Database access method, device, equipment and storage medium

Abstract

The present invention discloses a database access method, device, equipment and storage medium, which are applied to the database field. The method sends the negotiated encrypted operation and maintenance account to the database firewall through a security client. The database firewall decrypts and verifies the operation and maintenance account and password, and sends the corresponding negotiated encrypted database account and password to the security client. The security client decrypts the database account and password, calls a database access tool to send the database account and password to the target database to connect to the target data for access. The method of the present invention verifies the operation and maintenance account and password through the interaction between the self-developed security client and the database firewall. The data of the interaction process adopts a unified negotiated encryption and decryption algorithm. The database firewall only needs to perform a unified version of negotiated encryption and decryption, and does not need to have different versions of database encryption and decryption algorithms built in, thereby improving versatility and saving storage resources and computing resources.

Description

Technical Field

[0001] The present invention relates to the field of databases, and in particular to a database access method, apparatus, device and computer-readable storage medium. Background Art

[0002] Currently, the way operation and maintenance personnel access the database is generally that the database access tool sends the encrypted (database access tool and database encryption algorithm) operation and maintenance account to the database firewall. The database firewall decrypts the operation and maintenance account (database access tool and database decryption algorithm) for verification. After successful verification, the database firewall encrypts the corresponding database account (database access tool and database encryption algorithm) and sends it to the database to be accessed for login, thereby enabling the operation and maintenance personnel to access the database.

[0003] The encryption and decryption algorithms for different versions and types of databases may be different. When there are many operation and maintenance accounts and many database versions, the encryption and decryption algorithms for each database version need to be built into the database firewall. The database firewall needs to call different encryption and decryption algorithms according to the different databases being accessed, which reduces versatility, occupies storage resources, and wastes computing resources. Summary of the Invention

[0004] The purpose of the present invention is to provide a database access method, device, equipment and computer-readable storage medium, which are applied to the database field. The method interacts with the database firewall through a self-developed security client to verify the operation and maintenance account password. The data in the interaction process adopts a unified negotiated encryption and decryption algorithm. The database firewall only needs to perform a unified version of negotiated encryption and decryption, and does not need to have different versions of database encryption and decryption algorithms built in, which improves versatility and saves storage resources and computing resources.

[0005] To solve the above technical problems, the present invention provides a database access method, comprising:

[0006] The security client encrypts the operation and maintenance account and password entered by the operation and maintenance personnel using the negotiated encryption and decryption algorithm, assembles the encrypted message into a verification message, and sends it to the database firewall.

[0007] Calling the negotiated encryption and decryption algorithm within the database firewall to perform decryption analysis on the message to be verified, and obtaining the operation and maintenance account password and the IP identifier of the operation and maintenance account password;

[0008] The database login information is sent to the database firewall by calling the database access tool through the security client, and the database firewall verifies whether the IP identifier of the database login information is consistent with the IP identifier of the operation and maintenance account password;

[0009] After verification, the database account and password corresponding to the database login information are encrypted by the negotiated encryption and decryption algorithm through the database firewall and then sent to the security client;

[0010] The encrypted database account password is decrypted by calling the negotiated encryption and decryption algorithm through the security client, and the target database is connected based on the decrypted database account password and the database access tool.

[0011] Optionally, the method further includes:

[0012] Calling the database access tool through the security client to send a database operation instruction to the database firewall;

[0013] Verify through the database firewall whether the IP identifier of the database operation instruction is consistent with the IP identifier of the operation and maintenance account password;

[0014] After the verification is consistent, the database access permission information of the operation and maintenance account password is read through the database firewall to verify the database operation instruction, and the database operation instruction that fails the verification is intercepted.

[0015] Optionally, the step of encrypting the operation and maintenance account password input by the operation and maintenance personnel through the security client using a negotiated encryption and decryption algorithm and then assembling the encrypted message into a message to be verified and sending the message to the database firewall includes:

[0016] The security client encrypts the operation and maintenance account password input by the operation and maintenance personnel through the negotiated encryption and decryption algorithm and assembles the encrypted and decrypted password into the message to be verified and the heartbeat information;

[0017] The message to be verified is sent to the database firewall, and the heartbeat information is sent to the database firewall every preset time.

[0018] Optionally, the method further includes:

[0019] When the security client receives the database access tool binding instruction, it reads the verification identifier of the database access tool to be bound based on the database access tool binding instruction;

[0020] The verification identifier of the database access tool to be bound is verified by using the database access tool standard verification identifier built into the security client, and the database access tool to be bound that has been successfully verified is bound.

