Database access control method and storage medium

Abstract

The invention relates to the technical field of data security, and discloses a database access control method and a storage medium, the method is applied to a server, and the method comprises the following steps: when a connection between a first client and a database is monitored, establishing a first connection between a network probe and the database, and establishing a second connection between the network probe and the database; a second connection between the network probe and the database firewall is established, the network probe is arranged in the server, when the first client side sends an access data packet to the database, the access data packet is sent to the network probe through the first connection, and the access data packet is processed through the network probe; the network probe is used for processing the access data packet and sending the processed access data packet to the database firewall through the second connection, the processed access data packet comprises the first client information of the first client, and the network probe enables the first client directly connected with the database to be included in the management and control range of the database firewall. Therefore, the database firewall realizes accurate tracing of database operation behaviors.

Description

Technical Field

[0001] The present application relates to the technical field of data security and provides a database access control method and a storage medium. Background Art

[0002] In reverse proxy mode, the client first connects to the proxy port of the database firewall, and then the database firewall connects to the database, thereby realizing the connection between the client and the database. In this way, when the client accesses the database, the database firewall can control and trace the client's behavior.

[0003] However, there are still some clients, such as those used by developers and maintenance personnel, that bypass the proxy provided by the database firewall and connect directly to the database. Obviously, these clients that are directly connected to the database are not included in the control scope of the database firewall. The database firewall cannot control and trace the clients that are directly connected to the database, which poses a security risk to the database. Summary of the invention

[0004] The embodiments of the present application provide a database access control method and storage medium to enhance the control scope and traceability capability of a database firewall on a client.

[0005] The specific technical solutions provided by this application are as follows:

[0006] In a first aspect, an embodiment of the present application provides a database access control method, which is applied to a server, and the method includes:

[0007] When it is detected that there is a connection between the first client and the database, a first connection is established between the network probe and the database, and a second connection is established between the network probe and the database firewall, wherein the network probe is set in the server;

[0008] When the first client sends an access data packet to the database, the access data packet is sent to the network probe through the first connection, the access data packet is processed by the network probe, and the processed access data packet is sent to the database firewall through the second connection, wherein the processed access data packet includes the first client information of the first client.

[0009] Optionally, establishing a first connection between the network probe and the database includes:

[0010] Based on the correspondence between the preset database port and the network probe listening port, determine the first network probe listening port corresponding to the first database port, wherein the first database port represents the port in the database used to connect with the first client, and the first network probe listening port represents the port in the network probe used to connect with the database;

[0011] A mapping between the first database port and the first network probe listening port is established, and the mapping is determined as a first connection between the network probe and the database.

[0012] Optionally, establishing a second connection between the network probe and the database firewall includes:

[0013] Based on the correspondence between the preset network probe listening port and the firewall port, determine the first firewall port corresponding to the second network probe listening port, wherein the second network probe listening port represents the port in the network probe used to connect to the database firewall, and the first firewall port represents the port in the database firewall used to connect to the network probe;

[0014] A connection is established between the second network probe listening port and the first firewall port, and the connection is determined as a second connection between the network probe and the database firewall.

[0015] Optionally, use network probes to process access packets, including:

[0016] Analyze the access data packet using a network probe to determine first client information of a first client corresponding to the access data packet;

[0017] The access data packet and the first client information are bound together using a network probe to obtain a processed access data packet.

[0018] Optionally, the method further comprises:

[0019] When it is monitored that there is a third connection between the second client and the database firewall, the request data packet of the second client is sent to the database firewall through the third connection, wherein the client information of the second client is different from that of the first client.

[0020] Optionally, after sending the request data packet of the second client to the database firewall through the third connection, the method further includes:

[0021] When it is monitored that there is a fourth connection between the database firewall and the database, a response data packet is sent to the database firewall through the fourth connection, so that the database firewall sends the response data packet to the second client.

[0022] In a second aspect, an embodiment of the present application provides a database access control method, which is applied to a database firewall, including:

[0023] The first client information of the first client is determined based on the received processed access data packet, wherein the processed access data packet is sent to the database firewall through the second connection after the network probe processes the access data packet, when the first client sends the access data packet to the database, the network probe receives the access data packet through the first connection, the first connection is a connection between the network probe and the database established when a connection between the first client and the database is detected, the second connection is a connection between the network probe and the database firewall established when a connection between the first client and the database is detected, and the network probe is set in the server.

