Security authentication method for database

Abstract

The invention discloses a security authentication method for a database. The security authentication method comprises a first identity authentication module, a second identity authentication module, an encryption module, a decryption module and an alarm module. According to the invention, encryption verification is used, a random number is used as an original text, a password is used as a key, and an encryption module is also arranged, so that an account / password is stored in an encrypted form, and the risk of data leakage is reduced while the security of a database is ensured.

Description

Technical Field

[0001] The present invention relates to data security technology in the field of wireless communications, and in particular to a security authentication method for a database. Background Art

[0002] Security authentication is the process of identifying user identities and allowing users to log in. It is the first step for users to use the database.

[0003] Among the existing database authentication methods, username / password is the most commonly used authentication method. Users provide username and password when connecting to the database. The database matches it with the credentials in the database and allows access after verification. This method is easy to configure and manage, but the security is not high. It mainly depends on the strength and storage method of the password, and there is a possibility of unauthorized access and data leakage.

[0004] In view of this, it is necessary to improve the security of the username / password authentication method. Summary of the invention

[0005] The purpose of the present invention is to provide a security authentication method for a database to solve the problems existing in the above-mentioned prior art.

[0006] To achieve the above object, the present invention provides a security authentication method for a database, comprising:

[0007] A first identity authentication module, a second identity authentication module, an encryption module, a decryption module and an alarm module;

[0008] Wherein, the first identity authentication module is connected to the encryption module, the client and the second identity authentication module;

[0009] The second identity authentication module is connected to the first identity authentication module;

[0010] The encryption module connects the first identity authentication module and the access interface of the database;

[0011] The account number / password is stored in encrypted form in the first field of the encryption module data table;

[0012] The decryption module, after receiving the account / password, decrypts the first field. If the parsing is correct, it proceeds to the next step of verification. If they are different, it ends the identity verification.

[0013] The alarm module is connected to the first identity authentication module, and sends out an alarm message when the client fails to authenticate three times in a row.

[0014] Furthermore, the first identity authentication module of the security authentication method for a database receives a verification request including the account / password from a client;

[0015] The first identity authentication module performs a first authentication on the account / password to obtain a first authentication result.

[0016] Furthermore, in the security authentication method for a database, when the first authentication result indicates that the first authentication is passed, the first identity authentication module receives a second authentication password from the client.

[0017] Furthermore, in the security authentication method for a database, the first identity authentication module sends the account and the second authentication password to the second identity authentication module;

[0018] The first identity authentication module receives a second verification result from the second identity authentication module, where the second verification result is obtained after the second identity authentication module performs a second verification on the account and the second verification password;

[0019] The first verification module sends the second verification result to the client.

[0020] Furthermore, the security authentication method for a database is provided with a second field in a database table, and the account / password is stored in the second field;

[0021] Retrieving the first field and the second field according to the access request of the client;

[0022] After decrypting the first field according to the account / password of the client, it is necessary to:

[0023] The decrypted account data in the first field is compared with the account data in the second field. If they are the same, the client is allowed to perform access processing. If they are different, the client access request is rejected.

[0024] Furthermore, the first verification step of the security authentication method for a database is:

[0025] After receiving the account number / password of the client, the first identity authentication module first decrypts the first field in the encryption module, and compares the decryption result with the second field in the database. If the same account number / password exists, a first random number is randomly generated, and the first random number is encrypted according to the triple DES method with the password of the client as the key, and the encrypted first random number and the account number of the client are sent to the client;

[0026] After receiving the encrypted first random number and the client account number from the first identity authentication module, the client decrypts the received encrypted first random number using a password according to AES to obtain a decrypted first random number;

[0027] The client sends the decrypted first random number to the first identity authentication module;

[0028] The first identity authentication module compares the received decrypted first random number with the first random number generated by itself, and if they are the same, continues the second authentication; if they are different, ends the identity authentication.