[0021] Optionally, the verification identifier of the database access tool to be bound is an MD5 identifier.

[0022] Optionally, the decrypting the encrypted database account password by calling the negotiated encryption and decryption algorithm by the security client, and connecting to the target database based on the decrypted database account password and the database access tool, includes:

[0023] Decrypting the encrypted database account password by calling the negotiated encryption and decryption algorithm through the security client, and generating a CMD splicing command based on the database account password;

[0024] The CMD splicing command is sent to the database access tool through the security client to call the database access tool to connect to the target database.

[0025] Optionally, calling a database access tool through a security client to send database login information to the database firewall includes:

[0026] When the security client receives the database access tool call instruction, a login window containing a database IP input box, a database port input box and a database name input box pops up;

[0027] When the security client receives the database login information input through the login window, the security client calls the database access tool to send the database login information to the database firewall.

[0028] In order to solve the above technical problems, the present invention provides a database access device, comprising:

[0029] The first module is used to encrypt the operation and maintenance account and password entered by the operation and maintenance personnel through the security client using the negotiated encryption and decryption algorithm, assemble the encrypted message into a verification message, and send it to the database firewall;

[0030] The second module is used to call the negotiated encryption and decryption algorithm in the database firewall to decrypt and analyze the message to be verified, and obtain the operation and maintenance account password and the IP identifier of the operation and maintenance account password;

[0031] The third module is used to call the database access tool through the security client to send the database login information to the database firewall, and verify through the database firewall whether the IP identifier of the database login information is consistent with the IP identifier of the operation and maintenance account password;

[0032] The fourth module is used to encrypt the database account and password corresponding to the database login information through the database firewall using the negotiated encryption and decryption algorithm after verification and then send the encrypted data to the security client;

[0033] The fifth module is used to decrypt the encrypted database account password by calling the negotiated encryption and decryption algorithm through the security client, and connect to the target database based on the decrypted database account password and the database access tool.

[0034] To solve the above technical problems, the present invention provides a database access device, comprising:

[0035] Memory for storing computer programs;

[0036] A processor is configured to implement the above-mentioned database access method when executing the computer program.

[0037] To solve the above technical problems, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are executed by a processor, the database access method described above is implemented.

[0038] It can be seen that the method of the present invention encrypts the operation and maintenance account and password input by the operation and maintenance personnel through the security client through the negotiated encryption and decryption algorithm, assembles the encrypted message into a message to be verified, and sends it to the database firewall; calls the negotiated encryption and decryption algorithm in the database firewall to decrypt and analyze the message to be verified, and obtains the operation and maintenance account and password and the IP identification of the operation and maintenance account and password; calls the database access tool through the security client to send the database login information to the database firewall, and verifies through the database firewall whether the IP identification of the database login information is consistent with the IP identification of the operation and maintenance account and password; after verification, encrypts the database account and password corresponding to the database login information through the database firewall through the negotiated encryption and decryption algorithm and sends it to the security client; calls the negotiated encryption and decryption algorithm through the security client to decrypt the encrypted database account and password, and connects to the target database based on the decrypted database account and password and the database access tool.

[0039] The method of the present invention interacts with the database firewall through a self-developed security client to verify the operation and maintenance account password. The data in the interaction process adopts a unified negotiated encryption and decryption algorithm. The database firewall only needs to perform a unified version of negotiated encryption and decryption, and does not need to have different versions of database encryption and decryption algorithms built in. This improves versatility and saves storage resources and computing resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0041] Figure 1 A flowchart of a database access method provided by an embodiment of the present invention;

[0042] Figure 2 This is a structural block diagram of a database access device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0043] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0044] Currently, database operators often use shared accounts to meet the database access needs of different personnel. In practice, this practice is common, with cases of private or public sharing of database accounts. This leads to increasing data security concerns such as data abuse, misuse by unauthorized parties, and malicious theft, raising potential risks. Therefore, managing shared database accounts has become a thorny issue.

[0045] Database administrators can manage permissions using the authorization mechanisms provided by the database system. However, when an enterprise has a large number of databases, a large number of R&D and operations personnel, and frequent data and personnel changes, the workload increases exponentially. Striking a balance between effective management and efficiency becomes a challenge for database administrators, and therefore, shared database accounts are often used. However, shared accounts are prone to password leaks, making it impossible to implement minimum and precise permissions for database access. Furthermore, using the same database account for audits also makes it impossible to accurately trace database access behavior back to the specific operator.

