Database account information management method and device and electronic equipment

Abstract

The invention provides a database account information management method and device and electronic equipment, and is applied to a password management system, the password management system manages resources of an application server and a database server, and the method comprises the following steps: in response to receiving a token acquisition request sent by the application server, acquiring a target token; the target token is fed back to the application server, so that the application server generates a database access request based on the target token; in response to the received database access request, determining target account information corresponding to a to-be-accessed database server based on the database access request; and sending the target account information to the application server, so that the application server accesses the database server to be accessed based on the target account information. According to the scheme, right confirmation protection aiming at the account and the password of the user database is realized, meanwhile, the use of a terminal user is not influenced, and the security and the flexibility of database access are realized.

Description

Technical Field

[0001] The present disclosure relates to the fields of computer science and technology, network security, and database security technology, and in particular to a database account information management method, device, and electronic device. Background Art

[0002] The main target of cyber attacks that affect network security is the data in the database. In computer science, the database is also called the "Database Management System (DBMS)", which is a key software system for storing various types of business data. The account and password of the DBMS are the key to obtaining its management authority. Once the database account and password are stolen, it will lead to data leakage, which seriously threatens data security.

[0003] At present, in the related technology, the database account and password are usually embedded in the code. This hard-coded link between the application server and the database is easy for attackers to obtain the database login credentials by logging into the application server, affecting the security of the database. Summary of the invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, the embodiments of the present disclosure provide a database account information management method, device and electronic device.

[0005] According to one aspect of the present disclosure, a database account information management method is provided, which is applied to a password management system, wherein the password management system manages resources of an application server and a database server, and the method includes:

[0006] In response to receiving the token acquisition request sent by the application server, acquiring a target token;

[0007] Feeding back the target token to the application server, so that the application server generates a database access request based on the target token;

[0008] In response to receiving the database access request, determining target account information corresponding to the database server to be accessed based on the database access request;

[0009] The target account information is sent to the application server, so that the application server accesses the database server to be accessed based on the target account information.

[0010] According to another aspect of the present disclosure, a database account information management device is provided, which is applied to a password management system, wherein the password management system manages resources of an application server and a database server, and the device includes:

[0011] A token acquisition module, configured to acquire a target token in response to receiving a token acquisition request sent by the application server;

[0012] A token sending module, used for feeding back the target token to the application server, so that the application server generates a database access request based on the target token;

[0013] an account determination module, configured to, in response to receiving the database access request, determine target account information corresponding to the database server to be accessed based on the database access request;

[0014] An account sending module is used to send the target account information to the application server, so that the application server accesses the database server to be accessed based on the target account information.

[0015] According to another aspect of the present disclosure, there is provided an electronic device, comprising:

[0016] Processor; and

[0017] Memory for storing programs,

[0018] The program includes instructions, which, when executed by the processor, enable the processor to execute the database account information management method according to the aforementioned aspect.

[0019] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable a computer to execute the database account information management method according to the aforementioned aspect.

[0020] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, wherein the computer program implements the database account information management method described in the aforementioned aspect when executed by a processor.

[0021] One or more technical solutions provided in the embodiments of the present disclosure are to manage the resources of the application server and the database server through the password management system. When the password management system receives the token acquisition request sent by the application server, the target token is obtained and fed back to the application server, so that the application server generates a database access request based on the target token. Then, in response to receiving the database access request, the target account information corresponding to the database server to be accessed is determined based on the database access request, and then the target account information is sent to the application server, so that the application server accesses the database server to be accessed based on the target account information. With the scheme of the present disclosure, the resources of the application server and the database server are managed by the password management system, so that the password management system becomes the core bastion host for the account key management of the user application system and the database. When the application server needs to access the database server, it first requests a token from the password management system, and then requests the account information of the database server to be accessed based on the token to access the database server. Thus, the confirmation protection of the user's database account and password is realized, and at the same time, it will not cause any impact on the use of the terminal user, and the security and flexibility of the database access are realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Further details, features and advantages of the present disclosure are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0023] Figure 1 A flowchart of a method for managing database account information according to an exemplary embodiment of the present disclosure is shown;

[0024] Figure 2 A flowchart of a method for managing database account information according to another exemplary embodiment of the present disclosure is shown;

[0025] Figure 3 A schematic diagram showing an operation page of an exemplary embodiment of the present disclosure is shown;

[0026] FIG4( a ) shows a schematic diagram of authorizing a server to access a password management system through an operation page according to an exemplary embodiment of the present disclosure;

[0027] FIG4( b ) shows a schematic diagram of adding a server to a whitelist through an operation page according to an exemplary embodiment of the present disclosure;

[0028] FIG4( c ) shows a schematic diagram of managing user status through an operation page according to an exemplary embodiment of the present disclosure;

[0029] FIG4( d ) shows a schematic diagram of obtaining a unique credential key by operating a page according to an exemplary embodiment of the present disclosure;

[0030] Figure 5A schematic diagram showing a process of encrypting and storing data in a password management system according to an exemplary embodiment of the present disclosure is shown;

[0031] Figure 6 A schematic diagram of the actual interface of the backplane of the password management system according to an exemplary embodiment of the present disclosure is shown;

[0032] Figure 7 A schematic diagram showing the connection between an application server, a database server and a password management system according to an exemplary embodiment of the present disclosure is shown;

[0033] Figure 8 A schematic diagram showing an interactive process of a database account information management method according to an exemplary embodiment of the present disclosure is shown;

[0034] Fig. 9 A schematic block diagram of a database account information management device according to an exemplary embodiment of the present disclosure is shown;

[0035] Fig.10 A structural block diagram of an exemplary electronic device that can be used to implement the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0036] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0037] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0038] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc. mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0039] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0040] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0041] As time goes by, a large number of user units have developed various application software systems at different stages in time, which have become the key tools and means of information collaboration for the main business and operations of these units. As time accumulates, a large number of key business data have gradually been formed in databases, and the importance and value of these data have become increasingly prominent, and have become important assets and key resources for various units.

