An identity authentication method, device, apparatus, and medium

Abstract

The application discloses an identity authentication method and device, equipment and medium, and relates to the field of communication, and comprises the following steps: an identity authentication credential in an identity authentication request data packet sent by a database security reinforcement product client is used for identity authentication by a database security reinforcement product server; after successful authentication, a client authentication IP and database management system information are cached to a target list, and an authentication result is returned, so that a target management client sends an access authentication request data packet based on the authentication result; the access authentication request data packet is parsed, database management system information is queried according to the parsed information, and the database management system information is matched with to-be-accessed database management system information; if the matching is successful, the access authentication request data packet is forwarded to the database management system for identity authentication, an identity authentication result is returned to the target management client, and identity authentication is completed. The application realizes double-system authentication of a database security reinforcement product and a database management system.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication, in particular to an identity authentication method, device, equipment and medium. BACKGROUND

[0002] With the rapid development of informatization, it has driven the prosperity of many industries, but also caused increasingly serious network security problems. Identity authentication, as the first link of information security protection, bears a vital role. According to the "GA_T 1574-2019 Information Security Technology Database Security Reinforcement Product Safety Technical Requirements", in addition to the database management system authentication, the database management system account should also pass through the identity authentication of the database security reinforcement product. At present, there are mainly two ways to support database dual system authentication. One is through VPN / gateway proxy (VPN, Virtual Private Network), in which data needs to be forwarded from the VPN client / gateway client to the VPN server / gateway server, and then from the VPN server / gateway server to the database. Twice proxy has a greater impact on the access performance of the database, resulting in low access efficiency to the database. The other way is to modify the database client driver. This way needs to add a new authentication method in the database client driver, but each database has different client driver versions for different versions and different development languages (C, Java, C# etc.), resulting in more modified driver versions and increasing the cost of database client driver modification.

[0003] In summary, how to realize database identity authentication while improving database access efficiency and saving the cost of database identity authentication implementation is a problem to be solved at present. SUMMARY

[0004] Therefore, the purpose of the present application is to provide an identity authentication method, device, equipment and medium, which can realize database identity authentication while improving database access efficiency and saving the cost of database identity authentication implementation. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses an identity authentication method applied to a database security reinforcement product server, comprising:

[0006] Receiving an identity authentication request data packet of a database security reinforcement product client in a target management machine, performing identity authentication on the database security reinforcement product client based on the identity authentication credential in the identity authentication request data packet and obtaining a corresponding client authentication IP;

[0007] After successful authentication, the client authentication IP and database management system information are cached to a target list based on the identity authentication credential, and a corresponding authentication result is returned, so that the target management client in the target management machine sends an access authentication request data packet to the database management system based on the authentication result; the database management system information includes a database management system IP, a database management system port and a database management system account;

[0008] The access authentication request data packet is intercepted and parsed to obtain corresponding parsing information, the database management system information is queried from the target list according to the parsing information, and the database management system information is matched with the to-be-accessed database management system IP, to-be-accessed database management system port and to-be-accessed database management system account in the parsing information;

[0009] If the matching is successful, it is determined that the access authentication is successful, and the access authentication request data packet is forwarded to the database management system, so that the database management system performs identity authentication based on the to-be-accessed database management system account and password in the parsing information, and returns a corresponding identity authentication result to the target management client, so as to complete the identity authentication of the accessed database.

[0010] Optionally, before receiving the identity authentication request data packet of the database security reinforcement product client in the target management machine, the method further comprises:

[0011] The database management system IP, the database management system port and the database management system account are configured, and a target management client IP and the identity authentication credential are configured; wherein the identity authentication credential includes any one or a combination of several of a username, a password, a mobile phone number and a certificate.

[0012] Optionally, the caching of the client authentication IP and the database management system information to the target list based on the identity authentication credential comprises:

[0013] The target management client IP, the database management system IP, the database management system port and the database management system account are queried based on the identity authentication credential.

[0014] It is judged whether the target management client IP is consistent with the client authentication IP.

[0015] If they are consistent, the client authentication IP, the database management system IP, the database management system port and the database management system account are cached to the target list.

