Database connection control method and device, computer equipment and readable storage medium

Abstract

The invention relates to a database connection control method and device, computer equipment and a readable storage medium. The method comprises the following steps: performing security detection on an application program under the condition of receiving a connection request of the application program, configuring corresponding connection information based on the connection request under the condition of determining that the security detection of the application program is passed, and further performing legality verification on the connection information in response to the connection information of the application program. And under the condition of determining that the connection information passes the legality verification, connecting the target data resource based on the connection information. According to the method, the application program is subjected to security detection before connection, so that security risks caused by security holes of the application program to the database are avoided, and the secure connection information is configured after the security detection is passed, so that the exposure of the database connection information is reduced. And the connection identity is checked during connection, so that the connection security of the database can be effectively protected, and data leakage is prevented.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a database connection control method, device, computer equipment, readable storage medium and program product. Background Art

[0002] In the process of enterprise informatization, the public basic data of the enterprise is generally managed by configuring the master data management platform. In order to enable downstream business applications to quickly obtain public data, the enterprise generally creates a database account in the database corresponding to the master data management platform and provides the database account to the downstream application system. The downstream application system obtains public data by configuring the JDBC (Java Database Connectivity, which is an application program interface used in the Java language to standardize how client programs access databases) connection method in the program.

[0003] However, there are serious security vulnerabilities in exchanging data through database accounts. For example, unreasonable database account permission settings leading to data unauthorized access, database account information leakage, and security risks in the application itself will cause security risks to the database. Summary of the invention

[0004] Based on this, it is necessary to provide a database connection control method, device, computer equipment, computer-readable storage medium and computer program product that can improve data security in response to the above technical problems.

[0005] In a first aspect, the present application provides a database connection control method, comprising:

[0006] Upon receiving a connection request from an application, performing a security check on the application, wherein the connection request is used to request connection to a target data resource;

[0007] If it is determined that the application program has passed the security check, configuring corresponding connection information based on the connection request, the connection information including a virtual address of a target data resource to which the application program requests to connect, and a temporary access key;

[0008] In response to the connection information of the application, performing a validity check on the connection information;

[0009] In the case where it is determined that the connection information passes the legality check, the target data resource is connected based on the connection information.

[0010] In one of the embodiments, after connecting to the target data resource based on the connection information, the method further comprises: periodically performing security checks on the application, and disconnecting from the target data resource if a security risk is detected.

[0011] In one of the embodiments, after connecting to the target data resource based on the connection information, the method further includes: upon receiving an operation instruction from the application, performing a security check on the operation instruction based on a preset operation permission configuration; upon determining that the operation instruction passes the security check, responding to the operation instruction from the application and operating the target data resource based on the operation instruction; upon determining that the operation instruction fails the security check, returning a prompt message indicating an operation failure to the application.

[0012] In one of the embodiments, when it is determined that the operation instruction passes the security check, the method further includes: generating a connection session ticket and returning the connection session ticket to the application, wherein the connection session ticket is used to instruct the application to carry the connection session ticket in subsequent database operations, and the connection session ticket has a valid duration; when an operation request carrying the connection session ticket is received from the application, if the connection session ticket is determined to be invalid based on the valid duration, returning to the step of performing a legitimacy check; when it is determined that the legitimacy check passes, restoring the status of the connection session ticket to be valid based on the valid duration.

[0013] In one of the embodiments, the method further includes: when it is determined that the application program fails a security check, or when it is determined that the connection information fails a legitimacy check, returning a prompt message indicating a connection failure to the application program.

[0014] In one of the embodiments, connecting the target data resource based on the connection information includes: obtaining a virtual address of the target data resource in the connection information; determining an actual address corresponding to the virtual address based on a preset address mapping relationship, and connecting the target data resource according to the actual address.

[0015] In one of the embodiments, the temporary access key is generated by an OTP algorithm based on the interface key of the application and the request time of the connection request.

[0016] In a second aspect, the present application provides a database connection control device, the device comprising:

[0017] A security detection module, configured to perform security detection on the application upon receiving a connection request from the application, wherein the connection request is used to request connection to a target data resource;

[0018] An information configuration module, configured to configure corresponding connection information based on the connection request when it is determined that the application program has passed the security detection, wherein the connection information includes a virtual address of a target data resource to which the application program requests to connect, and a temporary access key;

[0019] A verification module, configured to perform a validity verification on the connection information in response to the connection information of the application;

[0020] A connection module is used to connect the target data resource based on the connection information when it is determined that the connection information passes the legality check.

