Identity authentication method, device, equipment and medium

Abstract

The invention discloses an identity authentication method and device, equipment and a medium, and relates to the field of communication, and the method comprises the steps that a database security reinforcement product server carries out identity authentication based on an identity authentication credential in an identity authentication request data packet sent by a database security reinforcement product client; after the authentication succeeds, the client authentication IP and the database management system information are cached to a target list, and an authentication result is returned, so that the target management client sends an access authentication request data packet based on the authentication result; analyzing the access authentication request data packet, querying database management system information according to analysis information, and matching the database management system information with to-be-accessed database management system information; and if the matching is successful, forwarding the access authentication request data packet to a database management system to perform identity authentication, and returning an identity authentication result to the target management client to complete identity authentication. According to the invention, dual-system authentication of a database security reinforcement product and a database management system is realized.

Description

Technical Field

[0001] The present invention relates to the field of communications, and in particular to an identity authentication method, device, equipment and medium. Background Art

[0002] With the rapid development of informatization, many industries have prospered, but it has also caused increasingly serious network security problems. Identity authentication, as the first step in information security protection, plays a vital role. According to "GA_T 1574-2019 Information Security Technology Database Security Hardening Product Security Technical Requirements", in addition to the database management system authentication, the database management system account should also pass the identity authentication of the database security hardening product. There are currently two main ways to support database dual system authentication. One is through VPN / gateway proxy (VPN, i.e. Virtual Private Network). In this way, data needs to be forwarded from the VPN client / gateway client to the VPN server / gateway server, and then forwarded from the VPN server / gateway server to the database. The two proxies have a great impact on the access performance of the database, resulting in low access efficiency to the database. Another way is to transform the database client driver. This method requires adding an authentication method to the database client driver, but each database has different client driver versions for different versions and different development languages ​​(C, Java, C#, etc.), resulting in more driver versions that need to be modified, increasing the cost of database client driver transformation.

[0003] In summary, how to improve database access efficiency and save the cost of database authentication while implementing database authentication is a problem that needs to be solved urgently. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide an identity authentication method, device, equipment and medium, which can improve the database access efficiency and save the cost of database identity authentication while implementing database identity authentication. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses an identity authentication method, which is applied to a database security reinforcement product server, comprising:

[0006] Receive an identity authentication request data packet of a database security hardening product client in a target management machine, authenticate the database security hardening product client based on the identity authentication credentials in the identity authentication request data packet and obtain a corresponding client authentication IP;

[0007] After successful authentication, the client authentication IP and database management system information are cached in the target list based on the identity authentication credential, and the corresponding authentication result is returned so that the target management client in the target management machine sends an access authentication request data packet to the database management system based on the authentication result; the database management system information includes the database management system IP, database management system port and database management system account;

[0008] Intercept and parse the access authentication request data packet, obtain corresponding parsing information, query the database management system information from the target list according to the parsing information, and match the database management system information with the IP address of the database management system to be accessed, the port number of the database management system to be accessed, and the account number of the database management system to be accessed in the parsing information;

[0009] If the match is successful, the access authentication is determined to be successful, and the access authentication request data packet is forwarded to the database management system so that the database management system can perform identity authentication based on the database management system account and password to be accessed in the parsed information, and return the corresponding identity authentication result to the target management client to complete the identity authentication for accessing the database.

[0010] Optionally, before receiving the identity authentication request data packet of the database security hardening product client in the target management machine, the method further includes:

[0011] Configure the database management system IP, the database management system port and the database management system account, and configure the target management client IP and the identity authentication credential; wherein the identity authentication credential includes any one or a combination of user name, password, mobile phone number and certificate.

[0012] Optionally, caching the client authentication IP and database management system information to a target list based on the identity authentication credential includes:

[0013] Based on the identity authentication credentials, query the pre-configured target management client IP, the database management system IP, the database management system port and the database management system account;

[0014] Determine whether the target management client IP is consistent with the client authentication IP;

[0015] If they are consistent, the client authentication IP, the database management system IP, the database management system port and the database management system account are cached to the target list.

[0016] Optionally, after authenticating the database security hardening product client based on the authentication credentials in the authentication request data packet and obtaining a corresponding client authentication IP, the method further includes:

[0017] If the database security hardening product client authentication fails, the authentication result of the authentication failure is returned and the process ends directly.