[0046] A common defense against shared database accounts among operations personnel is to deploy a database firewall in front of the database. Each operator is assigned an account and password. After the client's login request passes through the database firewall, the encrypted account and password are replaced with the database account and password, ensuring each person has a unique account.

[0047] Currently, the way operation and maintenance personnel access the database is generally that the database access tool sends the encrypted (database access tool and database encryption algorithm) operation and maintenance account to the database firewall. The database firewall decrypts the operation and maintenance account (database access tool and database decryption algorithm) for verification. After successful verification, the database firewall encrypts the corresponding database account (database access tool and database encryption algorithm) and sends it to the database to be accessed for login, thereby enabling the operation and maintenance personnel to access the database.

[0048] This technique requires a thorough understanding of the database's login encryption algorithm. However, some database code is publicly available, and different versions of the same database use different encryption algorithms. Higher versions use more complex algorithms. Consequently, this technique only supports lower-version databases with simpler encryption algorithms. When there are many operations accounts and database versions, the database firewall must integrate encryption and decryption algorithms for each database version. This requires the database firewall to call different encryption and decryption algorithms based on the database being accessed, reducing versatility, occupying storage resources, and wasting computing resources.

[0049] The database firewall of the present invention only needs to perform a unified version of negotiated encryption and decryption, eliminating the need for built-in versions of different database encryption and decryption algorithms. This improves versatility and saves storage resources. Because the database firewall only needs to send the negotiated, encrypted database account and password to the security client, eliminating the need to consider the application of other encryption algorithms, the database firewall only needs to encrypt and store the built-in database account and password once. Subsequent access by other users only needs to send the encrypted database account and password to the security client, thus saving computing resources.

[0050] The following combination Figure 1 , Figure 1 A flowchart of a database access method provided by an embodiment of the present invention may include:

[0051] S101: The operation and maintenance account and password entered by the operation and maintenance personnel are encrypted by the security client using a negotiated encryption and decryption algorithm, and then assembled into a message to be verified and sent to the database firewall.

[0052] First, in this embodiment, a security client can be installed on the device of the operation and maintenance personnel. The security client encrypts the operation and maintenance account password entered by the operation and maintenance personnel using a negotiated encryption algorithm and assembles it into a message to be verified and sends it to the database firewall.

[0053] The negotiated encryption algorithm in this embodiment is a unified version of the encryption algorithm negotiated between the security client and the database firewall. This embodiment does not limit the specific type of the negotiated encryption algorithm; it can be set based on the actual application scenario. The security client and the database firewall can have built-in negotiated encryption and decryption algorithms to implement encrypted communication.

[0054] In this embodiment, basic database information can be pre-configured on the database firewall, such as the database IP address, database port number, database name, and database account and password, which are necessary information for logging into the database. In this embodiment, operation and maintenance personnel can be assigned operation and maintenance accounts and passwords on the database firewall, and database access rights for each operation and maintenance account and password can be set, generating database access rights information for each operation and maintenance account and password.

[0055] This embodiment does not limit the specific content of the database access permission information, which may generally include accessible database information, accessible table information, and accessible row number information.

[0056] S102: Invoke the negotiated encryption and decryption algorithm in the database firewall to perform decryption analysis on the message to be verified, and obtain the operation and maintenance account password and the IP identifier of the operation and maintenance account password.

[0057] In this embodiment, the negotiated encryption and decryption algorithm may be called within the database firewall to perform decryption analysis on the verification message to obtain the operation and maintenance account password and the IP (Internet Protocol) identifier of the operation and maintenance account password.

[0058] In this embodiment, the operation and maintenance account password can be bound to the IP identifier of the operation and maintenance account password. Subsequently, the database firewall can trace the information by reading the IP identifier of the received information.

[0059] Furthermore, to ensure that the IP address and the operator's account and password always correspond, this embodiment can send heartbeat information to the database firewall at regular intervals. Specifically, the security client encrypts the operator's account and password using a negotiated encryption and decryption algorithm, assembling the encrypted message and heartbeat information. The encrypted message is then sent to the database firewall, and heartbeat information is sent to the database firewall at preset intervals. This embodiment does not limit the preset time period and can generally be set based on actual applications.

[0060] S103: The database access tool is called by the security client to send the database login information to the database firewall, and the database firewall verifies whether the IP identifier of the database login information is consistent with the IP identifier of the operation and maintenance account password.

[0061] In this embodiment, the database login information can be sent to the database firewall by calling the database access tool through the security client, and the database firewall verifies whether the IP identifier of the database login information is consistent with the IP identifier of the operation and maintenance account password.