[0016] Optionally, after the identity authentication of the database security reinforcement product client based on the identity authentication credential in the identity authentication request data packet and the acquisition of the corresponding client authentication IP, the method further comprises:

[0017] If the database security reinforcement product client authentication fails, an authentication result of authentication failure is returned, and the process is directly ended.

[0018] Optionally, the intercepting and analyzing of the access authentication request data packet to acquire corresponding analysis information and the querying of the database management system information from the target list according to the analysis information comprise:

[0019] The access authentication request data packet is intercepted in a transparent proxy manner;

[0020] The access authentication request data packet is analyzed to acquire the analysis information; the analysis information comprises a target management client IP, a to-be-accessed database management system IP, a to-be-accessed database management system port and a to-be-accessed database management system account;

[0021] The database management system IP, the database management system port and the database management system account are queried from the target list according to the target management client IP.

[0022] Optionally, after the matching of the database management system information with the to-be-accessed database management system IP, the to-be-accessed database management system port and the to-be-accessed database management system account in the analysis information, the method further comprises:

[0023] If the database management system information fails to match the to-be-accessed database management system IP, the to-be-accessed database management system port and the to-be-accessed database management system account, it is determined that the target management client has no access right, the target management client is prohibited from performing access database management system identity authentication, and a result of access authentication failure is returned to the target management client.

[0024] Optionally, the forwarding of the access authentication request data packet to the database management system so that the database management system performs identity authentication based on the to-be-accessed database management system account and password in the analysis information and returns a corresponding identity authentication result to the target management client to complete access database identity authentication comprises:

[0025] The access authentication request data packet is forwarded to the database management system so that the database management system performs identity authentication based on the to-be-accessed database management system account and password in the analysis information, and after the identity authentication is completed, a corresponding identity authentication result is returned to the database security reinforcement product server.

[0026] forward the identity authentication result to the target management client to complete identity authentication for accessing the database.

[0027] In a second aspect, the present application discloses an identity authentication device, applied to a database security reinforcement product server, comprising:

[0028] An identity authentication module is configured to receive an identity authentication request data packet of a database security reinforcement product client in a target management machine, perform identity authentication on the database security reinforcement product client based on an identity authentication credential in the identity authentication request data packet, and obtain a corresponding client authentication IP.

[0029] An authentication result returning module is configured to, after successful authentication, cache the client authentication IP and database management system information to a target list based on the identity authentication credential, and return a corresponding authentication result, so that a target management client in the target management machine sends an access authentication request data packet to a database management system based on the authentication result; the database management system information comprises a database management system IP, a database management system port, and a database management system account.

[0030] A matching module is configured to intercept and analyze the access authentication request data packet, obtain corresponding analysis information, query the database management system information from the target list according to the analysis information, and match the database management system information with a to-be-accessed database management system IP, a to-be-accessed database management system port, and a to-be-accessed database management system account in the analysis information.

[0031] A data packet forwarding module is configured to, if the matching is successful, determine that the access authentication is successful, forward the access authentication request data packet to the database management system, so that the database management system performs identity authentication based on a to-be-accessed database management system account and password in the analysis information, and returns a corresponding identity authentication result to the target management client, to complete identity authentication for accessing the database.

[0032] In a third aspect, the present application discloses an electronic device, comprising:

[0033] A memory is configured to save a computer program.

[0034] A processor is configured to execute the computer program to implement the identity authentication method.

[0035] In a fourth aspect, the present application discloses a computer readable storage medium, configured to store a computer program; wherein the computer program is executed by a processor to implement the identity authentication method.

