Database access method and device, equipment and storage medium

Abstract

The invention discloses a database access method, device and equipment and a storage medium, and is applied to the field of databases. The method comprises the following steps: sending a negotiated and encrypted operation and maintenance account to a database firewall through a security client, and decrypting and verifying the database firewall; and sending the corresponding negotiated and encrypted database account password to the security client, decrypting the database account password by the security client, and calling a database access tool to send the database account password to the target database so as to access the target data. According to the method, the self-developed security client interacts with the database firewall to verify the operation and maintenance account password, a unified negotiation encryption and decryption algorithm is adopted for data in the interaction process, the database firewall only needs to carry out negotiation encryption and decryption of a unified version, database encryption and decryption algorithms of different versions do not need to be built in, the universality is improved, and the operation and maintenance cost is reduced. And storage resources and computing resources are saved.

Description

Technical Field

[0001] The present invention relates to the field of databases, and in particular to a database access method, device, equipment and computer-readable storage medium. Background Art

[0002] Currently, the way operation and maintenance personnel access the database is generally that the database access tool sends the encrypted (database access tool and database encryption algorithm) operation and maintenance account to the database firewall, and the database firewall decrypts the operation and maintenance account (database access tool and database decryption algorithm) for verification. After successful verification, the database firewall encrypts the corresponding database account (database access tool and database encryption algorithm) and sends it to the database to be accessed for login, so as to enable the operation and maintenance personnel to access the database.

[0003] The encryption and decryption algorithms of different versions and types of databases may be different. When there are many operation and maintenance accounts and many database versions, the encryption and decryption algorithms of each database version need to be built into the database firewall. The database firewall needs to call different encryption and decryption algorithms according to the different databases accessed, which reduces versatility, occupies storage resources, and wastes computing resources. Summary of the invention

[0004] The purpose of the present invention is to provide a database access method, device, equipment and computer-readable storage medium, which are applied to the database field. The method interacts with the database firewall through a self-developed security client to verify the operation and maintenance account password. The data in the interaction process adopts a unified negotiated encryption and decryption algorithm. The database firewall only needs to perform a unified version of negotiated encryption and decryption, and there is no need to build in different versions of database encryption and decryption algorithms, which improves versatility and saves storage resources and computing resources.

[0005] In order to solve the above technical problems, the present invention provides a database access method, comprising:

[0006] The operation and maintenance account and password entered by the operation and maintenance personnel are encrypted by the negotiated encryption and decryption algorithm through the security client, assembled into a message to be verified and sent to the database firewall;

[0007] Calling the negotiated encryption and decryption algorithm in the database firewall to perform decryption analysis on the message to be verified, and obtaining the operation and maintenance account password and the IP identification of the operation and maintenance account password;

[0008] The database login information is sent to the database firewall by calling the database access tool through the security client, and the database firewall verifies whether the IP identifier of the database login information is consistent with the IP identifier of the operation and maintenance account password;

[0009] After verification, the database account password corresponding to the database login information is encrypted by the negotiated encryption and decryption algorithm through the database firewall and then sent to the security client;

[0010] The encrypted database account password is decrypted by calling the negotiated encryption and decryption algorithm through the security client, and the target database is connected based on the decrypted database account password and the database access tool.

[0011] Optionally, the method further includes:

[0012] Calling the database access tool through the security client to send a database operation instruction to the database firewall;

[0013] Verify through the database firewall whether the IP identification of the database operation instruction is consistent with the IP identification of the operation and maintenance account password;

[0014] After the verification is consistent, the database access permission information of the operation and maintenance account password is read through the database firewall to verify the database operation instruction, and the database operation instruction that fails the verification is intercepted.

