target account is recorded; Marking the network connection corresponding to the target account as login timeout according to the most recent access information; For the network connection marked as login timeout, all database requests are intercepted, and the database is simulated to return an error data packet in response to the database request.
2. The database login method according to claim 1, characterized in that: Also includes: Setting a timeout period for an account corresponding to the database in the database firewall; The set duration is determined according to the timeout exit time.
3. The database login method according to claim 2, characterized in that: Setting the timeout time of the account corresponding to the database in the firewall of the database includes: In the firewall of the database, a timeout exit time of a database account determined based on the connection pool information of the database is set.
4. The database login method according to claim 1, characterized in that: After marking the network connection corresponding to the most recent access information as login timeout, the method further includes: Generate a prompt message for re-login so that the database access tool can read the prompt message and re-generate a login window.
5. The database login method according to claim 1, characterized in that: The most recent access information of the target account includes: The IP address information and port number information when the target account accesses the database are recorded.
6. The database login method according to claim 5, characterized in that: After marking the network connection corresponding to the most recent access information as login timeout, the method further includes: If it is detected that the target account is reconnected to the database, obtaining the second IP address information and the second port number information of the current connection; If the IP address information is consistent with the second IP address information, and the port number information is consistent with the second port number, the network connection corresponding to the target account is kept as login timeout; If the IP address information is consistent with the second IP address information, and the port number information is inconsistent with the second port number, the network connection corresponding to the target account is maintained as a normal connection.
7. A database login system, characterized in that: include: An information recording module, used to record the latest access information of the target account when it is detected that no database operation is performed within a set period of time after the database is accessed by the target account; A connection marking module, configured to mark the network connection corresponding to the target account as a login timeout according to the most recent access information; The request interception module is used to intercept all database requests for network connections marked as login timeout, and simulate the database returning an error data packet to respond to the database request.
8. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the database login method according to any one of claims 1 to 6 when executing the computer program.
9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed, implements the steps of the database login method according to any one of claims 1 to 6.
10. A computer program product, characterized in that It comprises a computer program, which implements the steps of the database login method according to any one of claims 1 to 6 when being executed.