[0036] In identity authentication of database access, the database security reinforcement product server first receives an identity authentication request data packet of a database security reinforcement product client in a target management machine, performs identity authentication on the database security reinforcement product client based on an identity authentication credential in the identity authentication request data packet and acquires a corresponding client authentication IP; after successful authentication, the client authentication IP and database management system information are cached to a target list based on the identity authentication credential, and a corresponding authentication result is returned, so that a target management client in the target management machine sends an access authentication request data packet to a database management system based on the authentication result; the database management system information includes a database management system IP, a database management system port and a database management system account; then the access authentication request data packet is intercepted and parsed to acquire corresponding parsed information, the database management system information is queried from the target list according to the parsed information, and the database management system information is matched with a to-be-accessed database management system IP, a to-be-accessed database management system port and a to-be-accessed database management system account in the parsed information; finally, if the matching is successful, it is determined that the access authentication is successful, the access authentication request data packet is forwarded to the database management system, so that the database management system performs identity authentication based on the to-be-accessed database management system account and password in the parsed information, and returns a corresponding identity authentication result to the target management client, to complete the identity authentication of accessing the database. It can be seen that in the present application, the database security reinforcement product client and the database security reinforcement product server are first authenticated, the database security reinforcement product server queries the IP, port and account information of the database management system through the authenticated client IP, saves the information and the client IP to the target list, when the target management client and the database management system are authenticated, the authentication packet is first intercepted, then the authentication protocol is parsed and the authentication information is obtained, finally the authentication information is matched with the successfully authenticated client information, and the authentication packet is released and the database management system is authenticated after the matching is successful, so as to realize the double-system authentication of the database security reinforcement product and the database management system. Only one forwarding of the access authentication request data packet sent by the target management client is performed in the authentication process, the database access efficiency is improved, and the database client driver does not need to be modified, thereby saving the cost of implementing the database identity authentication. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description only belong to the embodiments of the present application, and those skilled in the art can also obtain other drawings according to the provided drawings without any creative effort.

[0038] Figure 1 A flow chart of an identity authentication method disclosed by the present application;

[0039] Figure 2 A specific identity authentication method disclosed by the present application;

[0040] Figure 3 A specific identity authentication method disclosed by the present application;

[0041] Figure 4 A structure schematic diagram of an identity authentication device disclosed by the present application;

[0042] Figure 5 A structure diagram of an electronic device disclosed by the present application. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0044] At present, database dual-system authentication is realized through VPN / gateway proxy, and data needs to be forwarded from a VPN client / gateway client to a VPN server / gateway server, and then from the VPN server / gateway server to a database, and twice proxy has a great influence on the access performance of the database, which reduces the efficiency of accessing the database. In addition, dual-system authentication is realized by modifying the database client driver, which needs to add a new authentication mode in the database client driver, but each database has different client driver versions for different versions and different development languages (C, java, C#, etc.), resulting in a large number of modified driver versions, which greatly increases the modification cost of the database client driver. In order to solve the above technical problems, the present application discloses an identity authentication method, device, equipment and medium, which can realize dual-system authentication while improving the database access efficiency and saving the cost of implementing database identity authentication.

[0045] Referring to Figure 1 As shown in the figure, the embodiment of the present application discloses an identity authentication method applied to a database security reinforcement product server, and the method comprises:

[0046] Step S11, receiving an identity authentication request data packet of a database security reinforcement product client in a target management machine, performing identity authentication on the database security reinforcement product client based on an identity authentication credential in the identity authentication request data packet and obtaining a corresponding client authentication IP.

[0047] In this embodiment, before receiving the identity authentication request data packet of the database security reinforcement product client in the target management machine, the database security reinforcement product server needs to configure the database management system IP (i.e. Internet Protocol), the database management system port and the database management system account, and configure the target management client IP and the identity authentication credential; wherein the identity authentication credential includes any one or combination of several of the username, the password, the mobile phone number and the certificate. In this way, by configuring the database management system IP, the database management system port, the database management system account and the target management client IP, it can be ensured that the database management system and the target management client can be successfully connected from the internal network or the external network and corresponding operations can be performed. It should be noted that the target management machine is an application server / database management machine, and the database security reinforcement product server is deployed between the application server / database management machine and the database server.

[0048] In this embodiment, the database security reinforcement product server receives the identity authentication request data packet of the database security reinforcement product client in the target management machine, and performs identity authentication on the database security reinforcement product client based on the identity authentication credential in the identity authentication request data packet. The basis for judging whether the database security reinforcement product client meets the authentication condition is the identity authentication credential contained in the identity authentication request data packet sent by the database security reinforcement product client, which includes but is not limited to the username, the password, the mobile phone number and the certificate. In a specific embodiment, if the combination of the username and the password is set as the identity authentication credential in the preset program, the database security reinforcement product server will automatically parse the identity authentication request data packet to obtain the username and the password in the identity authentication request data packet after obtaining the identity authentication request data packet, and perform identity authentication on the database security reinforcement product client based on the combination of the username and the password.