[0018] Optionally, intercepting and parsing the access authentication request data packet, obtaining corresponding parsing information, and querying the database management system information from the target list according to the parsing information includes:

[0019] Intercepting the access authentication request data packet by means of a transparent proxy;

[0020] Parsing the access authentication request data packet to obtain the parsing information; the parsing information includes the target management client IP, the database management system to be accessed IP, the database management system to be accessed port and the database management system to be accessed account;

[0021] The database management system IP, the database management system port and the database management system account are queried from the target list according to the target management client IP.

[0022] Optionally, after matching the database management system information with the IP address of the database management system to be accessed, the port number of the database management system to be accessed, and the account number of the database management system to be accessed in the parsed information, the method further includes:

[0023] If the database management system information fails to match the database management system IP to be accessed, the database management system port to be accessed and the database management system account to be accessed, it is determined that the target management client has no access rights, the target management client is prohibited from performing identity authentication for accessing the database management system, and a result of access authentication failure is returned to the target management client.

[0024] Optionally, forwarding the access authentication request data packet to a database management system so that the database management system performs identity authentication based on the database management system account and password to be accessed in the parsed information, and returns a corresponding identity authentication result to the target management client to complete the identity authentication for accessing the database, including:

[0025] Forwarding the access authentication request data packet to the database management system so that the database management system performs identity authentication based on the database management system account and password to be accessed in the parsed information, and after the identity authentication is completed, returning the corresponding identity authentication result to the database security hardening product service end;

[0026] The identity authentication result is forwarded to the target management client to complete the identity authentication for accessing the database.

[0027] In a second aspect, the present application discloses an identity authentication device, which is applied to a database security reinforcement product server, including:

[0028] An identity authentication module is used to receive an identity authentication request data packet of a database security hardening product client in a target management machine, authenticate the database security hardening product client based on the identity authentication credentials in the identity authentication request data packet, and obtain a corresponding client authentication IP;

[0029] The authentication result returning module is used to cache the client authentication IP and database management system information to the target list based on the identity authentication credential after successful authentication, and return the corresponding authentication result so that the target management client in the target management machine sends an access authentication request data packet to the database management system based on the authentication result; the database management system information includes the database management system IP, database management system port and database management system account;

[0030] a matching module, configured to intercept and parse the access authentication request data packet, obtain corresponding parsing information, query the database management system information from the target list according to the parsing information, and match the database management system information with the IP address of the database management system to be accessed, the port number of the database management system to be accessed, and the account number of the database management system to be accessed in the parsing information;

[0031] The data packet forwarding module is used to determine that the access authentication is successful if the match is successful, and forward the access authentication request data packet to the database management system so that the database management system can perform identity authentication based on the database management system account and password to be accessed in the parsed information, and return the corresponding identity authentication result to the target management client to complete the identity authentication for accessing the database.

[0032] In a third aspect, the present application discloses an electronic device, comprising:

[0033] Memory, used to store computer programs;

[0034] The processor is used to execute the computer program to implement the aforementioned identity authentication method.

[0035] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned identity authentication method is implemented.

[0036] When performing identity authentication for database access, the application first receives an identity authentication request data packet from a database security hardening product client in a target management machine, performs identity authentication on the database security hardening product client based on the identity authentication credentials in the identity authentication request data packet and obtains a corresponding client authentication IP; after successful authentication, the client authentication IP and database management system information are cached in a target list based on the identity authentication credentials, and a corresponding authentication result is returned so that the target management client in the target management machine sends an access authentication request data packet to the database management system based on the authentication result; the database management system information includes a database management system IP, a database management system port and Database management system account; then intercept and parse the access authentication request data packet, obtain corresponding parsing information, query the database management system information from the target list according to the parsing information, and match the database management system information with the database management system IP to be accessed, the database management system port to be accessed and the database management system account to be accessed in the parsing information; finally, if the match is successful, it is determined that the access authentication is successful, and the access authentication request data packet is forwarded to the database management system, so that the database management system performs identity authentication based on the database management system account to be accessed and the password in the parsing information, and returns the corresponding identity authentication result to the target management client to complete the identity authentication for accessing the database. It can be seen that in this application, the database security hardening product client and the database security hardening product server are first used for identity authentication. The database security hardening product server queries the IP, port and account information of the database management system through the authentication client IP, and saves the information and the client IP together in the target list. When the target management client authenticates with the database management system, the authentication package is first intercepted, and then the authentication protocol is parsed and the authentication information is obtained. Finally, the authentication information is matched with the successfully authenticated client information. Only after the match is successful, the authentication of the database management system is released, thereby realizing the dual system authentication of the database security hardening product and the database management system. During the authentication process, the access authentication request data packet sent by the target management client is forwarded only once, which improves the efficiency of database access, and there is no need to modify the database client driver, saving the cost of implementing database identity authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0038] Figure 1 A flow chart of an identity authentication method disclosed in this application;