[0021] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method described in the first aspect when executing the computer program.

[0022] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described in the first aspect above.

[0023] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect above.

[0024] The above-mentioned database connection control method, device, computer equipment, computer-readable storage medium and computer program product, by performing a security check on the application when receiving a connection request from the application, configuring corresponding connection information based on the connection request when determining that the application has passed the security check, and then responding to the connection information of the application, performing a legality check on the connection information, and connecting to the target data resource based on the connection information when determining that the connection information has passed the legality check. It performs a security check on the application before connecting, thereby avoiding security risks to the database caused by security vulnerabilities of the application, and configures connection information including the virtual address of the target data resource and the temporary access key after the security check has passed, thereby reducing the exposure of the database connection information. It also checks whether the connection identity is legal when connecting, and only establishes a connection with the target data resource when the connection identity is confirmed to be legal, thereby effectively protecting the connection security of the database and preventing data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments of the present application or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0026] Figure 1 It is a schematic diagram of database connection in traditional technology;

[0027] Figure 2 A schematic diagram of a flow chart of a database connection control method in one embodiment;

[0028] Figure 3 A schematic diagram of a flow chart of a security control step during a connection process in an embodiment;

[0029] Figure 4 A flowchart of a session ticket control step in one embodiment;

[0030] Figure 5 A schematic diagram of a system architecture in an embodiment;

[0031] Figure 6 is a structural block diagram of a database connection control device in one embodiment;

[0032] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0034] like Figure 1 As shown, in traditional technologies, in order to enable downstream business applications to quickly obtain public data, enterprises generally create database accounts in the database corresponding to the master data management platform (usually created by the data administrator), provide the database accounts to the downstream application system, and assign account permissions. The downstream application system configures the JDBC connection method in the application through the program client to obtain public data. Specifically, when configuring the JDBC connection information, the account password is encrypted. After the database receives the connection information, it is decrypted by the decryption component to perform connection detection based on the decrypted information, and establish a connection when the detection passes.

[0035] However, the above-mentioned data exchange through database accounts has the risk of account and password leakage; the database connection address also has the risk of exposure, which in turn leads to the risk of security attacks; and when the database account permissions are not set properly, there is also the problem of data unauthorized access; in addition, when the application itself has security risks, it will also cause the database to be at risk of security attacks.

[0036] Based on this, the present application provides a database connection control method, which performs security checks on the application before the connection to avoid security risks to the database caused by security vulnerabilities in the application, and configures the virtual address of the target data resource and the temporary access key after the security check passes to achieve connection invisibility, thereby reducing the exposure of database connection information. When connecting, check whether the connection identity is legal, and only establish a connection with the target data resource if the connection identity is confirmed to be legal, thereby effectively protecting the connection security of the database and preventing data leakage.

[0037] In one embodiment, Figure 2 As shown, a database connection control method is provided. This embodiment uses the method applied to a server as an example. Specifically, the server is loaded with a JDBC driver of a database. It can be understood that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0038] Step 202: When receiving a connection request from an application, perform a security check on the application.

[0039] Among them, the connection request is used to request to connect to the target data resource. Security detection is used to detect whether the application is safe, specifically, including but not limited to detecting whether the application environment is safe, whether there are security vulnerabilities, etc. For example, it can detect whether the application has SQL (Structured Query Language) injection vulnerabilities, XSS attacks (Cross Site Scripting, which refers to the use of loopholes left during web page development to inject malicious instruction codes into web pages through clever methods, so that users can load and execute web programs maliciously created by attackers), etc. If there are no security vulnerabilities, it means that the application security detection has passed. If there are security vulnerabilities, it means that the application security detection has failed.

[0040] In this embodiment, when the server receives a connection request from an application to a target data resource, it may first call the JDBC driver to perform a security check on the application, and when it is determined that the application passes the security check, it may proceed based on subsequent steps.

[0041] In one scenario, when the JDBC driver determines that the application fails security detection, it can also return a connection failure prompt message to the application to reject the connection of the application with security risks, thereby improving the connection security.

[0042] Step 204: When it is determined that the application program passes the security check, corresponding connection information is configured based on the connection request.