[0062] The database login information in this embodiment may be information of a target database that the operation and maintenance personnel want to log in to, and may generally include a database IP, a database port, and a database name.

[0063] This embodiment does not limit the specific method of sending database login information. Generally, when the security client receives a database access tool call instruction, a login window containing a database IP input box, a database port input box, and a database name input box pops up; when the security client receives the database login information entered through the login window, the database access tool is called by the security client to send the database login information to the database firewall.

[0064] In this embodiment, the first time a database access tool is used, it must be bound and verified. Specifically, after receiving a database access tool binding instruction, the security client reads the verification identifier of the database access tool to be bound based on the database access tool binding instruction. The verification identifier of the database access tool to be bound is then verified using the security client's built-in standard verification identifier for the database access tool. The successfully verified database access tool to be bound is then bound. This verification identifier avoids attacks such as database ransomware and data leaks caused by the low credibility of the database access tool being used.

[0065] In this embodiment, the verification identifier of the database access tool to be bound is an MD5 identifier. MD5 is a widely used cryptographic hash function. The security client may have a built-in standard MD5 identifier for commonly used database access tools. The MD5 identifier of the database access tool to be bound is verified using the built-in standard MD5 identifier of the database access tool, and the database access tool to be bound that successfully verifies is then bound.

[0066] This embodiment does not limit the specific method of triggering the database access tool binding instruction. Generally, the security client can have built-in icons of various database access tools, and the corresponding database access tool binding instruction can be triggered by clicking the database access tool icon.

[0067] Furthermore, this embodiment does not limit the specific method of triggering the database access tool call instruction. After the database access tool is bound to the security client, the database access tool call instruction of the corresponding data access tool can be triggered by clicking the database access tool icon.

[0068] S104: After verification, the database account and password corresponding to the database login information are encrypted by the negotiated encryption and decryption algorithm through the database firewall and then sent to the security client.

[0069] In this embodiment, when the IP identifier of the database login information is verified to be consistent with the IP identifier of the operation and maintenance account password, it can be determined that the database login information is information entered by the operation and maintenance personnel and is credible information.

[0070] Since there is no limit on the number of operation and maintenance accounts and passwords, when multiple operation and maintenance accounts and passwords are logged in simultaneously, multiple operation and maintenance accounts and passwords and their corresponding IP identifiers may exist within the database firewall. In this embodiment, the IP identifier of the database login information can be verified one by one with the IP identifier of the operation and maintenance account and password bound to the database firewall until it is determined that the IP identifier of the operation and maintenance account and password is consistent with the IP identifier of the database login information. In this way, the database login information can be determined to be authentic.

[0071] In this embodiment, the database firewall can encrypt the database account and password corresponding to the database login information using a negotiated encryption and decryption algorithm and then send it to the security client. Since the database firewall is configured with basic database information, this embodiment can determine the database account and password of the target database to be logged in based on the database login information. The database firewall can encrypt the database account and password of the target database using a negotiated encryption and decryption algorithm and then send it to the security client. In this embodiment, each operation and maintenance personnel can install a security client, and in this embodiment, the IP address of the database login information can be used to identify the security client that receives the encrypted database account and password.

[0072] S105: The encrypted database account password is decrypted by calling the negotiated encryption and decryption algorithm through the security client, and the target database is connected based on the decrypted database account password and the database access tool.

[0073] In this embodiment, after receiving the encrypted database account and password, the security client can invoke a negotiated encryption and decryption algorithm to decrypt the encrypted database account and password, and then connect to the target database using the decrypted database account and password and a database access tool. Specifically, the security client can invoke the negotiated encryption and decryption algorithm to decrypt the encrypted database account and password, and generate a CMD (Command Prompt) splicing command based on the database account and password. The security client then sends the CMD splicing command to the database access tool, invoking the database access tool to connect to the target database. This allows the database login window to be skipped and the login completion interface to be displayed, improving login efficiency.

[0074] Furthermore, since the database access permission information of each operation and maintenance account and password is pre-set in the database firewall, the database operation instructions can be verified through the database firewall in this embodiment. This embodiment does not limit the specific method of verification. Generally, the database operation instructions can be sent to the database firewall by calling the database access tool through the security client; the database firewall verifies whether the IP identifier of the database operation instruction is consistent with the IP identifier of the operation and maintenance account and password; after the verification is consistent, the database permission information of the operation and maintenance account and password is read through the database firewall to verify the database operation instruction, and the database operation instruction that fails the verification is intercepted.