[0039] Figure 2 A schematic diagram of a specific identity authentication method disclosed in this application;

[0040] Figure 3 A signaling diagram of a specific identity authentication method disclosed in this application;

[0041] Figure 4 This is a schematic diagram of the structure of an identity authentication device disclosed in this application;

[0042] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] At present, to achieve dual-system authentication of database through VPN / gateway proxy, data needs to be forwarded from VPN client / gateway client to VPN server / gateway server, and then forwarded from VPN server / gateway server to database. The two proxies have a great impact on the access performance of the database and reduce the efficiency of accessing the database. In addition, to achieve dual-system authentication by modifying the database client driver, it is necessary to add a new authentication method to the database client driver, but each database has different client driver versions for different versions and different development languages ​​(C, Java, C#, etc.), resulting in a large number of driver versions that need to be modified, which greatly increases the cost of database client driver modification. In order to solve the above technical problems, the present application discloses an identity authentication method, device, equipment and medium, which can improve the database access efficiency and save the cost of database identity authentication while achieving dual-system authentication.

[0045] See also Figure 1 As shown, an embodiment of the present invention discloses an identity authentication method, which is applied to a database security reinforcement product server, and the method includes:

[0046] Step S11, receiving an identity authentication request data packet of a database security hardening product client in a target management machine, performing identity authentication on the database security hardening product client based on the identity authentication credentials in the identity authentication request data packet and obtaining a corresponding client authentication IP.

[0047] In this embodiment, before receiving the authentication request data packet of the database security hardening product client in the target management machine, the database security hardening product server needs to configure the database management system IP (i.e. Internet Protocol), database management system port and database management system account, and configure the target management client IP and authentication credentials; wherein the authentication credentials include any one or a combination of user name, password, mobile phone number and certificate. In this way, by configuring the database management system IP, database management system port, database management system account and target management client IP, it can be ensured that the database management system and the target management client can be successfully connected from the internal network or external network and corresponding operations can be performed. It should be pointed out that the target management machine is an application server / database management machine, and the database security hardening product server is deployed between the application server / database management machine and the database server.

[0048] In this embodiment, the database security hardening product server receives an authentication request data packet from a database security hardening product client in the target management machine, and authenticates the database security hardening product client based on the authentication credentials in the authentication request data packet. Among them, the basis for judging whether the database security hardening product client meets the authentication conditions is the authentication credentials contained in the authentication request data packet sent by the database security hardening product client, and the authentication credentials include but are not limited to user name, password, mobile phone number and certificate. In a specific embodiment, if the combination of user name and password is set as the authentication credential in the preset program, then after obtaining the authentication request data packet, the database security hardening product server will automatically parse the authentication request data packet to obtain the user name and password in the authentication request data packet, and authenticate the database security hardening product client based on the combination of user name and password.

[0049] Step S12: After successful authentication, the client authentication IP and database management system information are cached to the target list based on the identity authentication credentials, and the corresponding authentication result is returned so that the target management client in the target management machine sends an access authentication request data packet to the database management system based on the authentication result; the database management system information includes the database management system IP, database management system port and database management system account.

[0050] In this embodiment, after the database security hardening product server successfully authenticates the database security hardening product client, it queries the pre-configured client IP, database management system IP, port and account information through the client's authentication credentials, compares whether the client authentication IP is consistent with the client configured IP, and if consistent, saves the client authentication IP together with the database management system IP, port and account information to the list of successfully authenticated clients. And returns the corresponding authentication result to the database security hardening product client. Among them, caching the client authentication IP, database management system IP, database management system port and database management system account to the target list can improve the efficiency of the next call to the successfully authenticated identity authentication credentials and database management system information.