[0015] Optionally, the step of encrypting the operation and maintenance account password input by the operation and maintenance personnel through the security client by using a negotiated encryption and decryption algorithm and assembling the encrypted password into a message to be verified and sending the message to the database firewall includes:

[0016] The operation and maintenance account password input by the operation and maintenance personnel is encrypted by the negotiated encryption and decryption algorithm through the security client and assembled into the message to be verified and the heartbeat information;

[0017] The message to be verified is sent to the database firewall, and the heartbeat information is sent to the database firewall at preset intervals.

[0018] Optionally, the method further includes:

[0019] When the security client receives the database access tool binding instruction, it reads the verification identifier of the database access tool to be bound based on the database access tool binding instruction;

[0020] The verification identifier of the database access tool to be bound is verified through the database access tool standard verification identifier built into the security client, and the database access tool to be bound that has been successfully verified is bound.

[0021] Optionally, the verification identifier of the database access tool to be bound is an MD5 identifier.

[0022] Optionally, calling the negotiated encryption and decryption algorithm by the security client to decrypt the encrypted database account password, and connecting to the target database based on the decrypted database account password and the database access tool, includes:

[0023] Decrypting the encrypted database account password by calling the negotiated encryption and decryption algorithm through the security client, and generating a CMD splicing command based on the database account password;

[0024] The CMD splicing command is sent to the database access tool through the security client to call the database access tool to connect to the target database.

[0025] Optionally, calling a database access tool through a security client to send database login information to the database firewall includes:

[0026] When the security client receives the database access tool call instruction, a login window including a database IP input box, a database port input box and a database name input box pops up;

[0027] When the security client receives the database login information input through the login window, the security client calls the database access tool to send the database login information to the database firewall.

[0028] In order to solve the above technical problems, the present invention provides a database access device, comprising:

[0029] The first module is used to encrypt the operation and maintenance account password entered by the operation and maintenance personnel through the security client through the negotiated encryption and decryption algorithm, assemble it into a message to be verified and send it to the database firewall;

[0030] The second module is used to call the negotiated encryption and decryption algorithm in the database firewall to perform decryption analysis on the message to be verified, and obtain the operation and maintenance account password and the IP identification of the operation and maintenance account password;

[0031] The third module is used to call the database access tool through the security client to send the database login information to the database firewall, and verify through the database firewall whether the IP identifier of the database login information is consistent with the IP identifier of the operation and maintenance account password;

[0032] The fourth module is used to encrypt the database account password corresponding to the database login information through the database firewall through the negotiated encryption and decryption algorithm and send it to the security client after verification;

[0033] The fifth module is used to decrypt the encrypted database account password by calling the negotiated encryption and decryption algorithm through the security client, and connect to the target database based on the decrypted database account password and the database access tool.

[0034] In order to solve the above technical problems, the present invention provides a database access device, comprising:

[0035] Memory, for storing computer programs;

[0036] A processor is used to implement the above-mentioned database access method when executing the computer program.

[0037] In order to solve the above technical problem, the present invention provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, the database access method as described above is implemented.

[0038] It can be seen that the method of the present invention encrypts the operation and maintenance account and password input by the operation and maintenance personnel through the security client through the negotiated encryption and decryption algorithm, assembles them into a message to be verified, and sends them to the database firewall; calls the negotiated encryption and decryption algorithm in the database firewall to decrypt and analyze the message to be verified, and obtains the operation and maintenance account and password and the IP identification of the operation and maintenance account and password; calls the database access tool through the security client to send the database login information to the database firewall, and verifies through the database firewall whether the IP identification of the database login information is consistent with the IP identification of the operation and maintenance account and password; after verification, encrypts the database account and password corresponding to the database login information through the database firewall through the negotiated encryption and decryption algorithm and sends them to the security client; calls the negotiated encryption and decryption algorithm through the security client to decrypt the encrypted database account and password, and connects to the target database based on the decrypted database account and password and the database access tool.