[0024] Optionally, after determining the first client information of the first client based on the received processed access data packet, the method further includes:

[0025] The received request data packet is parsed to determine the second client information of the second client corresponding to the request data packet.

[0026] In a third aspect, a server includes:

[0027] A memory for storing executable instructions;

[0028] A processor is used to read and execute executable instructions stored in a memory to implement any method as described in the first aspect.

[0029] In a fourth aspect, a database firewall includes:

[0030] A memory for storing executable instructions;

[0031] A processor is used to read and execute executable instructions stored in a memory to implement any method as described in the second aspect.

[0032] In a fifth aspect, a computer-readable storage medium is provided. When instructions in the storage medium are executed by a processor, the processor is enabled to execute the method described in any one of the first aspect or the second aspect.

[0033] The beneficial effects of this application are as follows:

[0034] To summarize, in an embodiment of the present application, a database access control method and storage medium are provided, which are applied to a server, and the method includes: when a connection is detected between a first client and a database, a first connection is established between a network probe and the database, and a second connection is established between the network probe and a database firewall, wherein the network probe is arranged in the server, and when the first client sends an access data packet to the database, the access data packet is sent to the network probe through the first connection, the access data packet is processed by the network probe, and the processed access data packet is sent to the database firewall through the second connection, wherein the processed access data packet includes the first client information of the first client, and the setting of the above-mentioned network probe enables the first client directly connected to the database to be included in the management and control scope of the database firewall, thereby enabling the database firewall to accurately trace the database operation behavior.

[0035] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0037] Figure 1 This is a schematic diagram of the connection between the first client and the database firewall via a network probe in an embodiment of the present application;

[0038] Figure 2 A schematic diagram of a process for access control to a database in an embodiment of the present application;

[0039] Figure 3 A schematic diagram of a process for establishing a first connection between a network probe and a database in an embodiment of the present application;

[0040] Figure 4 A schematic diagram of a process for establishing a second connection between a network probe and a database firewall in an embodiment of the present application;

[0041] Figure 5 A schematic diagram of a process of processing an access data packet using a network probe in an embodiment of the present application;

[0042] Figure 6 This is a flow diagram of the interaction between the first client and the database firewall in the embodiment of the present application;

[0043] Figure 7 This is a schematic diagram of the connection between the second client and the database firewall in an embodiment of the present application;

[0044] Figure 8 This is a schematic diagram of a scenario in which the second client is connected to the database via a database firewall in an embodiment of the present application;

[0045] Fig. 9 This is a flow chart of a first client and a second client both connecting to a database firewall in an embodiment of the present application;

[0046] Fig.10 This is another flow chart of connecting the first client and the second client to the database firewall in an embodiment of the present application;

[0047] Fig.11 This is a schematic diagram of a process for a database firewall to obtain first client information and second client information in an embodiment of the present application;

[0048] Fig.12 A schematic diagram of a physical architecture of a server in an embodiment of the present application;

[0049] Fig.13 This is a schematic diagram of the physical architecture of a database firewall in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0051] The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented using sequences other than those illustrated or described herein.

[0052] The preferred implementation modes of the present application are described in detail below with reference to the accompanying drawings.

[0053] See also Figure 1 As shown, in the embodiment of the present application, the system includes at least one first client, a database firewall, a database and a network probe, wherein the database and the network probe are both set in the server. It should be noted that in Figure 1In the example, the first client represents a client that is directly connected to the database.

[0054] In the embodiment of the present application, an implementation of a database access control method is mainly divided into two aspects: the server side and the database firewall side. The following first introduces the situation where the server side executes the database access control method.

[0055] See also Figure 2 As shown, in the embodiment of the present application, the specific process of a database access control method is as follows:

[0056] Step 201: When a connection is detected between a first client and a database, a first connection is established between a network probe and the database, and a second connection is established between the network probe and a database firewall, wherein the network probe is set in a server.

[0057] When it is detected that there is a connection between the first client and the database, that is, the first client and the database are directly connected, in order to enable the first client to be included in the control and traceability scope of the database firewall, in the embodiment of the present application, a network probe will be first set in the server, and the connection between the database firewall and the database will be realized through the network probe. In this way, after the first client is connected to the database, it will be connected to the database firewall through the network probe. In the specific implementation process, the connection between the network probe and the database is called the first connection, and the connection between the network probe and the database firewall is called the second connection.