[0051] In this embodiment, after receiving the authentication result, the database security hardening product client can directly forward the authentication result to the target management client, or send the authentication result to the target management client after obtaining the authentication result acquisition request issued by the target management client. It should be noted that the target management client in the target management machine can only send an access authentication request data packet to the database security hardening product server after obtaining the authentication result indicating successful authentication. Among them, the target management client is the application / database management client, and the target list is a list of clients that have been successfully authenticated.

[0052] In addition, if the database security hardening product server fails to authenticate the database security hardening product client, the database security hardening product server will return an authentication result indicating the authentication failure to the database security hardening product client and directly end the authentication process.

[0053] Step S13, intercept and parse the access authentication request data packet, obtain corresponding parsing information, query the database management system information from the target list according to the parsing information, and match the database management system information with the database management system IP to be accessed, the database management system port to be accessed and the database management system account to be accessed in the parsing information.

[0054] In this embodiment, in order to complete the access authentication of the target management client, the application / database management client carries the database management system login account and password to perform identity authentication with the database management system, such as Figure 2As shown, the database security hardening product server intercepts the access authentication request data packet through a transparent proxy, and then parses the access authentication request data packet to obtain the target management client IP, the database management system IP to be accessed, the database management system port to be accessed, and the database management system account to be accessed; the database management system IP, database management system port, and database management system account are queried from the target list based on the target management client IP. In other words, the database security hardening product server first parses the authentication data packet of the application / database management client and the database management system, and obtains the client IP, the IP of the access database management system, the port, and the database login account, and other information, and uses this information to perform two identity authentications, as follows:

[0055] First, use the client IP authentication to match the IP in the successful authentication client list, and query the IP, port and account that have access to the database management system;

[0056] Then, the IP, port and account of the database management system to be accessed are matched with the IP, port and login account of the database management system queried above. A successful match indicates that the client has the right to access, and a failed match indicates that the client has no right to access and the identity authentication between the application / database management client and the database management system is blocked; that is, if the database management system information fails to match the IP, port and account of the database management system to be accessed, the target management client is determined to have no access rights, the target management client is prohibited from performing identity authentication to access the database management system, and the result of access authentication failure is returned to the target management client.

[0057] Step S14: If the match is successful, the access authentication is determined to be successful, and the access authentication request data packet is forwarded to the database management system so that the database management system performs identity authentication based on the database management system account and password to be accessed in the parsed information, and returns the corresponding identity authentication result to the target management client to complete the identity authentication for accessing the database.

[0058] In this embodiment, when the database security hardening product service end completes the two identifications in the previous step and succeeds, it releases the authentication data packet of the application / database management client to access the database management system, so that the database management system receives the authentication data packet of the application / database management client and performs identity authentication on the application / database management client login account and password in the parsed information; when the database management system completes the identity authentication of the target management client, it returns the corresponding identity authentication result to the database security hardening product service end; the database security hardening product service end will automatically release the identity authentication result, and the application / database management client receives the database management system identity authentication result, completing the dual system identity authentication for accessing the database.

[0059] In this way, after the authentication information is parsed successfully, it is necessary to match the successfully authenticated client IP and the permission information for accessing the database set in advance. Only after the match is successful can the identity authentication with the database management client be released, thereby realizing dual system identification between the application / database management client and the database management system and database security reinforcement product.

[0060] To summarize, in this application, the database security reinforcement product client and the database security reinforcement product server are first used for identity authentication. The database security reinforcement product server queries the IP, port and account information of the database management system through the authentication client IP, and saves the information and the client IP together in the target list. When the target management client authenticates with the database management system, the authentication package is first intercepted, and then the authentication protocol is parsed and the authentication information is obtained. Finally, the authentication information is matched with the successfully authenticated client information. Only after the match is successful, the authentication of the database management system is released, thereby realizing the dual system authentication of the database security reinforcement product and the database management system. During the authentication process, the access authentication request data packet sent by the target management client is forwarded only once, which improves the efficiency of database access, and there is no need to modify the database client driver, saving the cost of implementing database identity authentication.