[0043] The connection information includes the virtual address of the target data resource that the application requests to connect to, and the temporary access key. Specifically, the temporary access key can be generated by the JDBC driver based on the interface key of the application (also known as the application KEY, which is the unique identifier of the application and is used to ensure that the application is secure and controlled when calling the API) and the request time of the connection request through the OTP (One Time Password) algorithm. Therefore, the temporary access key is random and one-time (that is, it can only be used once), thereby avoiding security risks when the key is leaked. The interface key, also known as the application KEY, is the unique identifier of the application and is used to ensure that the application is secure and controlled when calling the API (Application Programming Interface). The virtual address can be the target data resource that the JDBC driver requests to connect to based on the application, and the logical address generated based on virtualization technology, which hides the real physical address of the target data resource, thereby avoiding the risk of exposing the database connection address.

[0044] In this embodiment, the JDBC driver performs a security check on the application based on the above steps, and when it is determined that the application passes the security check, the corresponding connection information is configured based on the above connection request, that is, the virtual address of the target data resource that the application requests to connect to, and the temporary access key. Since the temporary access key is random and one-time, it can avoid security risks when the key is leaked. The virtual address hides the real physical address of the target data resource, thereby avoiding the risk of exposing the database connection address.

[0045] Step 206: In response to the connection information of the application, perform a validity check on the connection information.

[0046] Among them, the legitimacy check can be used to verify the legitimacy of the identity of the application currently requesting a connection. Specifically, after configuring the corresponding connection information based on the above steps, the JDBC driver can return the connection information to the application so that the application can connect to the database based on the connection information. The JDBC driver responds to the connection information of the application connecting to the database, and performs a legitimacy check based on the connection information. For example, the temporary access key can be verified through OTP, or the connection information can be verified to match the application. And when it is determined that the connection information passes the legitimacy check, processing is performed based on subsequent steps.

[0047] In one scenario, when the JDBC driver determines that the connection information fails the validity check, it can also return a connection failure prompt message to the application to reject the connection of illegal applications, thereby improving the connection security.

[0048] Step 208: When it is determined that the connection information passes the validity check, connect to the target data resource based on the connection information.

[0049] In this embodiment, when the JDBC driver determines that the connection information passes the validity check, it can connect to the target data resource based on the corresponding connection information, that is, establish a JDBC connection.

[0050] In the above database connection control method, when receiving a connection request from an application, a security check is performed on the application. When it is determined that the application has passed the security check, the corresponding connection information is configured based on the connection request, and then the connection information is responded to by the connection information of the application, and the legitimacy of the connection information is checked. When it is determined that the connection information has passed the legitimacy check, the target data resource is connected based on the connection information. It performs a security check on the application before the connection, thereby avoiding security risks to the database caused by security vulnerabilities of the application, and configures the connection information including the virtual address of the target data resource and the temporary access key after the security check has passed, thereby reducing the exposure of the database connection information. When connecting, it checks whether the connection identity is legal, and only establishes a connection with the target data resource when the connection identity is confirmed to be legal, thereby effectively protecting the connection security of the database and preventing data leakage.

[0051] In an exemplary embodiment, in step 208, connecting to the target data resource based on the connection information may specifically include: obtaining the virtual address of the target data resource in the connection information; determining the actual address corresponding to the virtual address based on a preset address mapping relationship, and connecting to the target data resource according to the actual address.

[0052] The actual address may be the real physical address of the target data resource. Since the connection information is configured by the JDBC driver based on the target data resource that the application requests to connect to, the JDBC driver can also generate a corresponding address mapping relationship based on the configured virtual address of the target data resource and the actual address of the target data resource when configuring the connection information. When connecting to the target data resource based on the connection information, the corresponding actual address can be found according to the virtual address of the target data resource in the connection information, and the target data resource can be connected according to the actual address, thereby achieving a secure connection to the database. The entire connection process avoids the risk of exposing the database connection address.

[0053] In an exemplary embodiment, Figure 3 As shown, in step 208, after connecting to the target data resource based on the connection information, the method may further include:

[0054] Step 302: When an operation instruction of an application is received, a security check is performed on the operation instruction based on a preset operation authority configuration.

[0055] The operation instruction is an instruction or command for operating the target data resource, which may specifically include but is not limited to the creation instruction, deletion instruction, update instruction, insertion instruction, etc. of the database object. The operation permission configuration may be the pre-configuration of the permission table of the application or the data permission of the data resource.