[0039] The method of the present invention interacts with the database firewall through a self-developed security client to verify the operation and maintenance account password. The data in the interaction process adopts a unified negotiated encryption and decryption algorithm. The database firewall only needs to perform a unified version of negotiated encryption and decryption, and there is no need to build in different versions of database encryption and decryption algorithms, which improves versatility and saves storage resources and computing resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0041] Figure 1 A flowchart of a database access method provided by an embodiment of the present invention;

[0042] Figure 2 This is a structural block diagram of a database access device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] At present, most database operation and maintenance personnel use shared accounts to meet the database access needs of different personnel. In actual work, it is common to see database accounts shared privately or publicly. As a result, data abuse / use by violators / malicious theft and other data security incidents are becoming more frequent, and the potential risks are also increasing, so the management of shared database accounts has become a thorny issue.

[0045] Database administrators can also implement permission control by using the authorization mechanism provided by the database system itself. However, when the number of enterprise databases is large, the number of R&D and operation personnel is large, and the data and personnel change frequently, the workload of this task will increase exponentially. How to deal with effective control and efficiency has become a difficult problem facing database administrators, so shared database accounts are usually used. However, shared accounts are prone to database account password leakage, and database access cannot implement minimum permissions and precise permissions. Even if the same database account is used, it is impossible to accurately trace the database access behavior to the specific operator for audit.

[0046] In the case where operation and maintenance personnel share database accounts, the usual means of protection is to deploy a database firewall in front of the database. Each operation and maintenance personnel is assigned an operation and maintenance account and password. After the login request data packet sent by the client passes through the database firewall, the encrypted operation and maintenance account password is replaced with the database account password to achieve one person per account.

[0047] Currently, the way operation and maintenance personnel access the database is generally that the database access tool sends the encrypted (database access tool and database encryption algorithm) operation and maintenance account to the database firewall, and the database firewall decrypts the operation and maintenance account (database access tool and database decryption algorithm) for verification. After successful verification, the database firewall encrypts the corresponding database account (database access tool and database encryption algorithm) and sends it to the database to be accessed for login, so as to enable the operation and maintenance personnel to access the database.

[0048] This technology requires a full understanding of the database login encryption algorithm, but a few database codes are public, and the encryption algorithms for different database versions of the same database are also different. The higher the version, the more complex the encryption algorithm used. As a result, this technology only supports some low-version databases with simple encryption algorithms. When there are many operation and maintenance accounts and many database versions, the encryption and decryption algorithms of each database version need to be built into the database firewall. The database firewall needs to call different encryption and decryption algorithms according to the different databases being accessed, which reduces versatility, occupies storage resources, and wastes computing resources.

[0049] The database firewall in the present invention only needs to perform the negotiated encryption and decryption of a unified version, and does not need to have different versions of database encryption and decryption algorithms built in, which improves versatility and saves storage resources. Since the database firewall only needs to send the negotiated encrypted database account password to the security client, there is no need to consider the application of other encryption algorithms. Therefore, the database firewall only needs to encrypt the built-in database account password once and then store it. Subsequent access by other personnel only needs to send the encrypted database account password to the security client, which saves computing resources.

[0050] The following combination Figure 1 , Figure 1 A flowchart of a database access method provided by an embodiment of the present invention, the method may include:

[0051] S101: The operation and maintenance account password input by the operation and maintenance personnel is encrypted by the negotiated encryption and decryption algorithm through the security client, and then assembled into a message to be verified and sent to the database firewall.

[0052] First, in this embodiment, a security client can be installed on the device of the operation and maintenance personnel, and the operation and maintenance account password entered by the operation and maintenance personnel is encrypted by the security client through a negotiated encryption algorithm and assembled into a message to be verified and sent to the database firewall.

[0053] The negotiated encryption algorithm of this embodiment is an encryption algorithm of a unified version negotiated by the security client and the database firewall. This embodiment does not limit the specific type of the negotiated encryption algorithm, which can be set based on actual application scenarios. The security client and the database firewall can have built-in negotiated encryption and decryption algorithms to achieve encrypted communication.