[0049] Step S12, after successful authentication, cache the client authentication IP and the database management system information to the target list based on the identity authentication credential, and return the corresponding authentication result, so that the target management client in the target management machine sends an access authentication request data packet to the database management system based on the authentication result; the database management system information includes the database management system IP, the database management system port and the database management system account.

[0050] In this embodiment, after the database security reinforcement product server successfully authenticates the database security reinforcement product client, the database security reinforcement product server queries the pre-configured client IP, database management system IP, port and account information through the authentication credential of the client, compares whether the client authentication IP is consistent with the client configured IP, and if consistent, saves the client authentication IP, database management system IP, port and account information to the successful authentication client list. The database security reinforcement product server returns the corresponding authentication result to the database security reinforcement product client. The client authentication IP, database management system IP, database management system port and database management system account are cached to the target list, which can improve the efficiency of the next call of the successfully authenticated identity authentication credential and database management system information.

[0051] In this embodiment, after receiving the authentication result, the database security reinforcement product client can directly forward the authentication result to the target management client, or can send the authentication result to the target management client after obtaining the authentication result acquisition request sent by the target management client. It should be noted that the target management client in the target management machine can only send an access authentication request data packet to the database security reinforcement product server after obtaining the authentication result indicating successful authentication. The target management client is an application / database management client, and the target list is a successfully authenticated client list.

[0052] In addition, if the database security reinforcement product server fails to authenticate the identity of the database security reinforcement product client, the database security reinforcement product server will return an authentication result indicating identity authentication failure to the database security reinforcement product client, and directly end the current identity authentication process.

[0053] Step S13, intercept and parse the access authentication request data packet, obtain the corresponding parsed information, query the database management system information from the target list according to the parsed information, and match the database management system information with the to-be-accessed database management system IP, to-be-accessed database management system port and to-be-accessed database management system account in the parsed information.

[0054] In this embodiment, in order to complete the access authentication of the target management client, the application / database management client carries out identity authentication to the database management system with the database management system login account and password, such as Figure 2As shown, the database security reinforcement product server intercepts the access authentication request data packet through a transparent proxy, then parses the access authentication request data packet to obtain the target management client IP, the to-be-accessed database management system IP, the to-be-accessed database management system port and the to-be-accessed database management system account; and according to the target management client IP, queries the database management system IP, the database management system port and the database management system account from the target list. That is, the database security reinforcement product server first parses the authentication data packet of the application / database management client and the database management system, and obtains the client IP, the IP of the accessed database management system, the port and the database login account and other information, and performs two identity verifications through these information, which are as follows:

[0055] First, the client IP is used to authenticate to the successful authentication client list IP for matching, and the IP, port and account with access authority to the database management system are queried;

[0056] Then, the IP, port and account of the database management system to be accessed are matched with the database management system IP, port and database management system login account queried above, and the matching success indicates that there is access authority, and the matching failure indicates that there is no access authority and the identity authentication of the application / database management client and the database management system is blocked; that is, if the database management system information and the to-be-accessed database management system IP, the to-be-accessed database management system port and the to-be-accessed database management system account fail to match, it is determined that the target management client has no access authority, the identity authentication of the target management client to access the database management system is prohibited, and the result of access authentication failure is returned to the target management client.

[0057] Step S14, if the matching is successful, it is determined that the access authentication is successful, the access authentication request data packet is forwarded to the database management system, so that the database management system performs identity authentication based on the to-be-accessed database management system account and password in the parsing information, and returns the corresponding identity authentication result to the target management client, to complete the identity authentication of accessing the database.

[0058] In the embodiment, when the database security reinforcement product server completes the two authentications in the previous step and succeeds, the authentication data packet of the application / database management client accessing the database management system is released, so that the database management system receives the authentication data packet of the application / database management client and performs identity authentication on the application / database management client login account and password in the parsed information; when the database management system completes the identity authentication of the target management client, the corresponding identity authentication result is returned to the database security reinforcement product server; the database security reinforcement product server automatically releases the identity authentication result, the application / database management client receives the database management system identity authentication result, and completes the double-system identity authentication for accessing the database.