[0056] In this embodiment, when the JDBC driver determines that the connection information has passed the legality check based on the above steps, it can connect to the target data resource based on the corresponding connection information, that is, establish a JDBC connection. Then, the operation instructions of the application can be monitored based on the JDBC connection, and when the operation instructions of the application are monitored, the operation instructions can be security checked based on the preset operation permission configuration. For example, it can detect whether the current operation instructions have unauthorized behavior (which can be achieved by configuring the rule library), whether the current operation time is abnormal (which can be achieved by behavior learning check), etc., or call the data resource permission service, and the data resource permission service determines whether the executed SQL operation, that is, the operation instruction, is reasonable according to the preset operation permission configuration. In this way, security detection of the operation instruction can be achieved.

[0057] Step 304, determine whether the security check is passed.

[0058] Specifically, when the JDBC driver determines that the operation instruction security check has passed, the JDBC driver may execute step 306 , and when the JDBC driver determines that the operation instruction security check has not passed, the JDBC driver may execute step 308 .

[0059] Step 306: In response to the operation instruction of the application program, operate the target data resource based on the operation instruction.

[0060] Specifically, when the JDBC driver determines that the operation instruction passes the security check, it can respond to the operation instruction of the application program and operate the target data resource based on the operation instruction, thereby ensuring the security of the operation.

[0061] Step 308: Return a prompt message indicating that the operation failed to the application.

[0062] Specifically, when the JDBC driver determines that the operation instruction fails the security check, it can return a prompt message indicating the operation failure to the application program to avoid erroneous operations.

[0063] In an exemplary embodiment, Figure 4 As shown, in the case where it is determined in the above steps that the operation instruction security detection passes, the above method may further include:

[0064] Step 402: Generate a connection session ticket and return the connection session ticket to the application.

[0065] The session token is used to instruct the application to carry the session token in subsequent database operations. Specifically, the session token has a certain validity period, that is, a validity period. For example, the validity period may be 10 minutes.

[0066] Specifically, when the JDBC driver determines that the operation instruction security check has passed, it can generate a unique connection session ticket and return the connection session ticket to the application so that the application can carry this ticket in subsequent database operations so that the JDBC driver can recognize it, thereby reducing frequent session verification and ensuring connection security.

[0067] Step 404: when receiving an operation request from an application program carrying a connection session ticket, if it is determined based on the validity period that the connection session ticket is invalid, then return to the step of performing a validity check.

[0068] Specifically, if the SESSION TOKEN is not updated or used within 10 minutes, it will become invalid. At this point, if the application attempts to perform database operations again, it needs to re-check the security, that is, return to the step of performing the legitimacy check. When the SESSION TOKEN expires, the JDBC driver will recheck the JDBC connection security to ensure that the connection remains secure even after the session token expires.

[0069] Step 406: If it is determined that the validity check has passed, the status of the connection session ticket is restored to be valid based on the validity period.

[0070] Specifically, when the session ticket expires, the JDBC driver rechecks the security of the JDBC connection. This may include the above-mentioned legitimacy check, security check, and network connection check. If the security check passes, the JDBC driver can restore the connection session ticket to a valid state based on the Session Resumption technology, thereby reducing the session ticket regeneration process to improve system performance, so that there is no need to generate a new session ticket every time. It is understandable that the restored session ticket can be updated according to the new 10-minute validity period, so that the new session ticket will continue to be valid until it expires again or the connection is manually disconnected.

[0071] In this embodiment, by reducing the frequent session reestablishment process, the system overhead can be significantly reduced, while ensuring that each connection is secure, thereby improving the performance and security of the system.

[0072] In an exemplary embodiment, in step 208, after connecting to the target data resource based on the connection information, the method may further include: periodically performing security checks on the application program, and disconnecting the connection with the target data resource if a security risk is detected.

[0073] Among them, security detection is used to detect whether the application is safe, specifically, including but not limited to detecting whether the environment of the application is safe, whether there are security vulnerabilities, etc. In this embodiment, during the JDBC connection process, the JDBC driver can also periodically perform security detection on the application. For example, a vulnerability scanner is enabled to scan whether the application has security vulnerabilities, and when risks are found, the connection of the application is blocked in time. That is to say, when the JDBC driver determines that a security risk is detected, it can disconnect the connection with the target data resource, that is, disconnect the JDBC connection. Thereby avoiding security risks to the database caused by security vulnerabilities in the application, and further improving the security of the connection.