[0054] In this embodiment, basic information of the database can be configured in advance on the database firewall, such as the database IP, database port, database name, database account password and other necessary information required to log in to the database. In this embodiment, an operation and maintenance account password can be allocated to the operation and maintenance personnel on the database firewall, and the database access rights of each operation and maintenance account password can be set to generate database access rights information for each operation and maintenance account password.

[0055] This embodiment does not limit the specific content of the database access permission information, which may generally include accessible database information, accessible table information, and accessible row number information.

[0056] S102: Invoke the negotiated encryption and decryption algorithm in the database firewall to perform decryption analysis on the message to be verified, and obtain the operation and maintenance account password and the IP identifier of the operation and maintenance account password.

[0057] In this embodiment, the negotiated encryption and decryption algorithm may be called in the database firewall to perform decryption analysis on the message to be verified, thereby obtaining the operation and maintenance account password and the IP (Internet Protocol) identifier of the operation and maintenance account password.

[0058] In this embodiment, the operation and maintenance account password can be bound to the IP identifier of the operation and maintenance account password. Subsequently, the database firewall can trace the information by reading the IP identifier of the received information.

[0059] Furthermore, in order to ensure that there is always a correspondence between the IP and the account and password of the operation and maintenance personnel, this embodiment can send heartbeat information to the database firewall at regular intervals. Specifically, the operation and maintenance account and password entered by the operation and maintenance personnel are encrypted by the security client through the negotiated encryption and decryption algorithm and assembled into a message to be verified and a heartbeat information; the message to be verified is sent to the database firewall, and the heartbeat information is sent to the database firewall at preset time intervals. This embodiment does not limit the size of the preset time, and it can generally be set based on actual applications.

[0060] S103: The database access tool is called by the security client to send the database login information to the database firewall, and the database firewall verifies whether the IP identifier of the database login information is consistent with the IP identifier of the operation and maintenance account password.

[0061] In this embodiment, the database login information can be sent to the database firewall by calling the database access tool through the security client, and the database firewall can verify whether the IP identifier of the database login information is consistent with the IP identifier of the operation and maintenance account password.

[0062] The database login information in this embodiment may be information of a target database that the operation and maintenance personnel want to log in to, and may generally include a database IP, a database port, and a database name.

[0063] This embodiment does not limit the specific method of sending database login information. Generally, when the security client receives a database access tool call instruction, a login window containing a database IP input box, a database port input box and a database name input box pops up; when the security client receives the database login information entered through the login window, the database access tool is called by the security client to send the database login information to the database firewall.

[0064] In this embodiment, when the database access tool is used for the first time, it is necessary to bind and verify the database access tool. Specifically, after the security client receives the database access tool binding instruction, it reads the verification identifier of the database access tool to be bound based on the database access tool binding instruction; verifies the verification identifier of the database access tool to be bound by the database access tool standard verification identifier built into the security client, and binds the database access tool to be bound that has been successfully verified. Through the verification identifier, the problem of attacks such as database ransomware / data leakage caused by the low credibility of the database access tool used is avoided.

[0065] In this embodiment, the verification identifier of the database access tool to be bound is an MD5 identifier, which is a widely used cryptographic hash function. The security client may have a built-in standard MD5 identifier of a commonly used database access tool, and the MD5 identifier of the database access tool to be bound is verified by the standard MD5 identifier of the database access tool built into the security client, and the successfully verified database access tool to be bound is bound.

[0066] This embodiment does not limit the specific method of triggering the database access tool binding instruction. Generally, the security client may have built-in icons of various database access tools, and the corresponding database access tool binding instruction can be triggered by clicking the database access tool icon.

[0067] Furthermore, this embodiment does not limit the specific method of triggering the database access tool call instruction. After the database access tool is bound to the security client, the database access tool call instruction of the corresponding data access tool can be triggered by clicking the database access tool icon.