[0029] Furthermore, in the security authentication method for a database, the second identity authentication module randomly generates a second random number, encrypts the second random number using a password as a key according to a triple DES method, and sends the encrypted second random number to the first identity authentication module;

[0030] The first identity authentication module sends the encrypted second random number to the client;

[0031] The client decrypts the received encrypted second random number, and sends the decrypted second random number to the first identity authentication module, and the first identity authentication module sends it to the second identity authentication module;

[0032] The second identity authentication module compares the received decrypted second random number with the second random number generated by itself. If they are the same, the authentication is continued to the next step; if they are different, the identity authentication is terminated.

[0033] Furthermore, the security authentication method for the database stores the account / password in the first field in an encrypted form by means of DES, 3DES, IEDA, RSA, DSA, AES or MDS.

[0034] Furthermore, the security authentication method for the database stores the account number / password in plain text in the second field.

[0035] Furthermore, in the security authentication method for database, the alarm module is also connected to a remote communication module, and the remote communication module sends an alarm message to a database administrator after the alarm module sends out the alarm message three times.

[0036] The technical effects of the present invention are:

[0037] 1. The first identity authentication module and the second identity authentication module use random numbers as the original text and the password as the key for encryption, which increases the difficulty of cracking and improves security.

[0038] 2. By setting up an encryption module and saving the account / password in encrypted form, the risk of data leakage can be effectively avoided.

[0039] 3. By connecting the alarm module with the remote communication module, database administrators can more easily assess risks in advance. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0041] Figure 1 It is a schematic diagram of the connection of each module in the embodiment of the present invention. DETAILED DESCRIPTION

[0042] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0043] Embodiment 1

[0044] like Figure 1 As shown, this embodiment provides a security authentication method for a database, including a first identity authentication module, a second identity authentication module, an encryption module, a decryption module and an alarm module, and the specific steps are:

[0045] a. The client sends the account / password to the first identity authentication module and initiates a request to access the database;

[0046] B. The encryption module and decryption module are used to provide the first layer of username / password verification operations, and save the account / password in encrypted form, which can effectively avoid the risk of data leakage. Specifically:

[0047] b1. The first identity authentication module receives a request from the client to access the database and triggers the decryption module to decrypt the account / password stored in encrypted form in the first field of the encryption module data table, and compares the decrypted account / password with the account / password stored in plain text in the second field. If the account / password stored in plain text in the second field is the same as the decrypted account / password, the next step of verification is continued. Otherwise, the identity authentication is terminated and a verification failure message is sent to the client;

[0048] b2. When the first authentication module sends verification failure information to the client three times in a row, it triggers the alarm module connected to it;

[0049] b3. The alarm module is connected to a remote communication module. When the alarm module is triggered, the remote communication module sends an alarm message to the database administrator;

[0050] C. Identity verification The first module verifies the client for the first time, using a random number as the original text and a password as the key for encryption, which increases the difficulty of cracking and improves security. Specifically:

[0051] c1. If the client account / password received in b1 is the same as the decrypted account / password, the first identity verification module performs the first verification on the client:

[0052] c2. The first identity authentication module randomly generates a first random number, encrypts the first random number using the client's password as a key according to the AES method, and sends the encrypted first random number and the client's account to the client;

[0053] c3. After the client receives the encrypted first random number and the client account number of the first identity authentication module, the encrypted first random number received is decrypted using a password according to the AES method to obtain the decrypted first random number;

[0054] c4. The client sends the decrypted first random number to the first identity authentication module;

[0055] c5. The first identity authentication module compares the received decrypted first random number with the first random number generated by itself. If they are the same, the second authentication is continued. If they are different, the identity authentication is terminated.

[0056] D. The second authentication module performs a second authentication on the client based on the success of the first authentication, further improving security. Specifically:

[0057] d1. The first identity authentication module sends the first successful authentication information to the second identity authentication module;

[0058] d2. The second identity authentication module randomly generates a second random number, encrypts the second random number using the password as a key according to the AES method, and sends the encrypted second random number to the first identity authentication module;

[0059] d3. The first identity authentication module sends the encrypted second random number to the client;

[0060] d4. The client decrypts the received encrypted second random number and sends the decrypted second random number to the first identity authentication module, which then sends it to the second identity authentication module;

[0061] d5. The second identity authentication module compares the received decrypted second random number with the second random number generated by itself. If they are the same, the authentication is successful and the client accesses the database. If they are different, the identity authentication ends.