[0059] In this way, after the authentication information is parsed successfully, the IP of the client authenticated successfully needs to be matched with the permission information for accessing the database set in advance, and only after the matching succeeds, the identity authentication with the database management client can be released, so as to realize the double-system authentication between the application / database management client and the database management system and the database security reinforcement product.

[0060] In summary, in the present application, the database security reinforcement product client and the database security reinforcement product server are first used for identity authentication, the database security reinforcement product server queries the IP, port and account information of the database management system through the authenticated client IP, saves the information and the client IP to the target list, when the target management client and the database management system perform identity authentication, the authentication packet is first intercepted, then the authentication protocol is parsed and the authentication information is obtained, finally, the authentication information is matched with the successfully authenticated client information, and only after the matching succeeds, the authentication with the database management system is released, so as to realize the double-system authentication between the database security reinforcement product and the database management system. In the authentication process, only the access authentication request data packet sent by the target management client is forwarded once, the database access efficiency is improved, and the database client driver does not need to be modified, thereby saving the cost of realizing the database identity authentication.

[0061] Based on the previous embodiment, the present application discloses an identity authentication method, which can realize the double-system authentication between the application / database management client and the database management system and the database security reinforcement product. Next, the specific identity authentication process will be described in detail.

[0062] As Figure 3As shown, before starting authentication, the database security reinforcement product administrator configures the IP and authentication credentials of the application server / database management client, accesses the database management system IP, port and database management system login account. Then start the authentication, the database security reinforcement client first authenticates the identity to the database security reinforcement server through the authentication credentials; the database security reinforcement server receives the authentication credentials of the client and authenticates the identity, and obtains the client authentication IP. Among them, the authentication credentials, namely the identity authentication credentials, include any one or a combination of several of the username, password, mobile phone number and certificate. Used to identify the identity of the database security reinforcement product client and application / database management client on the application server / database management machine.

[0063] After the database security reinforcement server successfully authenticates the identity, the client's authentication credentials are used to query the pre-configured client IP, database management system IP, port and account information, and the client authentication IP is compared with the client configured IP. If they are consistent, the client authentication IP and the database management system IP, port and account information are saved to the successful authentication client list. However, if the database security reinforcement server fails to authenticate the identity, the authentication result of authentication failure is returned, and the process is directly ended. The database security reinforcement server returns the authentication result to the database security reinforcement client.

[0064] Then, after receiving the authentication result of successful authentication, the application / database management client carries out identity authentication to the database management system with the database management system login account and password; the database security reinforcement product server intercepts the identity authentication data packet of the application / database management client through transparent proxy, and parses the identity authentication data packet to obtain the application / database management client IP, the database management system IP, port and database management system login account to be accessed. The database security reinforcement product server queries the database management system IP, port and database management system login account to be accessed through the application / database management client IP in the successful identity authentication client list. Then, the database security reinforcement product server matches the database management system IP, port and database management system login account to be accessed with the database management system IP, port and database management system login account queried above. If the database security reinforcement product server matches successfully, it means that it has the right to access, and if it fails to match, it means that it has no right to access and blocks the identity authentication of the application / database management client and the database management system; when the database security reinforcement product server matches successfully, the authentication data packet is released.

[0065] The database management system receives the application / database management client authentication package, authenticates the database management system account and password, and returns authentication information to the application / database management client after successful authentication. At this time, the database security reinforcement product server directly releases the database management system to the application / database management client, and the application / database management client receives the authentication result, and the double-system authentication is completed.

[0066] It can be seen that in the present application, the database security reinforcement product client and the database security reinforcement product server first perform identity authentication, then the database security reinforcement product server intercepts the authentication information between the application / database management client and the database management system through a transparent proxy, parses the information, matches the authentication successful client IP and the pre-set access database permission information after successful parsing, and releases the identity authentication with the database management client after successful matching, thereby realizing the double-system authentication between the application / database management client and the database management system and the database security reinforcement product. In the authentication process, the access authentication request data packet sent by the target management client is only forwarded once, the database access efficiency is improved, and the database client driver does not need to be modified, thereby saving the cost of realizing database identity authentication.