[0075] Specifically, by verifying whether the IP identifier of the database operation instruction is consistent with the IP identifier of the operation and maintenance account and password, it can be determined whether the database operation instruction is a trusted instruction sent by the operation and maintenance personnel; further, the database permission information of the operation and maintenance account and password is read through the database firewall to verify the permission of the data operation instruction. If the data operation instruction meets the requirements of the corresponding database permission information, the database firewall can send the data operation instruction to the database for execution; if the data operation instruction does not meet the requirements of the corresponding database permission information, the database firewall can intercept the database operation instruction.

[0076] Furthermore, after interception, this embodiment can return database operation instruction interception information to the security client through the database firewall, so that the operation and maintenance personnel know that the database operation instruction was not successfully executed.

[0077] Based on the above embodiments, the method of the present invention interacts with the database firewall through a self-developed security client to verify the operation and maintenance account password. The data in the interaction process adopts a unified negotiated encryption and decryption algorithm. The database firewall only needs to perform a unified version of negotiated encryption and decryption, and there is no need to build in different versions of database encryption and decryption algorithms, which improves versatility and saves storage resources and computing resources.

[0078] The following combination Figure 2 , Figure 2 This is a structural block diagram of a database access device provided by an embodiment of the present invention, which may include:

[0079] The first module 100 is used to encrypt the operation and maintenance account and password entered by the operation and maintenance personnel through the security client using the negotiated encryption and decryption algorithm, assemble the encrypted message into a verification message, and send it to the database firewall;

[0080] The second module 200 is configured to call the negotiated encryption and decryption algorithm within the database firewall to perform decryption analysis on the message to be verified, and obtain the operation and maintenance account password and the IP identifier of the operation and maintenance account password;

[0081] The third module 300 is used to call the database access tool through the security client to send the database login information to the database firewall, and verify through the database firewall whether the IP identifier of the database login information is consistent with the IP identifier of the operation and maintenance account password;

[0082] The fourth module 400 is used to encrypt the database account and password corresponding to the database login information using the negotiated encryption and decryption algorithm through the database firewall after verification and then send the encrypted data to the security client;

[0083] The fifth module 500 is used to decrypt the encrypted database account password by calling the negotiated encryption and decryption algorithm through the security client, and connect to the target database based on the decrypted database account password and the database access tool.

[0084] Based on the above embodiment, the device may further include:

[0085] A sixth module is configured to call the database access tool through the security client to send a database operation instruction to the database firewall;

[0086] The seventh module is used to verify through the database firewall whether the IP identifier of the database operation instruction is consistent with the IP identifier of the operation and maintenance account password;

[0087] The eighth module is used to verify the consistency, read the database access permission information of the operation and maintenance account password through the database firewall to verify the database operation instruction, and intercept the database operation instruction that fails the verification.

[0088] Based on the above embodiments, the first module 100 may include:

[0089] The first unit is configured to encrypt the operation and maintenance account password input by the operation and maintenance personnel through the negotiated encryption and decryption algorithm through the security client and assemble the encrypted and decrypted password into the message to be verified and the heartbeat information;

[0090] The second unit is configured to send the message to be verified to the database firewall, and send the heartbeat information to the database firewall at preset intervals.

[0091] Based on the above embodiments, the device may further include:

[0092] A ninth module is configured to read the verification identifier of the database access tool to be bound based on the database access tool binding instruction after the security client receives the database access tool binding instruction;

[0093] The tenth module is configured to verify the verification identifier of the database access tool to be bound using the database access tool standard verification identifier built into the security client, and bind the database access tool to be bound that has been successfully verified.

[0094] Based on the above embodiments, the verification identifier of the database access tool to be bound is an MD5 identifier.

[0095] Based on the above embodiments, the fifth module 500 may include:

[0096] The third unit is configured to decrypt the encrypted database account password by calling the negotiated encryption and decryption algorithm through the security client, and generate a CMD splicing command based on the database account password;

[0097] The fourth unit is used to send the CMD splicing command to the database access tool through the security client to call the database access tool to connect to the target database.

[0098] Based on the above embodiments, the third module 300 may include:

[0099] The fifth unit is configured to pop up a login window including a database IP input box, a database port input box, and a database name input box when the security client receives a database access tool call instruction;

[0100] The sixth unit is configured to, when the security client receives the database login information input through the login window, call the database access tool through the security client to send the database login information to the database firewall.