[0042] The main means of network attacks that affect network security are ever-changing, but the main goal is to target the ultimate goal in the user's network resource system - the data in the database. As a key software system for storing various types of business data, the database account and password are the key to obtaining its management rights. At present, one means of obtaining database accounts and passwords is to obtain database super administrator privileges through weak passwords or default passwords, ordered passwords, etc. after the network attack successfully intercepts the database server, and implement operations such as downloading, modifying, and deleting the database; another main way to obtain database administrator privileges and passwords is to directly log in to the application server, obtain and analyze the application configuration, boot, method, class library and other files in the application server, so as to master the database login plain text account name and password. This method is called the risk of hard-coded account leakage.

[0043] In order to reduce the risk of data leakage caused by theft of database accounts and passwords, the present disclosure provides a system integration database account information management solution, which uses the database native connection protocol and token authorization protocol technology to realize account discovery and password modification of database assets. By eliminating the problem of hard-coding database login credentials caused by hard-coding database accounts and passwords in configuration files or codes due to software system development, the user database account and password confirmation protection is realized, and at the same time, it will not cause any impact on the use of end users, and the security and flexibility of database access are realized.

[0044] The following describes the database account information management method, device and electronic device provided by the present disclosure with reference to the accompanying drawings.

[0045] Figure 1A flowchart of a database account information management method according to an exemplary embodiment of the present disclosure is shown. The method can be executed by a database account information management device provided by an embodiment of the present disclosure, wherein the device can be implemented using software and / or hardware and applied to a password management system. The password management system manages all resources of an application server and a database server, including but not limited to accounts and passwords of the application server and the database server. The password management system can generally be integrated in electronic devices, including computers, servers and other devices.

[0046] like Figure 1 As shown, the database account information management method may include the following steps:

[0047] Step 101: In response to receiving a token acquisition request sent by an application server, a target token is acquired.

[0048] Among them, the original hard-coded link relationship between the application server and the database server is released, and the configuration, guidance, method, and class library files that may be required for the application to initialize access to the database are deleted simultaneously. The hard-coded link of the database refers to the process of embedding sensitive information such as database connection information (such as uniform resource locator URL, account username and password) directly into the code when developing the application, which cannot be managed through configuration files or other external means. This makes it very difficult to change the database user or password once deployed unless a new code version is recompiled and released. In addition, there is a major problem with this approach, that is, anyone can obtain the password by obtaining the code information. If an attacker can access the bytecode of the application, they can use tools such as javap-c to disassemble the code, thereby leaking the value used for the password. In this embodiment, the password management system manages all resources of the application server and the database server, and there is no need to perform a hard-coded link between the application server and the database server, thereby avoiding the situation where an attacker obtains the login credentials of the database through the code and attacks the database.

[0049] In this embodiment, the application server can access the password management system through a preset password authorization protocol. When the application server needs to access the corresponding database, it can send a token acquisition request to the password management system based on the password authorization protocol. After receiving the token acquisition request, the password management server can obtain a token (referred to as a target token for ease of description and distinction).

[0050] Exemplarily, the password management system may obtain a preset token as a target token.

[0051] Exemplarily, the password management system may randomly generate a token as a target token after receiving a token acquisition request from an application server.

[0052] Step 102: Feedback the target token to the application server, so that the application server generates a database access request based on the target token.

[0053] In this embodiment, after the password management system obtains the target token, it can feed the target token back to the application server to establish a communication channel between the application server and the password management system. After the application server receives the target token for legal communication returned by the password management system, it can generate a database access request based on the target token and send it to the password management system to request the password management system for the legal password (password) of the database server. The database access request carries the target token so that the password management system can verify the legitimacy of the application server requesting the database password; the database access request also carries the account name of the database server to be accessed, so that the password management system can determine the associated password based on the account name.

[0054] For example, the application server can initiate a database access request through an http request, and the detailed content and parameter configuration of the return address of the database password request are as follows:

[0055] http: / / IP / cgi-bin / account / view / account_name=ACCOUNTNAME&access_token=ACCESST OKEN;

[0056] The two key basic parameters are described as follows:

[0057] (1) account_name: refers to the name of the account corresponding to the database server to be accessed in the password management system that needs to be obtained;

[0058] (2) access_token: refers to the access credentials returned by the password management system to the corresponding application server, that is, the target password.

[0059] Step 103: in response to receiving the database access request, determine the target account information corresponding to the database server to be accessed based on the database access request.

[0060] In this embodiment, after the password management system receives the database access request sent by the application server, it can determine the database server to be accessed requested by the application server based on the database access request, and then obtain the account information corresponding to the database server to be accessed (for the convenience of description and distinction, referred to as target account information), where the target account information may include an account and a password, or may only include a password, and the present disclosure does not limit this.

[0061] Step 104: Send the target account information to the application server, so that the application server accesses the database server to be accessed based on the target account information.

[0062] In this embodiment, after the password management system determines the target account information of the database server to be accessed, it feeds back the target account information to the application server. Thus, after the application server receives the target account information fed back by the password management system, it can access the database server to be accessed based on the target account information.

[0063] As an example, the target account information returned by the password management system includes the account and password of the database server, and the application server can directly access the database server to be accessed based on the target account information.

[0064] As another example, the target account information returned by the password management system only includes the login password of the database server. After receiving the target account information returned by the password management system, the application server can access the database server to be accessed based on the account name of the server to be accessed and the target account information recorded by itself.