[0067] Referring to Figure 4 The embodiment of the present application discloses an identity authentication device applied to a database security reinforcement product server, which comprises:

[0068] An identity authentication module 11 is configured to receive an identity authentication request data packet of a database security reinforcement product client in a target management machine, perform identity authentication on the database security reinforcement product client based on an identity authentication credential in the identity authentication request data packet, and obtain a corresponding client authentication IP;

[0069] An authentication result returning module 12 is configured to, after successful authentication, cache the client authentication IP and database management system information to a target list based on the identity authentication credential, and return a corresponding authentication result, so that a target management client in the target management machine sends an access authentication request data packet to a database management system based on the authentication result; the database management system information comprises a database management system IP, a database management system port, and a database management system account;

[0070] A matching module 13 is configured to intercept and parse the access authentication request data packet, obtain corresponding parsed information, query the database management system information from the target list according to the parsed information, and match the database management system information with a to-be-accessed database management system IP, a to-be-accessed database management system port, and a to-be-accessed database management system account in the parsed information.

[0071] The data packet forwarding module 14 is configured to, if the matching is successful, determine that the access authentication is successful, forward the access authentication request data packet to the database management system, so that the database management system performs identity authentication based on the to-be-accessed database management system account and password in the parsed information, and returns a corresponding identity authentication result to the target management client, so as to complete the identity authentication for accessing the database.

[0072] It can be seen that, in the present application, the database security reinforcement product client is first used to perform identity authentication with the database security reinforcement product server, the database security reinforcement product server queries the IP, port and account information of the database management system through the client IP, saves the information and the client IP to a target list, when the target management client performs identity authentication with the database management system, the authentication packet is first intercepted, the authentication protocol is parsed and the authentication information is obtained, and finally the authentication information is matched with the information of the successfully authenticated client, and only when the matching is successful, the authentication with the database management system is allowed, so as to realize the double-system authentication of the database security reinforcement product and the database management system. In the authentication process, only the access authentication request data packet sent by the target management client is forwarded once, the database access efficiency is improved, and the database client driver does not need to be modified, thereby saving the cost of implementing the database identity authentication.

[0073] In a specific embodiment, the apparatus can further include:

[0074] The configuration module is configured to configure the database management system IP, the database management system port and the database management system account, and configure the target management client IP and the identity authentication credential; wherein the identity authentication credential includes any one or a combination of several of a username, a password, a mobile phone number and a certificate.

[0075] In a specific embodiment, the authentication result returning module 12 can specifically include:

[0076] The first query unit is configured to query the target management client IP, the database management system IP, the database management system port and the database management system account pre-configured based on the identity authentication credential;

[0077] The IP judgment unit is configured to judge whether the target management client IP is consistent with the client authentication IP;

[0078] The cache unit is configured to, if the target management client IP is consistent with the client authentication IP, cache the client authentication IP, the database management system IP, the database management system port and the database management system account to the target list.

[0079] In a specific embodiment, the apparatus can further include:

[0080] The first authentication failure operation module is configured to return an authentication result of authentication failure and directly end if the database security reinforcement product client authentication fails.

[0081] In a specific embodiment, the matching module 13 can specifically include:

[0082] The interception unit is configured to intercept the access authentication request packet by means of a transparent proxy;

[0083] The packet analysis unit is configured to analyze the access authentication request packet to obtain the analysis information; the analysis information includes a target management client IP, the to-be-accessed database management system IP, a to-be-accessed database management system port, and a to-be-accessed database management system account;

[0084] The second query unit is configured to query the database management system IP, the database management system port, and the database management system account from the target list according to the target management client IP.

[0085] In a specific embodiment, the apparatus can further include:

[0086] The second authentication failure operation module is configured to determine that the target management client has no access right if the database management system information fails to match the to-be-accessed database management system IP, the to-be-accessed database management system port, and the to-be-accessed database management system account, prohibit the target management client from performing identity authentication for accessing the database management system, and return an access authentication failure result to the target management client.