[0062] In other embodiments, further, when the client registers, the database adds a first-level tag and a second-level tag for each account / password. When an access request from the client is received, the first-level tag or the second-level tag of the user is verified. If it is a first-level tag, the permission to add, delete, modify and check all objects in the database is opened. If it is a second-level tag, only the permission to view all objects in the database is opened.

[0063] By adding tags to accounts and granting different processing permissions, the security of the database is further improved.

[0064] The above is only a preferred specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A security authentication method for a database, characterized in that: include: A first identity authentication module, a second identity authentication module, an encryption module, a decryption module and an alarm module; Wherein, the first identity authentication module is connected to the encryption module, the client and the second identity authentication module; The second identity verification module is connected to the first identity verification module; The encryption module connects the first identity authentication module and the access interface of the database; The account number / password is stored in encrypted form in the first field of the encryption module data table; The decryption module, after receiving the account / password, decrypts the first field. If the parsing is correct, it proceeds to the next step of verification. If they are different, it ends the identity verification. The alarm module is connected to the first identity authentication module, and sends out an alarm message when the client fails to authenticate three times in a row.

2. The security authentication method for a database according to claim 1, characterized in that: The first identity authentication module receives a verification request including the account / password from the client; The first identity authentication module performs a first authentication on the account / password to obtain a first authentication result.

3. The security authentication method for a database according to claim 1, characterized in that: When the first verification result indicates that the first verification is passed, the identity authentication first module receives a second verification password from the client.

4. The security authentication method for a database according to claim 1, characterized in that: The first identity verification module sends the account and the second verification password to the second identity verification module; The first identity authentication module receives a second verification result from the second identity authentication module, where the second verification result is obtained after the second identity authentication module performs a second verification on the account and the second verification password; The first verification module sends the second verification result to the client.

5. The security authentication method for a database according to claim 1, characterized in that: A second field is set in the database table, and the account / password is stored in the second field; Retrieving the first field and the second field according to the access request of the client; After decrypting the first field according to the account / password of the client: The decrypted account data in the first field is compared with the account data in the second field. If they are the same, the client is allowed to perform access processing. If they are different, the client access request is rejected.

6. The security authentication method for a database according to claim 1, characterized in that: The steps of the first verification are: After receiving the account / password of the client, the first identity authentication module first decrypts the first field in the encryption module, and compares the decryption result with the second field in the database. If the same account / password exists, a first random number is randomly generated, and the first random number is encrypted according to the AES method with the password of the client as the key, and the encrypted first random number and the account of the client are sent to the client; After receiving the encrypted first random number and the client account number from the first identity authentication module, the client decrypts the received encrypted first random number using a password according to the AES method to obtain a decrypted first random number; The client sends the decrypted first random number to the first identity authentication module; The first identity authentication module compares the received decrypted first random number with the first random number generated by itself, and if they are the same, continues the second authentication; if they are different, ends the identity authentication.

7. The security authentication method for a database according to claim 1, characterized in that: The steps of the second verification are: The second identity authentication module randomly generates a second random number, encrypts the second random number using the password as a key according to the triple DES method, and sends the encrypted second random number to the first identity authentication module; The first identity authentication module sends the encrypted second random number to the client; The client decrypts the received encrypted second random number, and sends the decrypted second random number to the first identity authentication module, and the first identity authentication module sends it to the second identity authentication module; The second identity authentication module compares the received decrypted second random number with the second random number generated by itself. If they are the same, the authentication is successful; if they are different, the identity authentication is terminated.

8. The security authentication method for a database according to claim 1, characterized in that: The account number / password is stored in the first field in an encrypted form by means of DES, 3DES, IEDA, RSA, DSA, AES or MDS.

9. The security authentication method for a database according to claim 5, characterized in that: The account number / password is stored in the second field in plain text.

10. The security authentication method for a database according to claim 1, characterized in that: The alarm module is also connected to a remote communication module, and the remote communication module sends an alarm message to a database administrator after the alarm module sends out the alarm message three times.

Images