[0065] The database account information management method of the embodiment of the present disclosure is to manage the resources of the application server and the database server by the password management system. When the password management system receives the token acquisition request sent by the application server, the target token is obtained and fed back to the application server, so that the application server generates a database access request based on the target token. Then, in response to receiving the database access request, the target account information corresponding to the database server to be accessed is determined based on the database access request, and then the target account information is sent to the application server, so that the application server accesses the database server to be accessed based on the target account information. The scheme of the present disclosure is adopted, and the resources of the application server and the database server are managed by the password management system, so that the password management system becomes the core bastion host for the account key management of the user application system and the database. When the application server needs to access the database server, it first requests a token from the password management system, and then requests the account information of the database server to be accessed based on the token to access the database server. Thus, the confirmation protection of the user's database account and password is realized, and at the same time, it will not cause any impact on the use of the terminal user, and the security and flexibility of the database access are realized.

[0066] In an optional embodiment of the present disclosure, Figure 2 As shown in the figure, the password management system can manage application servers and database servers in the following ways:

[0067] Step 201, obtaining registration parameter information of the server.

[0068] The server includes an application server and a database server. The registration parameter information may include but is not limited to the Domain Name System (DNS) name, IP address, and port number of the server to be taken over.

[0069] As an example, after logging into the password management system, the administrator of the password management system can manually add the resources of the application server or database server that needs to be taken over, and fill in the server's DNS name, IP address, port number information and other resources into the password management system. The resource becomes a legal resource in the whitelist of the password management system. In addition, the system administrator account can be configured for the resource to facilitate the application system administrator to perform in-depth configuration management of the resource in the later stage. For example, the administrator of the password management system can add the registration parameter information of the server that needs to be managed through the provided operation page. Figure 3 A schematic diagram of an operation page of an exemplary embodiment of the present disclosure is shown. Figure 3 As shown, the operation page provides an "Add API User" control. After the administrator clicks the control, a pop-up window for receiving the server's registration parameter information pops up. After the administrator adds the server's registration parameter information in the pop-up window and clicks "OK", the password management system will obtain the server's registration parameter information.

[0070] Step 202: Generate a server identifier and a unique credential key corresponding to the server based on the registration parameter information.

[0071] In this embodiment, after the password management system obtains the registration parameter information of the server, it automatically generates a server identifier (recorded as APPID) and a unique credential key (including SecretId and SecretKey) corresponding to the server based on the registration parameter information. Figure 3 In the operation page shown, the server ID and unique credential key generated for each managed server are displayed in the "APPID" field and "Key" field corresponding to the operation page. The operation page also includes the "Last Access Time", "Status" and "Operation" fields. The description of each field is as follows:

[0072] APPID: One of the credentials for authorized access, the field value is the server ID;

[0073] Secret key: One of the credentials for authorizing access. The field value is a unique credential key, including SecretId and SecretKey.

[0074] Last access time: the time of the latest request to the third-party business system;

[0075] Status: Indicates whether the corresponding server is available. The field value is On or Off. On means the server is available.

[0076] Operation: used to provide some operations for server configuration, including but not limited to authorization, adding whitelist, and deletion.

[0077] As an example, part or all of the registration parameter information may be encrypted according to a preset encryption algorithm to generate a server identifier and a unique credential key.

[0078] As another example, the server identification and unique credential key may be randomly generated.

[0079] Step 203: Add the server identifier and the unique credential key to the access authorization list to authorize the server to access the password management system.

[0080] In this embodiment, after generating the server identifier and unique credential key corresponding to the server, the server identifier and unique credential key can be added to the access authorization list to authorize the server to access the password management system. In other words, only authorized servers can access the password management system and call the API interface of the password management system to obtain an access token.

[0081] As an example, after generating the server identifier and the unique credential key of the server to be managed, the password management system may automatically add the server identifier and the unique credential key to the access authorization list.

[0082] As another example, after generating the server identifier and unique credential key of the server to be managed, the password management system can display the generated server identifier and unique credential key in the API user list of the operation page, and the administrator can manually authorize the server. Figure 3 As shown, the administrator can click "More" in the "Operation" field corresponding to the server that needs to be authorized, and then the two options of "Authorize" and "IP Whitelist" in the operation field are displayed, as shown in Figure 4(a). After the administrator clicks "Authorize", the password management system adds the server identifier and unique credential key to the access authorization list.

[0083] Step 204: Add the IP address in the registration parameter information to the whitelist.

[0084] In this embodiment, the password management system can also add the IP address in the registration parameter information to a whitelist, wherein the whitelist is used to control the source IP of the visitor, and only the IP addresses in the whitelist can access the password management system.

[0085] As an example, after obtaining the registration parameter information of the server, the password management system can obtain the IP address of the server from the registration parameter information and add it to the whitelist.

[0086] As another example, the administrator can manually add the server's IP address to the whitelist through the operation page. Figure 3 As shown, the administrator can click "More" in the "Operation" field corresponding to the server, and then the two options of "Authorization" and "IP Whitelist" in the operation field will be displayed. When the user clicks "IP Whitelist", as shown in Figure 4(b), the password management system obtains the IP address from the registration parameter information and adds it to the whitelist.

[0087] Step 205: Set the user status corresponding to the server identifier and the unique credential key to an open state.

[0088] In this embodiment, after the password management system generates a server identifier and a unique credential key corresponding to the server, the user status corresponding to the server identifier and the unique credential key can be set to an open state, wherein only a server in an open state can communicate with the password management system.

[0089] As an example, the state of the server can be manually set by the administrator through the operation page. Figure 3 As shown, the administrator can set the corresponding switch to "on" in the "status" field corresponding to the server, as shown in FIG4(c).

[0090] It should be noted that, in this embodiment, the execution order of step 203, step 204 and step 205 is not particular, and the three can be executed sequentially or simultaneously. The present disclosure only uses the sequential execution of the three as an example to explain the present disclosure, and it cannot be used as a limitation of the present disclosure.

[0091] In addition, it should be noted that, in this embodiment, when the server is a database server, after completing the database server resource filling work and successfully incorporating it into the system whitelist, it is necessary to configure the database administrator account information for the database server resource in more detail. This information must be completely consistent with the specific database name, administrator role, name, and login password in the corresponding database management system, and entered into the password management system database server administrator login information collection; on the other hand, the system supports multiple account configurations for the same database resource, and configures different database users for the same database instance to facilitate access to different application database objects.