[0087] In a specific embodiment, the packet forwarding module 14 can specifically include:

[0088] The packet forwarding unit is configured to forward the access authentication request packet to the database management system, so that the database management system performs identity authentication based on the to-be-accessed database management system account and password in the analysis information, and returns a corresponding identity authentication result to the database security reinforcement product server after the identity authentication is completed;

[0089] The authentication result forwarding unit is configured to forward the identity authentication result to the target management client to complete identity authentication for accessing the database.

[0090] Further, the embodiment of the present application further discloses an electronic device, Figure 5Fig. 1 is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content of the figure should not be considered as any limitation on the scope of use of the present application.

[0091] Figure 5 Fig. 1 is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content of the figure should not be considered as any limitation on the scope of use of the present application.

[0092] In the present embodiment, the power supply 23 is configured to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 is configured to create a data transmission channel between the electronic device 20 and external devices, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the present application, which will not be limited in detail herein; the input / output interface 25 is configured to obtain external input data or output data to the outside, and the specific interface type can be selected according to the specific application needs, which will not be limited in detail herein.

[0093] In addition, the memory 22 as a carrier for resource storage can be a read-only memory, a random access memory, a magnetic or optical disk, etc., and the resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage mode can be temporary storage or permanent storage.

[0094] The operating system 221 is configured to manage and control each hardware device on the electronic device 20 and the computer program 222, and can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program capable of completing the identity authentication method executed by the electronic device 20 disclosed in any of the preceding embodiments, the computer program 222 can further include a computer program capable of completing other specific work.

[0095] Further, the present application further discloses a computer readable storage medium for storing a computer program; wherein the computer program is executed by a processor to implement the identity authentication method disclosed above. For the specific steps of the method, reference can be made to the corresponding content disclosed in the preceding embodiments, which will not be repeated here.

[0096] The various embodiments described in the specification are progressive in nature, and each embodiment highlights the differences from other embodiments. The same or similar parts among the various embodiments can be mutually referred to. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method.

[0097] Those skilled in the art will further appreciate that the individual steps of the examples described in connection with the embodiments disclosed herein can be embodied in electronic hardware, computer software, or combinations of both. The various examples have been described in relation to the described embodiments, as a means of generalizing the interchangeability of hardware and software. Whether employing hardware or software, the described functionality is implemented as desired by the particular application and design constraints. Skilled artisans appreciate that the replacement of one part by a different part, the addition of new parts, or the removal of existing parts from a design, do not alter the basic underlying function of the inventive concept.

[0098] The steps of a method or algorithm described in connection with the embodiments disclosed herein can be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module can reside in random access memory (RAM), flash memory, read-only memory (ROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0099] Finally, it needs to be pointed out that, in this document, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or sequence between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0100] The above describes the technical solutions provided by the present application in detail, and the principles and implementation manners of the present application are described by using specific examples. The above description of the embodiments is only for helping to understand the method of the present application and its core idea; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manner and application range can be changed, and the above description of the specification should not be understood as limiting the present application.

Claims

1. An identity authentication method, characterized by, The application is applied to a database security reinforcement product server side, comprising: receiving an identity authentication request data packet of a database security reinforcement product client in a target management machine, performing identity authentication on the database security reinforcement product client based on identity authentication credentials in the identity authentication request data packet and obtaining a corresponding client authentication IP; after successful authentication, caching the client authentication IP and database management system information to a target list based on the identity authentication credentials, and returning a corresponding authentication result, so that a target management client in the target management machine sends an access authentication request data packet to a database management system based on the authentication result; the database management system information comprises a database management system IP, a database management system port and a database management system account; intercepting and analyzing the access authentication request data packet, obtaining corresponding analysis information, querying the database management system information from the target list according to the analysis information, and matching the database management system information with the to-be-accessed database management system IP, to-be-accessed database management system port and to-be-accessed database management system account in the analysis information; if the matching is successful, it is determined that the access authentication is successful, the access authentication request data packet is forwarded to the database management system, so that the database management system performs identity authentication based on the to-be-accessed database management system account and password in the analysis information, and returns a corresponding identity authentication result to the target management client, so as to complete the identity authentication of the access database.