[0068] S104: After verification, the database account password corresponding to the database login information is encrypted by the negotiated encryption and decryption algorithm through the database firewall and then sent to the security client.

[0069] In this embodiment, when the IP identifier of the database login information is verified to be consistent with the IP identifier of the operation and maintenance account password, it can be determined that the database login information is information entered by the operation and maintenance personnel and is credible information.

[0070] Since the number of operation and maintenance accounts and passwords is not limited, when multiple operation and maintenance accounts and passwords are logged in at the same time, there may be multiple operation and maintenance accounts and passwords and their corresponding IP identifiers in the database firewall. In this embodiment, the IP identifier of the database login information can be verified one by one with the IP identifier of the operation and maintenance account and password bound in the database firewall until it is determined that the IP identifier of the operation and maintenance account and password is consistent with the IP identifier of the database login information, and the database login information can be determined to be credible information.

[0071] In this embodiment, the database account password corresponding to the database login information can be encrypted by the database firewall through the negotiated encryption and decryption algorithm and then sent to the security client. Since the basic information of the database is configured on the database firewall, this embodiment can determine the database account password of the target database to be logged in based on the database login information. The database firewall can encrypt the database account password of the target database through the negotiated encryption and decryption algorithm and then send it to the security client. In this embodiment, each operation and maintenance personnel can install a security client, and this embodiment can determine the security client that receives the encrypted database account password through the IP identifier of the database login information.

[0072] S105: The encrypted database account password is decrypted by calling the negotiated encryption and decryption algorithm through the security client, and the target database is connected based on the decrypted database account password and the database access tool.

[0073] In this embodiment, after the security client receives the encrypted database account password, the encrypted database account password can be decrypted by calling the negotiated encryption and decryption algorithm through the security client, and the target database can be connected based on the decrypted database account password and the database access tool. Specifically, the encrypted database account password can be decrypted by calling the negotiated encryption and decryption algorithm through the security client, and a CMD (command prompt) splicing command can be generated based on the database account password; the CMD splicing command can be sent to the database access tool through the security client to call the database access tool to connect to the target database, so as to skip the database login window and directly enter the login completion interface, thereby improving login efficiency.

[0074] Furthermore, since the database access permission information of each operation and maintenance account and password is pre-set in the database firewall, the database operation instructions can be verified through the database firewall in this embodiment. The present embodiment does not limit the specific method of verification. Generally, the database operation instructions can be sent to the database firewall by calling the database access tool through the security client; the database firewall is used to verify whether the IP identifier of the database operation instruction is consistent with the IP identifier of the operation and maintenance account and password; after the verification is consistent, the database permission information of the operation and maintenance account and password is read through the database firewall to verify the database operation instruction, and the database operation instructions that fail the verification are intercepted.

[0075] Specifically, by verifying whether the IP identifier of the database operation instruction is consistent with the IP identifier of the operation and maintenance account and password, it can be determined whether the database operation instruction is a trusted instruction sent by the operation and maintenance personnel; further, the database permission information of the operation and maintenance account and password is read by the database firewall to verify the permission of the data operation instruction. If the data operation instruction meets the requirements of the corresponding database permission information, the database firewall can send the data operation instruction to the database for execution; if the data operation instruction does not meet the requirements of the corresponding database permission information, the database firewall can intercept the database operation instruction.

[0076] Furthermore, after interception, this embodiment can return database operation instruction interception information to the security client through the database firewall, so that the operation and maintenance personnel know that the database operation instruction has not been successfully executed.

[0077] Based on the above embodiments, the method of the present invention interacts with the database firewall through a self-developed security client to verify the operation and maintenance account password. The data in the interaction process adopts a unified negotiated encryption and decryption algorithm. The database firewall only needs to perform a unified version of negotiated encryption and decryption, and there is no need to build in different versions of database encryption and decryption algorithms, which improves versatility and saves storage resources and computing resources.