[0092] The database account information management method of this embodiment obtains the registration parameter information of the server, and based on the registration parameter information, generates a server identifier and a unique credential key corresponding to the server, and adds the server identifier and the unique credential key to the access authorization list to authorize the server to access the password management system. In this way, the authorization management of the server accessing the password management system is realized. By adding the IP address in the registration parameter information to the whitelist, a basis is provided for the legitimacy verification of the server accessing the password management system. By setting the user status corresponding to the server identifier and the unique credential key to the open state, it is convenient for the administrator to perform daily maintenance work. For example, if it is necessary to close the communication with a server, it is only necessary to set its user status to the closed state to stop the communication between the API interface of the password management system and the server. There is no need to process the whitelist and authorization information, and the parameters do not need to be configured again, which is convenient for quick maintenance work.

[0093] Furthermore, in an optional implementation of the present disclosure, after the password management system generates a server identifier and a unique credential key corresponding to the server, the server identifier and the unique credential key can also be added to a configuration file of the server's middleware, so that the server can send a token acquisition request to the password management system through the middleware, wherein the token acquisition request carries the server identifier and the unique credential key.

[0094] As an example, after the password management system generates the server identifier and unique credential key corresponding to the server, it can call the configuration file of the middleware deployed on the server and add the generated server identifier and unique credential key to the corresponding fields in the configuration file.

[0095] As another example, after generating the server identifier and unique credential key of the server to be managed, the password management system may display the generated server identifier and unique credential key in the API user list of the operation page, for example Figure 3 As shown, from Figure 3 It can be seen that the SecretKey in the unique credential key displayed in the operation page is hidden, and a "Show" control is provided behind it. When the user clicks the "Show" control, the content of the SecretKey will be displayed, as shown in Figure 4(d). As can be seen from Figure 4(d), a copy control is provided after the server identifier and the unique credential key. The user can click the control to copy the corresponding content. Thus, the administrator of the password management system can copy the corresponding server identifier and unique credential key and manually add them to the corresponding fields of the configuration file of the server's middleware.

[0096] In this embodiment, in order to ensure the communication security between the application server and the password management system, middleware can be deployed in the application server (the middleware is a third-party component that communicates between the operating system and the application software and is not restricted by the operating system). The middleware is mainly used to access the password management system through a token authorization protocol (such as the OAuth 2.0 protocol) and communicate with the password management system. The middleware generates a token acquisition request based on the server identifier and unique credential key configured in the configuration file and sends it to the password management system to request an access token.

[0097] For example, the application server can perform detailed parameter configuration in the following middleware interface call to generate a token acquisition request:

[0098] http: / / IP / cgi-bin / token / ? grant_type=client_credential&appid=APPID&secret=APPSECRET;

[0099] The three key basic parameters are described as follows:

[0100] (1) grant_type: client_credential (the SSL authentication digital certificate required for the application server to access the password management system) that needs to be filled in to obtain the access token;

[0101] (2) appid: refers to the server ID of the application server generated by the password management system during the application server management phase;

[0102] (3) Secret: refers to the unique credential key of the application server generated by the password management system during the application server management phase.

[0103] Through the above configuration, in the middleware installed on the application server, the SSL identity authentication digital certificate of the password management system to be accessed is specified through the access address parameter, and the application server's own label and access key that are pre-configured and generated in the password management system are specified.

[0104] In this embodiment, by adding the server identification and the unique credential key to the configuration file of the server's middleware, the server's middleware is allowed to access the password management system, so that the middleware can communicate normally with the password management system.

[0105] Further, in an optional implementation of the present disclosure, the token acquisition request sent by the middleware of the application server carries a server identifier and a unique credential key. In this embodiment, when the password management system obtains the target token after receiving the token acquisition request, it can respond to the token acquisition request sent by the middleware of the application server, obtain the target server identifier and target unique credential key carried in the token acquisition request, and determine whether the target server identifier and target unique credential key exist in the access authorization list; if the target server identifier and target unique credential key exist in the access authorization list, further determine whether the source IP address of the token acquisition request (i.e., the IP address of the application server that sends the token acquisition request) exists in the whitelist; if the source IP address exists in the whitelist, obtain the target token.

[0106] In this embodiment, after receiving the token acquisition request sent by the middleware of the application server, the server identifier and unique credential key carried in the token acquisition request are verified to see whether they exist in the access authorization list, and the IP address of the application server is verified to see whether it exists in the whitelist. Only when both exist will the target token be obtained and fed back to the application server. In this way, the legitimacy of the identity of the application server requesting the access token is guaranteed, which helps to improve the security of the database.

[0107] In an optional implementation of the present disclosure, after the password management system obtains the target token, it can first verify whether the user status of the application server is enabled, and when the user status corresponding to the target server identifier and the target unique credential key is enabled, the target token is fed back to the application server through the SSL tunnel between the application server and the application server. The target token is fed back to the application server through the SSL tunnel, which ensures the security of token transmission.

[0108] In an optional implementation of the present disclosure, in order to ensure the transmission security of the account information of the database server, the password management system can encrypt the account information of the database server and transmit it to the application server. In this embodiment, after the password management system receives the database access request sent by the application server, it can obtain the target token and the account name of the database server to be accessed carried in the database access request, and verify the target token. For example, it can verify whether the target token is recorded in the password management system and whether the target token is within the validity period. If the target token is recorded in the password management system and the target token is still within the validity period, it is determined that the target token verification has passed. Then, if the target token verification has passed, the corresponding login password is determined based on the account name, and the login password is encrypted according to the preset encryption algorithm to generate the target account information. Among them, the account name of the database server is unique and corresponds to a unique login password.

[0109] Among them, the preset encryption algorithm can be AES_CBC encryption algorithm, MD5 encryption algorithm, DES encryption algorithm, etc.