2. The identity authentication method of claim 1, wherein, Before the receiving an identity authentication request data packet of a database security reinforcement product client in a target management machine, further comprising: configuring the database management system IP, the database management system port and the database management system account, and configuring a target management client IP and the identity authentication credentials; wherein the identity authentication credentials comprise any one or a combination of several of a username, a password, a mobile phone number and a certificate.

3. The identity authentication method of claim 2, wherein, The caching of the client authentication IP and database management system information to the target list based on the identity authentication credentials comprises: querying the target management client IP, the database management system IP, the database management system port and the database management system account pre-configured based on the identity authentication credentials; determining whether the target management client IP is consistent with the client authentication IP; if consistent, caching the client authentication IP, the database management system IP, the database management system port and the database management system account to the target list.

4. The identity authentication method of claim 1, wherein, After the identity authentication of the database security reinforcement product client based on the identity authentication credentials in the identity authentication request data packet and the obtaining of the corresponding client authentication IP, further comprising: if the database security reinforcement product client authentication fails, an authentication result of authentication failure is returned, and the process is directly ended.

5. The identity authentication method of claim 1, wherein, The intercepting and analyzing of the access authentication request data packet, the obtaining of corresponding analysis information, and the querying of the database management system information from the target list according to the analysis information comprise: Intercept the access authentication request data packet through a transparent proxy; Parse the access authentication request data packet to obtain the parsed information; the parsed information includes a target management client IP, the to-be-accessed database management system IP, to-be-accessed database management system port and to-be-accessed database management system account; According to the target management client IP, query the database management system IP, the database management system port and the database management system account from the target list.

6. The identity authentication method of claim 1, wherein, After matching the database management system information with the to-be-accessed database management system IP, to-be-accessed database management system port and to-be-accessed database management system account in the parsed information, the method further includes: If the database management system information fails to match the to-be-accessed database management system IP, to-be-accessed database management system port and to-be-accessed database management system account, it is determined that the target management client has no access right, the target management client is prohibited from performing identity authentication for accessing the database management system, and a result of access authentication failure is returned to the target management client.

7. The identity authentication method according to any one of claims 1 to 6, characterized in that, Forwarding the access authentication request data packet to the database management system so that the database management system performs identity authentication based on the to-be-accessed database management system account and password in the parsed information, and returns a corresponding identity authentication result to the target management client to complete identity authentication for accessing the database, including: Forwarding the access authentication request data packet to the database management system so that the database management system performs identity authentication based on the to-be-accessed database management system account and password in the parsed information, and returns a corresponding identity authentication result to the database security reinforcement product server after the identity authentication is completed; Forwarding the identity authentication result to the target management client to complete identity authentication for accessing the database.

8. An identity authentication apparatus characterized by comprising: Applied to a database security reinforcement product server, including: An identity authentication module is configured to receive an identity authentication request data packet of a database security reinforcement product client in a target management machine, perform identity authentication on the database security reinforcement product client based on identity authentication credentials in the identity authentication request data packet and obtain a corresponding client authentication IP; An authentication result returning module is configured to, after authentication succeeds, cache the client authentication IP and database management system information to a target list based on the identity authentication credentials, and return a corresponding authentication result, so that a target management client in the target management machine sends an access authentication request data packet to a database management system based on the authentication result; the database management system information includes a database management system IP, a database management system port and a database management system account; The matching module is used for intercepting and analyzing the access authentication request data packet, obtaining corresponding analysis information, querying the database management system information from the target list according to the analysis information, and matching the database management system information with the to-be-accessed database management system IP, to-be-accessed database management system port and to-be-accessed database management system account in the analysis information; The data packet forwarding module is used for determining that the access authentication is successful if the matching is successful, forwarding the access authentication request data packet to the database management system, so that the database management system performs identity authentication based on the to-be-accessed database management system account and password in the analysis information, and returns a corresponding identity authentication result to the target management client, so as to complete the identity authentication of the access database.

9. An electronic device, comprising: Comprise: A memory for saving a computer program; A processor for executing the computer program to realize the steps of the identity authentication method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, A computer program for storing; wherein the computer program is executed by the processor to realize the steps of the identity authentication method according to any one of claims 1 to 7.

Images