[0074] In an exemplary embodiment, the above method can be applied to Figure 5 In the system architecture shown, specifically, the system architecture may include a JDBC connection proxy, a JDBC connection control center, a JDBC security detection service, and a JDBC connection session service.

[0075] Specifically, when an application wants to access a target data resource, it can initiate a connection request to the JDBC connection proxy. The JDBC connection proxy starts a local security check to scan for application security vulnerabilities, such as whether there are SQL injection vulnerabilities, XSS attacks, etc. If there are security vulnerabilities, it will prompt a connection failure. If the security check passes, it will request the JDBC connection control center to configure the connection information. The JDBC connection control center will generate connection information including the virtual connection address of the target data resource and the temporary access key for the application, and return it to the application.

[0076] The application configures the database connection information based on this, and requests the JDBC connection agent to connect to the database based on the connection information. The JDBC connection agent forwards the request to the JDBC connection control center, which verifies whether the connection information is legal, such as verifying the random password through OTP, whether the user is legal, etc., and connects to the target data resource based on the connection information when the verification passes. Specifically, the JDBC connection control center finds the real database connection information to connect to the data resource library based on the virtual database connection information, that is, establishes a JDBC connection.

[0077] During the JDBC connection process, the JDBC connection agent can periodically enable the vulnerability scanner and block the application connection in a timely manner when risks are found.

[0078] During the JDBC connection process, the JDBC connection control center can also call the JDBC security detection service, which checks whether the permission allocation of the current database account is reasonable, whether the executed SQL statement has exceeded the authority, and whether there is an abnormality in the application's database connection time. Specifically, some rule libraries can be placed, and some behavior learning checks can be performed. If no abnormality is detected, the SQL statement executed. If an abnormality is detected, a prompt message indicating that the operation failed is returned. Among them, whether the permission allocation is reasonable can be confirmed by the JDBC security detection service calling the data resource permission service. The data resource permission service can determine whether the executed SQL is reasonable based on the permission table or data permission allocated to the account.

[0079] When the JDBC security detection service passes, the JDBC connection control center can also request the JDBC connection session service to generate a SESSION TOKEN (connection session ticket). The validity period of the session ticket is uncertain, and the default validity period is generally 10 minutes. The session ticket is returned to the JDBC connection agent, and the subsequent JDBC connection will be attached with the session ticket. When the session ticket expires, the JDBC connection security is rechecked. When the security check passes, the session ticket is restored to a valid state based on Session Resumption, thereby reducing the regeneration process of the session ticket and improving system performance. At the same time, the session ticket can be valid for a new 10 minutes.

[0080] The above connection control method not only reduces the exposure of database connection information, but also dynamically checks JDBC connection risks through the JDBC proxy connector before connection and through the JDBC security detection service after connection, thereby strengthening JDBC connection risk control and effectively preventing data leakage.

[0081] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0082] Based on the same inventive concept, the embodiment of the present application also provides a database connection control device for implementing the database connection control method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more database connection control device embodiments provided below can refer to the limitations of the database connection control method above, and will not be repeated here.

[0083] In an exemplary embodiment, Figure 6 As shown, a database connection control device is provided, including: a security detection module 602, an information configuration module 604, a verification module 606 and a connection module 608, wherein:

[0084] A security detection module 602 is used to perform a security detection on the application program upon receiving a connection request from the application program, wherein the connection request is used to request a connection to a target data resource;

[0085] An information configuration module 604 is used to configure corresponding connection information based on the connection request when it is determined that the application program passes the security detection, wherein the connection information includes a virtual address of a target data resource to which the application program requests to connect, and a temporary access key;

[0086] A verification module 606, configured to perform a validity verification on the connection information in response to the connection information of the application;

[0087] The connection module 608 is used to connect the target data resource based on the connection information when it is determined that the connection information passes the legality check.

[0088] In an exemplary embodiment, the security detection module is further used to: periodically perform security detection on the application program, and disconnect the connection with the target data resource when it is determined that a security risk is detected.