[0110] Further optionally, when the password management system determines the corresponding login password based on the account name, it can first confirm whether the account, password (i.e., login password), URL and other parameters of the database server to be accessed applied for by the application server are valid. For example, it can detect whether the user status of the database server to be accessed is on. If it is on, it is determined that the account, password, URL and other parameters of the database server are valid, so as to encrypt the password and obtain the target account information.

[0111] In this embodiment, the login password of the database server is obtained only after the target token carried in the database access request has been verified, thereby ensuring that the application server requesting access to the database is a legitimate user who is allowed to access; by encrypting the obtained login password before sending it to the application server, the password is prevented from being stolen during the communication process of the password management system sending the account information back to the application server, thereby ensuring the security of the database.

[0112] According to network security requirements, it is necessary to regularly modify the passwords of databases and application systems, and the password changes need to comply with certain password strength regulations. In the existing method of fixing the account name and password of the database in the code, when the password of the database changes, it is necessary to synchronously modify the underlying codes of a large number of application systems. If it is not possible to modify them one by one, various problems of business system interruption will be caused. Therefore, the change of database account passwords in the traditional solution is extremely complicated and cumbersome for later operation and maintenance. Considering the fact that a large number of users do not develop their own application systems, if you want to modify the database account password in the later stage, the complexity is high, which is not conducive to user operation and maintenance. However, with the solution disclosed in the present invention, when the password of the database server needs to be modified, the user only needs to modify the password of the database server in the password management system, and the administrator account password in the database server or the application server user account password can be synchronously modified. This is because the application server or database server has been managed by the password management system. When modifying the account password of the above server, the password can be synchronously modified through the SSL tunnel that has been handshaked to confirm the legitimacy of the communication between the servers. Therefore, in an optional implementation of the present disclosure, the solution of the present disclosure also includes: in response to receiving a user's account information modification operation on the target database server, obtaining the modified account information; replacing the account information of the target database server recorded in the local database with the modified account information.

[0113] The modified account information may include at least one of an account name and a login password.

[0114] In this embodiment, when a user modifies the account name and / or login password of a database server (referred to as a target database server for ease of description and distinction), the password management system will receive the user's account information modification operation on the target database server, and the account information modification operation can carry the target database server's identifier and the modified account information, and then find the current account information of the corresponding target database server recorded in the local database according to the identifier of the target database server, and replace the account information with the modified account information, so that the local database stores the latest account information of the database server. With this solution, it is easier to periodically adjust the password and password strength of the database server within a certain period of time, and the administrator of the database server does not need to remember the password specifically, and can obtain the password again through private mobile phone text messages, emails, etc. At the same time, it is more in line with the requirements of modern network security management regulations, easier to implement password modification, and more conducive to the password management and compliance inspection of later users.

[0115] In the scheme of the present disclosure, all information such as various resource information, user account password information, etc. entered by the administrator through the password management system are in plain text and are entered and stored as the local database content of the password management system. If stored in plain text, there will be major security risks. Therefore, in order to ensure the security of the data stored in the password management system, in an optional implementation of the present disclosure, all plain text data entered in the password management system can be encrypted and stored in the local database (the local database is a special database in the password management system for storing the passwords of the managed servers). Thus, in this embodiment, the modified account information obtained by the password management system can be encrypted. Specifically, after the password management system receives the user's account information modification operation on the target database server, it can obtain the account name and / or login password entered by the user based on the account information modification operation, and determine whether the user has entered the login password. If the login password entered by the user is obtained based on the account information modification operation, the encryption chip is called to encrypt the login password to generate a password ciphertext, and then the modified account information is generated based on the account name and / or password ciphertext.

[0116] Among them, the encryption algorithm is embedded in the encryption chip. For example, the encryption chip can be an HSM2A high-performance public key cryptographic algorithm chip that supports the national encryption SM2 algorithm, or it can be a chip embedded with other encryption algorithms (such as DSA algorithm, RSA algorithm), and the present disclosure does not impose any restrictions on this.

[0117] As an example, an encryption module including the SM2 algorithm can be developed in the password management system. After sending a data packet to the MCU chip, the module can determine whether the MCU has received the calculation result returned by the encryption chip within a predetermined time, and store the calculation result in the output parameter of the module; at the same time, the module conducts data docking with a stored procedure of the database management system in the password management system to ensure that the output parameters of the program module correspond to the input parameters in the stored procedure, and executes the SQL database insert statement through the stored procedure to save the password string to the password data table corresponding to the local database in the password management system.

[0118] Figure 5 FIG. 2 shows a schematic diagram of a process of encrypting and storing data in a password management system according to an exemplary embodiment of the present disclosure. Figure 5 As shown, an encryption module including the SM2 algorithm is developed in the password management system, and the interface part includes a set of input parameters and a set of output parameters; the module is mainly used to convert the input parameters into encrypted output parameters and complete the storage in the local database (embedded database) corresponding to the password system. The encryption module of the SM2 algorithm is not responsible for the soft encryption of the input parameters, but calls the encryption unit in the encryption chip to complete the encryption process. The encryption module includes a step of calling the stored procedure in the local database corresponding to the password management system. The stored procedure receives the input parameters of this module. Since the local database corresponding to the password management system is a domestic embedded database SinoDB, in SinoDB, the stored procedure can be called in the trigger, and once the database writes to the password table trigger action, the encryption unit of the chip is first called to complete the encryption process of the input parameters; secondly, it is determined whether the MCU receives the calculation result returned by the encryption chip within the predetermined time. If successful, the encrypted calculation result of the input parameter is stored in the output parameter of the module, and the SQL insertion command is formed by splicing the output parameters, and the SQL command line is executed to complete the insertion operation of a password data table, so as to achieve the purpose of writing the password into the local database. In the process of executing the above actions, the database uses Transparent Data Encryption (TDE) technology, which can encrypt and decrypt data in real time without increasing the burden on users. Specifically, encryption and decryption can be performed in the read and write links between the database storage process and the file system.