[0101] Based on the above embodiments, the present invention further provides a database access device. The device may include a memory and a processor. The memory stores a computer program, and the processor invokes the computer program to implement the steps provided in the above embodiments. The device may also include various necessary network interfaces, a power supply, and other components.

[0102] The present invention also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by an execution terminal or a processor, the method provided in the embodiment of the present invention can be implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., various media that can store program codes.

[0103] In this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

Claims

1. A database access method, characterized in that: include: The security client encrypts the operation and maintenance account and password entered by the operation and maintenance personnel using the negotiated encryption and decryption algorithm, assembles the encrypted message into a verification message, and sends it to the database firewall. Calling the negotiated encryption and decryption algorithm within the database firewall to perform decryption analysis on the message to be verified, and obtaining the operation and maintenance account password and the IP identifier of the operation and maintenance account password; The database access tool is called by the security client to send the database login information to the database firewall, and the database firewall verifies whether the IP identifier of the database login information is consistent with the IP identifier of the operation and maintenance account password; After verification, the database account and password corresponding to the database login information are encrypted by the negotiated encryption and decryption algorithm through the database firewall and then sent to the security client; The encrypted database account password is decrypted by calling the negotiated encryption and decryption algorithm through the security client, and the target database is connected based on the decrypted database account password and the database access tool.

2. The database access method according to claim 1, characterized in that: Also includes: Calling the database access tool through the security client to send a database operation instruction to the database firewall; Verify through the database firewall whether the IP identifier of the database operation instruction is consistent with the IP identifier of the operation and maintenance account password; After the verification is consistent, the database access permission information of the operation and maintenance account password is read through the database firewall to verify the database operation instruction, and the database operation instruction that fails the verification is intercepted.

3. The database access method according to claim 1, characterized in that: The security client encrypts the operation and maintenance account and password entered by the operation and maintenance personnel through the negotiated encryption and decryption algorithm, assembles the encrypted message into a message to be verified, and sends it to the database firewall, including: The security client encrypts the operation and maintenance account password input by the operation and maintenance personnel through the negotiated encryption and decryption algorithm and assembles the encrypted and decrypted password into the message to be verified and the heartbeat information; The message to be verified is sent to the database firewall, and the heartbeat information is sent to the database firewall every preset time.

4. The database access method according to claim 1, characterized in that: Also includes: When the security client receives the database access tool binding instruction, it reads the verification identifier of the database access tool to be bound based on the database access tool binding instruction; The verification identifier of the database access tool to be bound is verified by using the database access tool standard verification identifier built into the security client, and the database access tool to be bound that has been successfully verified is bound.

5. The database access method according to claim 4, characterized in that: The verification identifier of the database access tool to be bound is an MD5 identifier.

6. The database access method according to claim 1, characterized in that: The method of decrypting the encrypted database account password by calling the negotiated encryption and decryption algorithm through the security client, and connecting to the target database based on the decrypted database account password and the database access tool, includes: Decrypting the encrypted database account password by calling the negotiated encryption and decryption algorithm through the security client, and generating a CMD splicing command based on the database account password; The CMD splicing command is sent to the database access tool through the security client to call the database access tool to connect to the target database.

7. The database access method according to claim 1, characterized in that: The step of calling a database access tool through a security client to send database login information to the database firewall includes: When the security client receives the database access tool call instruction, a login window containing a database IP input box, a database port input box and a database name input box pops up; When the security client receives the database login information input through the login window, the security client calls the database access tool to send the database login information to the database firewall.

8. A database access device, characterized in that: include: The first module is used to encrypt the operation and maintenance account and password entered by the operation and maintenance personnel through the security client using the negotiated encryption and decryption algorithm, assemble the encrypted message into a verification message, and send it to the database firewall; The second module is used to call the negotiated encryption and decryption algorithm in the database firewall to decrypt and analyze the message to be verified, and obtain the operation and maintenance account password and the IP identifier of the operation and maintenance account password; The third module is used to call the database access tool through the security client to send the database login information to the database firewall, and verify through the database firewall whether the IP identifier of the database login information is consistent with the IP identifier of the operation and maintenance account password; The fourth module is used to encrypt the database account and password corresponding to the database login information through the database firewall using the negotiated encryption and decryption algorithm after verification and then send the encrypted data to the security client; The fifth module is used to decrypt the encrypted database account password by calling the negotiated encryption and decryption algorithm through the security client, and connect to the target database based on the decrypted database account password and the database access tool.

9. A database access device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the database access method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the database access method according to any one of claims 1 to 7 is implemented.

Images