[0078] The following combination Figure 2 , Figure 2 A structural block diagram of a database access device provided by an embodiment of the present invention, the device may include:

[0079] The first module 100 is used to encrypt the operation and maintenance account password input by the operation and maintenance personnel through the negotiated encryption and decryption algorithm through the security client, assemble it into a message to be verified and send it to the database firewall;

[0080] The second module 200 is used to call the negotiated encryption and decryption algorithm in the database firewall to perform decryption analysis on the message to be verified, and obtain the operation and maintenance account password and the IP identifier of the operation and maintenance account password;

[0081] The third module 300 is used to call the database access tool through the security client to send the database login information to the database firewall, and verify through the database firewall whether the IP identifier of the database login information is consistent with the IP identifier of the operation and maintenance account password;

[0082] The fourth module 400 is used to encrypt the database account password corresponding to the database login information through the database firewall using the negotiated encryption and decryption algorithm and then send it to the security client after verification;

[0083] The fifth module 500 is used to decrypt the encrypted database account password by calling the negotiated encryption and decryption algorithm through the security client, and connect to the target database based on the decrypted database account password and the database access tool.

[0084] Based on the above embodiment, the device may further include:

[0085] The sixth module is used to call the database access tool through the security client to send a database operation instruction to the database firewall;

[0086] The seventh module is used to verify through the database firewall whether the IP identifier of the database operation instruction is consistent with the IP identifier of the operation and maintenance account password;

[0087] The eighth module is used to verify the consistency by reading the database access permission information of the operation and maintenance account password through the database firewall to verify the database operation instruction, and intercept the database operation instruction that fails the verification.

[0088] Based on the above embodiments, the first module 100 may include:

[0089] The first unit is used to encrypt the operation and maintenance account password input by the operation and maintenance personnel through the negotiated encryption and decryption algorithm through the security client and assemble them into the message to be verified and the heartbeat information;

[0090] The second unit is used to send the message to be verified to the database firewall, and send the heartbeat information to the database firewall at preset time intervals.

[0091] Based on the above embodiments, the device may further include:

[0092] A ninth module is configured to read the verification identifier of the database access tool to be bound based on the database access tool binding instruction after the security client receives the database access tool binding instruction;

[0093] The tenth module is used to verify the verification identifier of the database access tool to be bound through the database access tool standard verification identifier built into the security client, and bind the database access tool to be bound that has been successfully verified.

[0094] Based on the above embodiments, the verification identifier of the database access tool to be bound is an MD5 identifier.

[0095] Based on the above embodiments, the fifth module 500 may include:

[0096] The third unit is used to decrypt the encrypted database account password by calling the negotiated encryption and decryption algorithm through the security client, and generate a CMD splicing command based on the database account password;

[0097] The fourth unit is used to send the CMD splicing command to the database access tool through the security client to call the database access tool to connect to the target database.

[0098] Based on the above embodiments, the third module 300 may include:

[0099] The fifth unit is used to pop up a login window including a database IP input box, a database port input box and a database name input box when the security client receives a database access tool call instruction;

[0100] The sixth unit is configured to, when the security client receives the database login information input through the login window, call the database access tool through the security client to send the database login information to the database firewall.

[0101] Based on the above embodiments, the present invention further provides a database access device, which may include a memory and a processor, wherein the memory stores a computer program, and when the processor calls the computer program in the memory, the steps provided in the above embodiments may be implemented. Of course, the device may also include various necessary network interfaces, power supplies, and other components.