[0119] It can be understood that if the user only enters the modified account name based on the account information modification operation, the account name will be directly used as the modified account information; if the user only enters the modified login password based on the account information modification operation, the encryption chip will be called to encrypt the login password to generate the password ciphertext, and then the password ciphertext will be determined as the modified account information; if the user enters the modified account name and login password based on the account information modification operation, the encryption chip will be called to encrypt the login password to generate the password ciphertext, and then the modified account name and password ciphertext will be determined as the modified account information.

[0120] In this embodiment, only the modified login password is encrypted while the account name is not encrypted, so that when the password management system receives a database access request from the application server, it can query the corresponding login password according to the account name of the database server to be accessed.

[0121] It is understandable that when the password management system receives a database access request from an application server, the password of the database server to be accessed obtained from the local database is an encrypted password ciphertext, which needs to be decrypted to obtain the plaintext login password before being transmitted to the application server. The decryption process is the reverse operation of the encryption process, which will not be described here.

[0122] Figure 6 FIG. 4 shows a schematic diagram of the actual interface of the backplane of the password management system according to an exemplary embodiment of the present disclosure. Figure 6 As shown in FIG. 1 , the application server and the database server can be connected to the password management system through a wired connection. The connection diagram of the application server, the database server and the password management system is shown in FIG. Figure 7 As shown, from Figure 7It can be seen that the middleware is pre-installed in the application server, and the middleware is connected to the password management system through the OAuth 2.0 (Open Authorization 2.0) protocol. The OAuth 2.0 protocol is an open standard authorization framework protocol that allows users to authorize third-party applications to access their resources hosted on another service provider without sharing their credentials (such as usernames and passwords). The OAuth2.0 protocol provides a token instead of directly using usernames and passwords to access user data. At the same time, the password management system provides an open API access interface to the outside world, and the middleware of the application server connects to the API interface of the password management system through SSL tunnel communication. Users need to configure the basic environment information of the application server (such as operating system, network access port, etc.) in the password management system to allow the password management system to fully manage all resources in this application server. On the other hand, the password management system configures an SSL communication tunnel for the user's database server separately. The SSL tunnel can forward the network data of other TCP ports through the SSL communication tunnel connection and automatically provide corresponding encryption and decryption services. This process is also called "tunneling" communication, thereby ensuring that the network communication between the password management system and the database server is carried out in an encrypted channel. The user also needs to configure the relevant information of the database server in the password management system to allow the password management system to fully manage all resources in this database server.

[0123] The above configuration process actually completely manages the application server and database server into the password management system, making the password management system the core bastion host for user application system account key management. When the application server needs to access the database, the password management system will temporarily generate a token through the OAuth 2.0 protocol. The application server uses the token to form an encrypted password and allows access to the data content in the database server. Because business users directly access the application server, the underlying management will not affect changes in the business layer. Therefore, the overall application system does not need to be adjusted, making the password management method of this solution very flexible.

[0124] Figure 8 A schematic diagram of the interaction process of a database account information management method according to an exemplary embodiment of the present disclosure is shown. Figure 8As shown, the application server needs to be initialized first, including but not limited to releasing the original hard-coded link relationship between the application server and the database server, and simultaneously deleting the configuration, boot, method, class library files, etc. that may be required for the application to initialize access to the database. In addition, middleware needs to be deployed in the application server to communicate with the public API interface of the password management system. For the password management system, the administrator needs to configure all servers that require password management in the password management system in advance, including application servers and database servers, so that the password management system can manage all resources of the access server. Among them, when the administrator logs in to the password management system, it needs to be completed using SSL certificate encryption.

[0125] The login method of the password management system adopts the SSL certificate encryption authentication method. The SSL certificate is a method used for identity authentication in the SSL protocol. It includes public key, private key and user-defined identity string. The overall login process is: the user and the server each generate their own public key and send these public keys to the CA (certificate authority). The CA uses the server's public key to generate a server certificate and sends it to the server; at the same time, the CA uses the user's public key to generate a user certificate and sends it to the user. When the user tries to log in to the server, SSL automatically sends the user certificate to the server. The server checks whether the user certificate is valid and whether it is issued by a trusted CA. If the certificate is valid and credible, the server will trust the user. After confirming that both parties trust each other, SSL begins identity authentication and session establishment, including operations such as exchanging encryption keys and negotiating symmetric encryption algorithms to ensure the security of data transmission. After completing identity authentication and session establishment, all data passing through the SSL channel will be encrypted to ensure that the data is not stolen or tampered with during transmission. The entire process is automatically handled by the SSL protocol, and users do not need to intervene manually, thus ensuring security and convenience. In addition, using certificates for authentication is safer than traditional public key authentication because it can verify that the certificate is issued by a trusted CA and does not require the server to store the user's public key database locally. At the same time, since SSL specifies that the client must have a digital certificate and a fixed IP address, it eliminates the possibility of intercepting the password management server for remote login operations after a network attack, one because the IP address is illegal, and the other because there is no legal SSL certificate, thus ensuring that the login users are all legally authorized users.

[0126] like Figure 8As shown, after the administrator logs in to the password management system, in the application server management stage of step 3, by manually adding resources, the resources of the application server (specifically including the DNS name, IP address, and port number information of the application server) are filled into the password security management system, and the resource becomes a whitelist legal resource of the password management system. At the same time, a system administrator account can be configured for the resource to facilitate the later application system administrator to perform in-depth configuration management of the resource. Correspondingly, in the database server management stage of step 4, the administrator can manage the database server by manually adding the resources of the database server. The specific method of management can refer to the relevant description of the aforementioned embodiment, which will not be repeated here. The password of the managed database server is encrypted and stored in the local database. In the account password data encryption storage stage of step 5, all kinds of resource information and user account password information filled in by the administrator will be encrypted and stored in the password management system.