[0061] Based on the above embodiment, it can be known that the present application discloses an identity authentication method, which can realize dual system authentication between the application / database management client and the database management system and the database security reinforcement product. Next, the specific identity authentication process will be described in detail.

[0062] like Figure 3As shown, before starting authentication, the database security hardening product administrator configures the IP and authentication credentials of the application server / database management client, accesses the database management system IP, port, and database management system login account. Then authentication begins, and the database security hardening client first authenticates the database security hardening server through the authentication credentials; after receiving the authentication credentials from the client, the database security hardening server performs identity authentication and obtains the client authentication IP. Among them, the authentication credentials are also identity authentication credentials, including user name, password, mobile phone number, and any one or a combination of certificates. It is used to identify the identity of the database security hardening product client and the application / database management client on the application server / database management machine.

[0063] After the database security hardening server successfully authenticates, it queries the pre-configured client IP, database management system IP, port, and account information through the client's authentication credentials, and compares the client authentication IP with the client-configured IP to see if they are consistent. If they are consistent, the client authentication IP is saved together with the database management system IP, port, and account information to the list of successfully authenticated clients. However, if the database security hardening server fails to authenticate, it returns an authentication result indicating that the authentication failed, and ends directly. The database security hardening server returns the authentication result to the database security hardening client.

[0064] Then, after receiving the authentication result of successful authentication, the application / database management client carries the database management system login account and password to authenticate the database management system; the database security hardening product server intercepts the authentication data packet of the application / database management client through a transparent proxy, and parses the authentication data packet to obtain the application / database management client IP, the database management system IP, port and database management system login account to be accessed. The database security hardening product server queries the database management system IP, port and database management system login account to access the database management system through the application / database management client IP to the list of successful authentication clients. Then, the database security hardening product server matches the database management system IP, port and database management system login account to be accessed with the above-queried database management system IP, port and database management system login account. If the database security hardening product server successfully matches, it means that it has the right to access. If the match fails, it means that it has no right to access and blocks the authentication between the application / database management client and the database management system; when the database security hardening product server successfully matches, the authentication data packet is released.

[0065] After receiving the authentication package from the application / database management client, the database management system will authenticate the account and password for logging into the database management system; and after successful authentication, the database management system will return authentication information to the application / database management client. At this time, the database security hardening product server directly releases the database management system to the application / database management client, and the dual system authentication is completed after the application / database management client receives the authentication result.

[0066] It can be seen that in this application, the database security hardening product client and the database security hardening product server first perform identity authentication, and then the database security hardening product server intercepts the authentication information between the application / database management client and the database management system through a transparent proxy and parses the information. After the analysis is successful, it is necessary to match the successfully authenticated client IP and the permission information for accessing the database set in advance. Only after the match is successful can the identity authentication with the database management client be released, thereby realizing dual system identification between the application / database management client and the database management system and the database security hardening product. At the same time, during the authentication process, the access authentication request data packet sent by the target management client is only forwarded once, which improves the database access efficiency, and there is no need to modify the database client driver, saving the cost of implementing database identity authentication.

[0067] See also Figure 4 As shown, the embodiment of the present application discloses an identity authentication device, which is applied to a database security reinforcement product server, including:

[0068] The identity authentication module 11 is used to receive an identity authentication request data packet of a database security hardening product client in a target management machine, authenticate the database security hardening product client based on the identity authentication credentials in the identity authentication request data packet, and obtain a corresponding client authentication IP;

[0069] The authentication result returning module 12 is used to cache the client authentication IP and database management system information to the target list based on the identity authentication credential after successful authentication, and return the corresponding authentication result so that the target management client in the target management machine sends an access authentication request data packet to the database management system based on the authentication result; the database management system information includes the database management system IP, database management system port and database management system account;

[0070] A matching module 13 is used to intercept and parse the access authentication request data packet, obtain corresponding parsing information, query the database management system information from the target list according to the parsing information, and match the database management system information with the IP address of the database management system to be accessed, the port number of the database management system to be accessed, and the account number of the database management system to be accessed in the parsing information;

[0071] The data packet forwarding module 14 is used to determine that the access authentication is successful if the match is successful, and forward the access authentication request data packet to the database management system so that the database management system can perform identity authentication based on the database management system account and password to be accessed in the parsed information, and return the corresponding identity authentication result to the target management client to complete the identity authentication for accessing the database.