[0102] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by an execution terminal or a processor, the method provided in the embodiment of the present invention can be implemented; the storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0103] In this article, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

Claims

1. A database access method, characterized in that: include: The operation and maintenance account and password entered by the operation and maintenance personnel are encrypted by the negotiated encryption and decryption algorithm through the security client, assembled into a message to be verified and sent to the database firewall; Calling the negotiated encryption and decryption algorithm in the database firewall to perform decryption analysis on the message to be verified, and obtaining the operation and maintenance account password and the IP identification of the operation and maintenance account password; The database login information is sent to the database firewall by calling the database access tool through the security client, and the database firewall verifies whether the IP identifier of the database login information is consistent with the IP identifier of the operation and maintenance account password; After verification, the database account password corresponding to the database login information is encrypted by the negotiated encryption and decryption algorithm through the database firewall and then sent to the security client; The encrypted database account password is decrypted by calling the negotiated encryption and decryption algorithm through the security client, and the target database is connected based on the decrypted database account password and the database access tool.

2. The database access method according to claim 1, characterized in that: Also includes: Calling the database access tool through the security client to send a database operation instruction to the database firewall; Verify through the database firewall whether the IP identification of the database operation instruction is consistent with the IP identification of the operation and maintenance account password; After the verification is consistent, the database access permission information of the operation and maintenance account password is read through the database firewall to verify the database operation instruction, and the database operation instruction that fails the verification is intercepted.

3. The database access method according to claim 1, characterized in that: The operation and maintenance account password input by the operation and maintenance personnel is encrypted by the security client through the negotiated encryption and decryption algorithm, and then assembled into a message to be verified and sent to the database firewall, including: The operation and maintenance account password input by the operation and maintenance personnel is encrypted by the negotiated encryption and decryption algorithm through the security client and assembled into the message to be verified and the heartbeat information; The message to be verified is sent to the database firewall, and the heartbeat information is sent to the database firewall at preset intervals.

4. The database access method according to claim 1, characterized in that: Also includes: When the security client receives the database access tool binding instruction, it reads the verification identifier of the database access tool to be bound based on the database access tool binding instruction; The verification identifier of the database access tool to be bound is verified through the database access tool standard verification identifier built into the security client, and the database access tool to be bound that has been successfully verified is bound.

5. The database access method according to claim 4, characterized in that: The verification identifier of the database access tool to be bound is an MD5 identifier.

6. The database access method according to claim 1, characterized in that: The method of decrypting the encrypted database account password by calling the negotiated encryption and decryption algorithm through the security client, and connecting to the target database based on the decrypted database account password and the database access tool, includes: Decrypting the encrypted database account password by calling the negotiated encryption and decryption algorithm through the security client, and generating a CMD splicing command based on the database account password; The CMD splicing command is sent to the database access tool through the security client to call the database access tool to connect to the target database.

7. The database access method according to claim 1, characterized in that: The step of calling a database access tool through a security client to send database login information to the database firewall includes: When the security client receives the database access tool call instruction, a login window including a database IP input box, a database port input box and a database name input box pops up; When the security client receives the database login information input through the login window, the security client calls the database access tool to send the database login information to the database firewall.

8. A database access device, characterized in that: include: The first module is used to encrypt the operation and maintenance account password entered by the operation and maintenance personnel through the security client through the negotiated encryption and decryption algorithm, assemble it into a message to be verified and send it to the database firewall; The second module is used to call the negotiated encryption and decryption algorithm in the database firewall to perform decryption analysis on the message to be verified, and obtain the operation and maintenance account password and the IP identification of the operation and maintenance account password; The third module is used to call the database access tool through the security client to send the database login information to the database firewall, and verify through the database firewall whether the IP identifier of the database login information is consistent with the IP identifier of the operation and maintenance account password; The fourth module is used to encrypt the database account password corresponding to the database login information through the database firewall through the negotiated encryption and decryption algorithm and send it to the security client after verification; The fifth module is used to decrypt the encrypted database account password by calling the negotiated encryption and decryption algorithm through the security client, and connect to the target database based on the decrypted database account password and the database access tool.

9. A database access device, characterized in that: include: Memory, for storing computer programs; A processor, configured to implement the database access method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the database access method according to any one of claims 1 to 7 is implemented.

Images