[0127] After completing the above basic operations, the specific implementation process is shown in steps 6.1 to 6.5. First, the application server requests the access token access_token (i.e., the target token) from the password management system through appid (i.e., the server identifier) ​​and secret (i.e., the unique credential key), and the password management system returns access_token to the application server. After that, the application server requests the account password (i.e., password) of the database server through access_token and the account name, and the password management system returns the account password to the application server. The returned account password is encrypted and transmitted using the CBC (Cipher BlockChaining) mode of AES. The password management system returns the following JSON data packet to the API interface of the application server. The data packet format is as follows:

[0128] {"data":DATA,"iv":IV}

[0129] The two key basic parameters are described as follows:

[0130] (1) data: password ciphertext encrypted using AES_CBC;

[0131] (2) iv: initialization vector encrypted using AES_CBC;

[0132] The key technical point of the data packet is that the data packet is returned using a public AES_CBC encryption algorithm.

[0133] After the middleware of the application server receives the encrypted data packet sent back by the password management system, it completes the reverse decryption. There is a close relationship between the AES_CBC encryption algorithm and Base64 encoding. In practical applications, it is usually necessary to encode the data encrypted in the AES_CBC mode in Base64 for easy transmission and storage. The specific decryption process is as follows:

[0134] (1) Encode the data in base64;

[0135] (2) Base64 encode the iv;

[0136] (3) Use AES_CBC to reversely decrypt data, with the key value being access_token and the padding method being zeropaddin. Remove zeros from the ciphertext to obtain the password.

[0137] Among them, step (3) is illustrated by the following code example:

[0138] key="583519634b054961b244b3b824c44a50"

[0139] iv=base64.b64decode('J+7zTl+miH23ezlKPcBTew==')

[0140] aes=AES.new(key.encode('utf8'),AES.MODE_CBC,iv)

[0141] data='KZuKWXP3hGNeShhegfJ7Ng=='

[0142] crypt_text=base64.b64decode(base64_crypt_text.encode('utf8'))

[0143] plain_text_byte=aes.decrypt(crypt_text)

[0144] plain_text=plain_text_byte.rstrip(b'\0').decode('utf8').

[0145] After the above decryption process, the application server will obtain the password information of the corresponding account to access the database server. Note: Step 6.5 can be encapsulated in the method or class library of the development code, and desensitized again after compilation. The development process of the corresponding development code method or class library is to encapsulate the overall decryption algorithm in the method or class library, and then implement the corresponding data operation when it is determined that the connection with the database is successful. This class or method can be referenced by all other codes in the application system, conforms to the object-oriented programming concept, and is applicable to all current mainstream development languages.

[0146] The exemplary embodiment of the present disclosure further provides a database account information management device, which is applied to a password management system, and the password management system manages resources of an application server and a database server.

[0147] Fig. 9 A schematic block diagram of a database account information management device according to an exemplary embodiment of the present disclosure is shown. Fig. 9 As shown, the database account information management device 60 includes: a token acquisition module 610, a token sending module 620, an account determination module 630 and an account sending module 640.

[0148] The token acquisition module 610 is used to acquire a target token in response to receiving a token acquisition request sent by the application server;

[0149] A token sending module 620, configured to feed back the target token to the application server, so that the application server generates a database access request based on the target token;

[0150] An account determination module 630 is configured to determine target account information corresponding to a database server to be accessed based on the database access request in response to receiving the database access request;

[0151] The account sending module 640 is used to send the target account information to the application server, so that the application server accesses the database server to be accessed based on the target account information.

[0152] Optionally, the database account information management device 60 further includes: a server management module, which is used to:

[0153] Acquire registration parameter information of a server, wherein the server includes an application server and a database server;

[0154] Based on the registration parameter information, generating a server identifier and a unique credential key corresponding to the server;

[0155] adding the server identification and the unique credential key to an access authorization list to authorize the server to access the password management system;

[0156] Add the IP address in the registration parameter information to the whitelist;

[0157] The user status corresponding to the server identifier and the unique credential key is set to an open state.

[0158] Optionally, the database account information management device 60 further includes:

[0159] An adding module is used to add the server identifier and the unique credential key to the configuration file of the middleware of the server, so that the server sends the token acquisition request to the password management system through the middleware, wherein the token acquisition request carries the server identifier and the unique credential key.

[0160] Optionally, the token acquisition module 610 is further configured to:

[0161] In response to receiving a token acquisition request sent by the middleware of the application server, acquiring a target server identifier and a target unique credential key carried in the token acquisition request;

[0162] Determining whether the target server identifier and the target unique credential key exist in the access authorization list;

[0163] If the target server identifier and the target unique credential key exist in the access authorization list, determining whether the source IP address of the token acquisition request exists in the whitelist;

[0164] If the source IP address exists in the whitelist, the target token is obtained.

[0165] Optionally, the token sending module 620 is further used for:

[0166] When the user status corresponding to the target server identifier and the target unique credential key is in an open state, the target token is fed back to the application server through the SSL tunnel between the application server and the application server.

[0167] Optionally, the account determination module 630 is further configured to:

[0168] Obtaining the target token carried in the database access request and the account name of the database server to be accessed;

[0169] If the target token is verified, determine the corresponding login password based on the account name;

[0170] The login password is encrypted according to a preset encryption algorithm to generate the target account information.

[0171] Optionally, the database account information management device 60 further includes:

[0172] A modified information acquisition module, configured to acquire modified account information in response to receiving a user's account information modification operation on a target database server;

[0173] A replacement module is used to replace the account information of the target database server recorded in the local database with the modified account information.

[0174] Further optionally, the information acquisition module is modified to be further used for:

[0175] Obtaining the account name and / or login password input by the user based on the account information modification operation;

[0176] When the user inputs the login password, the encryption chip is called to encrypt the login password to generate a password ciphertext;

[0177] The modified account information is generated based on the account name and / or the ciphertext password.