[0072] It can be seen that in this application, the database security hardening product client and the database security hardening product server are first used for identity authentication. The database security hardening product server queries the IP, port and account information of the database management system through the authentication client IP, and saves the information and the client IP together in the target list. When the target management client authenticates with the database management system, the authentication package is first intercepted, and then the authentication protocol is parsed and the authentication information is obtained. Finally, the authentication information is matched with the successfully authenticated client information. Only after the match is successful, the authentication of the database management system is released, thereby realizing the dual system authentication of the database security hardening product and the database management system. During the authentication process, the access authentication request data packet sent by the target management client is forwarded only once, which improves the efficiency of database access, and there is no need to modify the database client driver, saving the cost of implementing database identity authentication.

[0073] In a specific embodiment, the device may further include:

[0074] A configuration module is used to configure the database management system IP, the database management system port and the database management system account, and configure the target management client IP and the identity authentication credential; wherein the identity authentication credential includes any one or a combination of a user name, a password, a mobile phone number and a certificate.

[0075] In a specific embodiment, the authentication result returning module 12 may specifically include:

[0076] A first query unit, configured to query the pre-configured target management client IP, the database management system IP, the database management system port and the database management system account based on the identity authentication credential;

[0077] An IP judgment unit is used to judge whether the target management client IP is consistent with the client authentication IP;

[0078] A cache unit is used to cache the client authentication IP, the database management system IP, the database management system port and the database management system account to the target list if they are consistent.

[0079] In a specific embodiment, the device may further include:

[0080] The first authentication failure operation module is used to return an authentication result of authentication failure and directly end if the database security hardening product client authentication fails.

[0081] In a specific embodiment, the matching module 13 may specifically include:

[0082] An interception unit, used for intercepting the access authentication request data packet by means of a transparent proxy;

[0083] A data packet parsing unit, used to parse the access authentication request data packet to obtain the parsing information; the parsing information includes the target management client IP, the database management system to be accessed IP, the database management system to be accessed port and the database management system to be accessed account;

[0084] The second query unit is used to query the database management system IP, the database management system port and the database management system account from the target list according to the target management client IP.

[0085] In a specific embodiment, the device may further include:

[0086] The second authentication failure operation module is used to determine that the target management client has no access rights if the database management system information fails to match the database management system IP, the database management system port and the database management system account to be accessed, prohibit the target management client from performing identity authentication for accessing the database management system, and return the result of access authentication failure to the target management client.

[0087] In a specific embodiment, the data packet forwarding module 14 may specifically include:

[0088] A data packet forwarding unit, used to forward the access authentication request data packet to the database management system, so that the database management system performs identity authentication based on the database management system account and password to be accessed in the parsed information, and after the identity authentication is completed, returns the corresponding identity authentication result to the database security hardening product service end;

[0089] The authentication result forwarding unit is used to forward the identity authentication result to the target management client to complete the identity authentication for accessing the database.

[0090] Furthermore, the present application also discloses an electronic device. Figure 5This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0091] Figure 5 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the identity authentication method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0092] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0093] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0094] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the identity authentication method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0095] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed identity authentication method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0096] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0097] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0098] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0099] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0100] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An identity authentication method, characterized in that: Applied to the database security hardening product server, including: Receive an identity authentication request data packet of a database security hardening product client in a target management machine, authenticate the database security hardening product client based on the identity authentication credentials in the identity authentication request data packet and obtain a corresponding client authentication IP; After successful authentication, the client authentication IP and database management system information are cached in the target list based on the identity authentication credential, and the corresponding authentication result is returned so that the target management client in the target management machine sends an access authentication request data packet to the database management system based on the authentication result; the database management system information includes the database management system IP, database management system port and database management system account; Intercept and parse the access authentication request data packet, obtain corresponding parsing information, query the database management system information from the target list according to the parsing information, and match the database management system information with the IP address of the database management system to be accessed, the port number of the database management system to be accessed, and the account number of the database management system to be accessed in the parsing information; If the match is successful, the access authentication is determined to be successful, and the access authentication request data packet is forwarded to the database management system so that the database management system can perform identity authentication based on the database management system account and password to be accessed in the parsed information, and return the corresponding identity authentication result to the target management client to complete the identity authentication for accessing the database.