[0089] In an exemplary embodiment, the security detection module is also used to: upon receiving an operation instruction from the application, perform a security check on the operation instruction based on a preset operation permission configuration; upon determining that the operation instruction passes the security check, respond to the operation instruction from the application and perform an operation on the target data resource based on the operation instruction; upon determining that the operation instruction fails the security check, return a prompt message indicating that the operation has failed to the application.

[0090] In an exemplary embodiment, the security detection module is also used to: generate a connection session ticket and return the connection session ticket to the application, wherein the connection session ticket is used to instruct the application to carry the connection session ticket in subsequent database operations, and the connection session ticket has a valid duration; upon receiving an operation request from the application carrying the connection session ticket, if the connection session ticket is determined to be invalid based on the valid duration, returning to the step of performing a legitimacy check; and if it is determined that the legitimacy check has passed, restoring the status of the connection session ticket to be valid based on the valid duration.

[0091] In an exemplary embodiment, the security detection module is also used to: when it is determined that the application program fails the security detection, or when it is determined that the connection information fails the legality check, return a prompt message indicating a connection failure to the application program.

[0092] In an exemplary embodiment, the connection module is further used to: obtain the virtual address of the target data resource in the connection information; determine the actual address corresponding to the virtual address based on a preset address mapping relationship, and connect the target data resource according to the actual address.

[0093] In an exemplary embodiment, the temporary access key is generated by an OTP algorithm based on the interface key of the application and the request time of the connection request.

[0094] Each module in the above-mentioned database connection control device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.

[0095] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store connection control data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a database connection control method is implemented.

[0096] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0097] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0098] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0099] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0100] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0101] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0102] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0103] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A database connection control method, characterized in that: The method comprises: Upon receiving a connection request from an application, performing a security check on the application, wherein the connection request is used to request connection to a target data resource; If it is determined that the application program has passed the security check, configuring corresponding connection information based on the connection request, the connection information including a virtual address of a target data resource to which the application program requests to connect, and a temporary access key; In response to the connection information of the application, performing a validity check on the connection information; In the case where it is determined that the connection information passes the legality check, the target data resource is connected based on the connection information.

2. The method according to claim 1, characterized in that After connecting to the target data resource based on the connection information, the method further includes: Periodically perform security checks on the application program, and disconnect the application program from the target data resource if a security risk is detected.

3. The method according to claim 1, characterized in that After connecting to the target data resource based on the connection information, the method further includes: When receiving an operation instruction from the application, performing a security check on the operation instruction based on a preset operation authority configuration; In the case of determining that the operation instruction passes the security check, responding to the operation instruction of the application program and operating the target data resource based on the operation instruction; When it is determined that the operation instruction fails the security check, a prompt message indicating that the operation failed is returned to the application.

4. The method according to claim 3, characterized in that When it is determined that the operation instruction passes the safety detection, the method further includes: Generate a connection session ticket, and return the connection session ticket to the application, wherein the connection session ticket is used to instruct the application to carry the connection session ticket in subsequent database operations, and the connection session ticket has a valid duration; In case of receiving an operation request from the application program carrying the connection session ticket, if it is determined based on the validity period that the connection session ticket is invalid, returning to the step of performing a legitimacy check; In the case where it is determined that the validity check has passed, the state of the connection session ticket is restored to be valid based on the validity period.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: When it is determined that the application program fails the security check, or when it is determined that the connection information fails the legality check, a prompt message indicating the connection failure is returned to the application program.

6. The method according to any one of claims 1 to 4, characterized in that: The connecting the target data resource based on the connection information includes: Obtaining the virtual address of the target data resource in the connection information; An actual address corresponding to the virtual address is determined based on a preset address mapping relationship, and the target data resource is connected according to the actual address.

7. The method according to any one of claims 1 to 4, characterized in that: The temporary access key is generated by an OTP algorithm based on the interface key of the application and the request time of the connection request.

8. A database connection control device, characterized in that: The device comprises: A security detection module, configured to perform security detection on the application upon receiving a connection request from the application, wherein the connection request is used to request connection to a target data resource; An information configuration module, configured to configure corresponding connection information based on the connection request when it is determined that the application program has passed the security detection, wherein the connection information includes a virtual address of a target data resource to which the application program requests to connect, and a temporary access key; A verification module, configured to perform a validity verification on the connection information in response to the connection information of the application; A connection module is used to connect the target data resource based on the connection information when it is determined that the connection information passes the legality check.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images