[0178] The database account information management device provided in the embodiments of the present disclosure can execute any database account information management method provided in the embodiments of the present disclosure that can be applied to the password management system, and has the corresponding functional modules and beneficial effects of the execution method. For the contents not fully described in the embodiments of the present disclosure, reference can be made to the description in any method embodiment of the present disclosure.

[0179] The exemplary embodiments of the present disclosure also provide an electronic device, including: a processor; and

[0180] Memory for storing programs,

[0181] The program includes instructions, and when the instructions are executed by the processor, the processor executes the database account information management method provided by any of the aforementioned embodiments.

[0182] The exemplary embodiments of the present disclosure further provide a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions, when executed by a processor of a computer, are used to cause the computer to execute the database account information management method provided by any of the aforementioned embodiments.

[0183] The exemplary embodiments of the present disclosure further provide a computer program product, including a computer program, wherein when the computer program is executed by a processor of a computer, the database account information management method provided by any of the aforementioned embodiments is implemented.

[0184] refer to Fig.10 , a block diagram of an electronic device 1100 that can be used as a server or client of the present disclosure will now be described, which is an example of a hardware device that can be applied to various aspects of the present disclosure. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0185] like Fig.10 As shown, the electronic device 1100 includes a computing unit 1101, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 1102 or a computer program loaded from a storage unit 1108 into a random access memory (RAM) 1103. In the RAM 1103, various programs and data required for the operation of the electronic device 1100 can also be stored. The computing unit 1101, the ROM 1102, and the RAM 1103 are connected to each other via a bus 1104. An input / output (I / O) interface 1105 is also connected to the bus 1104.

[0186] Multiple components in the electronic device 1100 are connected to the I / O interface 1105, including: an input unit 1106, an output unit 1107, a storage unit 1108, and a communication unit 1109. The input unit 1106 can be any type of device that can input information to the electronic device 1100, and the input unit 1106 can receive input digital or character information, and generate key signal input related to user settings and / or function control of the electronic device. The output unit 1107 can be any type of device that can present information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 1108 can include but is not limited to a disk, an optical disk. The communication unit 1109 allows the electronic device 1100 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include but is not limited to a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth™ device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0187] The computing unit 1101 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 1101 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 1101 performs the various methods and processes described above. For example, in some embodiments, the database account information management method may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 1108. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 1100 via the ROM 1102 and / or the communication unit 1109. In some embodiments, the computing unit 1101 may be configured to execute the database account information management method in any other appropriate manner (e.g., by means of firmware).

[0188] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0189] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0190] As used in this disclosure, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and / or device (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0191] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0192] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0193] A computer system may include clients and servers. Clients and servers are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship to each other.

Claims

1. A database account information management method, characterized in that: Applied to a password management system, the password management system manages resources of an application server and a database server, the method comprising: In response to receiving the token acquisition request sent by the application server, acquiring a target token; Feeding back the target token to the application server, so that the application server generates a database access request based on the target token; In response to receiving the database access request, determining target account information corresponding to the database server to be accessed based on the database access request; The target account information is sent to the application server, so that the application server accesses the database server to be accessed based on the target account information.

2. The method according to claim 1, characterized in that The password management system implements the management of the server in the following manner, wherein the server includes an application server and a database server: Obtaining registration parameter information of the server; Based on the registration parameter information, generating a server identifier and a unique credential key corresponding to the server; adding the server identification and the unique credential key to an access authorization list to authorize the server to access the password management system; Add the IP address in the registration parameter information to the whitelist; The user status corresponding to the server identifier and the unique credential key is set to an open state.

3. The method according to claim 2, characterized in that The method further comprises: The server identifier and the unique credential key are added to the configuration file of the middleware of the server, so that the server sends the token acquisition request to the password management system through the middleware, wherein the token acquisition request carries the server identifier and the unique credential key.

4. The method according to claim 3, characterized in that The step of acquiring a target token in response to receiving a token acquisition request sent by the application server comprises: In response to receiving a token acquisition request sent by the middleware of the application server, acquiring a target server identifier and a target unique credential key carried in the token acquisition request; Determining whether the target server identifier and the target unique credential key exist in the access authorization list; If the target server identifier and the target unique credential key exist in the access authorization list, determining whether the source IP address of the token acquisition request exists in the whitelist; If the source IP address exists in the whitelist, the target token is obtained.

5. The method according to claim 4, characterized in that Feeding back the target token to the application server includes: When the user status corresponding to the target server identifier and the target unique credential key is in an open state, the target token is fed back to the application server through the SSL tunnel between the application server and the application server.

6. The method according to any one of claims 1 to 5, characterized in that: The determining, based on the database access request, target account information corresponding to the database server to be accessed includes: Obtaining the target token carried in the database access request and the account name of the database server to be accessed; If the target token is verified, determine the corresponding login password based on the account name; The login password is encrypted according to a preset encryption algorithm to generate the target account information.

7. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: In response to receiving an account information modification operation of a user on a target database server, obtaining modified account information; The account information of the target database server recorded in the local database is replaced with the modified account information.

8. The method according to claim 7, characterized in that The obtaining of modified account information includes: Obtaining the account name and / or login password input by the user based on the account information modification operation; When the user inputs the login password, the encryption chip is called to encrypt the login password to generate a password ciphertext; The modified account information is generated based on the account name and / or the ciphertext password.

9. A database account information management device, characterized in that: Applied to a password management system, the password management system manages resources of an application server and a database server, and the device comprises: A token acquisition module, configured to acquire a target token in response to receiving a token acquisition request sent by the application server; A token sending module, used for feeding back the target token to the application server, so that the application server generates a database access request based on the target token; an account determination module, configured to, in response to receiving the database access request, determine target account information corresponding to the database server to be accessed based on the database access request; An account sending module is used to send the target account information to the application server, so that the application server accesses the database server to be accessed based on the target account information.

10. An electronic device, comprising: processor; as well as Memory for storing programs, It is characterized in that the program includes instructions, and when the instructions are executed by the processor, the processor executes the database account information management method according to any one of claims 1-8.

Images