2. The identity authentication method according to claim 1, characterized in that: Before receiving the identity authentication request data packet of the database security hardening product client in the target management machine, the method further includes: Configure the database management system IP, the database management system port and the database management system account, and configure the target management client IP and the identity authentication credential; wherein the identity authentication credential includes any one or a combination of user name, password, mobile phone number and certificate.

3. The identity authentication method according to claim 2, characterized in that: The caching the client authentication IP and database management system information to a target list based on the identity authentication credential includes: Based on the identity authentication credentials, query the pre-configured target management client IP, the database management system IP, the database management system port and the database management system account; Determine whether the target management client IP is consistent with the client authentication IP; If they are consistent, the client authentication IP, the database management system IP, the database management system port and the database management system account are cached to the target list.

4. The identity authentication method according to claim 1, characterized in that: After authenticating the database security hardening product client based on the authentication credentials in the authentication request data packet and obtaining the corresponding client authentication IP, the method further includes: If the database security hardening product client authentication fails, the authentication result of the authentication failure is returned and the process ends directly.

5. The identity authentication method according to claim 1, characterized in that: The step of intercepting and parsing the access authentication request data packet, obtaining corresponding parsing information, and querying the database management system information from the target list according to the parsing information includes: Intercepting the access authentication request data packet by means of a transparent proxy; Parse the access authentication request data packet to obtain the parsing information; the parsing information includes the target management client IP, the database management system to be accessed IP, the database management system to be accessed port and the database management system to be accessed account; The database management system IP, the database management system port and the database management system account are queried from the target list according to the target management client IP.

6. The identity authentication method according to claim 1, characterized in that: After matching the database management system information with the IP address, port and account of the database management system to be accessed in the parsed information, the method further includes: If the database management system information fails to match the database management system IP to be accessed, the database management system port to be accessed and the database management system account to be accessed, it is determined that the target management client has no access rights, the target management client is prohibited from performing identity authentication for accessing the database management system, and a result of access authentication failure is returned to the target management client.

7. The identity authentication method according to any one of claims 1 to 6, characterized in that: The step of forwarding the access authentication request data packet to the database management system so that the database management system performs identity authentication based on the database management system account and password to be accessed in the parsed information, and returns a corresponding identity authentication result to the target management client to complete the identity authentication for accessing the database, including: Forwarding the access authentication request data packet to the database management system so that the database management system performs identity authentication based on the database management system account and password to be accessed in the parsed information, and after the identity authentication is completed, returning the corresponding identity authentication result to the database security hardening product service end; The identity authentication result is forwarded to the target management client to complete the identity authentication for accessing the database.

8. An identity authentication device, characterized in that: Applied to the database security hardening product server, including: An identity authentication module is used to receive an identity authentication request data packet of a database security hardening product client in a target management machine, authenticate the database security hardening product client based on the identity authentication credentials in the identity authentication request data packet, and obtain a corresponding client authentication IP; The authentication result returning module is used to cache the client authentication IP and database management system information to the target list based on the identity authentication credential after successful authentication, and return the corresponding authentication result so that the target management client in the target management machine sends an access authentication request data packet to the database management system based on the authentication result; the database management system information includes the database management system IP, database management system port and database management system account; a matching module, configured to intercept and parse the access authentication request data packet, obtain corresponding parsing information, query the database management system information from the target list according to the parsing information, and match the database management system information with the IP address of the database management system to be accessed, the port number of the database management system to be accessed, and the account number of the database management system to be accessed in the parsing information; The data packet forwarding module is used to determine that the access authentication is successful if the match is successful, and forward the access authentication request data packet to the database management system so that the database management system can perform identity authentication based on the database management system account and password to be accessed in the parsed information, and return the corresponding identity authentication result to the target management client to complete the identity authentication for accessing the database.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the steps of the identity authentication method as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein, when the computer program is executed by a processor, the steps of the identity authentication method as described in any one of claims 1 to 7 are implemented.

Images