[0058] The above establishes the first connection between the network probe and the database, see Figure 3 As shown, including:

[0059] Step 2011: Based on the correspondence between the preset database port and the network probe listening port, determine the first network probe listening port corresponding to the first database port, wherein the first database port represents the port in the database used to connect with the first client, and the first network probe listening port represents the port in the network probe used to connect with the database.

[0060] Taking into account that there may be multiple first clients connected to the database, the number of first database ports in the database used to connect with each first client is one. In order to realize the connection between the above-mentioned first clients and the database firewall, a first network probe listening port needs to be set accordingly in the above-mentioned network probe, that is, after the first client connects to the database via the first database port, it realizes the connection with the network probe via the first network probe listening port.

[0061] In order to better match the ports between the database and the network probe, in the embodiment of the present application, a correspondence between the database port and the network probe listening port is pre-established, that is, a one-to-one correspondence is established between the first database port and the first network probe listening port.

[0062] When it is monitored that the database and the first client are connected through the first database port, the first network scout listening port corresponding to the first database port is determined according to the correspondence between the preset database port and the network scout listening port. That is, after it is clear that the first client and the database are connected through the first database port, the first network scout listening port for the connection between the above-mentioned database and the network probe is determined.

[0063] Example 1: It is monitored that the database is connected to the first client 1 through the first database port a, the database is connected to the first client 2 through the first database port a, and the database is connected to the first client 3 through the first database port a. According to the correspondence between the preset database port and the network scout listening port, it is determined that the first database port a corresponds to the first network scout listening port A.

[0064] Step 2012: Establish a mapping between the first database port and the first network probe listening port, and determine the mapping as a first connection between the network probe and the database.

[0065] During the implementation process, after determining the first database port and the first network scouting listening port, a mapping between the first database port and the first network scouting listening port is established, that is, the port mapping between the network probe and the database and the establishment of a hardware link are realized, and the mapping between the above-mentioned first database port and the first network scouting listening port is determined as the first connection between the network probe and the database.

[0066] Still using the above example 1 as an example, when the first client 2 connects to the database through the first database port a and determines that the first database port a corresponds to the first network probe listening port A, a first connection 2 is established between the first database port a and the first network probe listening port A, that is, the first client 2 is connected to the network probe through the first connection 2 after connecting to the database.

[0067] Similarly, the second connection between the network probe and the database firewall is established as described above. Figure 4 As shown, including:

[0068] Step 2011': Based on the correspondence between the preset network probe listening port and the firewall port, determine the first firewall port corresponding to the second network probe listening port, wherein the second network probe listening port represents the port in the network probe used to connect to the database firewall, and the first firewall port represents the port in the database firewall used to connect to the network probe.

[0069] During the implementation process, when the number of first clients connected to the database is multiple, the number of the first database port and the first network sniffer listening port is also one, and the number of the first firewall port connected to the second network sniffer listening port in the database firewall is one, that is, after the first client connects to the database via the first database port, it connects to the network probe via the first network sniffer listening port, and then connects to the database firewall via the second network sniffer listening port and the first firewall port.

[0070] In order to better match the ports between the network probe and the database firewall, in the embodiment of the present application, a correspondence between the network probe listening port and the firewall port is pre-established, that is, the second network probe listening port is one-to-one corresponding to the first firewall port.

[0071] After monitoring the connection between the network probe and the database through the first network probe listening port, the first firewall port corresponding to the second network probe listening port is determined according to the correspondence between the preset network probe listening port and the firewall port. That is, after it is clear that the database and the network probe are connected through the first network probe listening port, the second network probe listening port and the first firewall port connected between the above network probe and the database firewall are determined.

[0072] Example 2: After monitoring the establishment of the first connection, it is further determined that the first client 1 is connected to the database firewall through the second network scout listening port A, the first client 2 is connected to the database firewall through the second network scout listening port B, and the first client 3 is connected to the database firewall through the second network scout listening port C. According to the preset correspondence between the network scout listening port and the firewall port, it is determined that the second network scout listening port A corresponds to the first firewall port 11, the second network scout listening port B corresponds to the first firewall port 11, and the second network scout listening port C corresponds to the first firewall port 11.

[0073] Step 2012': establish a connection between the second network probe listening port and the first firewall port, and determine the connection as a second connection between the network probe and the database firewall.

[0074] During the implementation process, after determining the second network probe listening port and the first firewall port, a connection is established between the second network probe listening port and the first firewall port, that is, the establishment of a hardware link between the network probe and the database firewall is realized, and the hardware link between the second network probe listening port and the first firewall port is determined as the second connection between the network probe and the database firewall.

[0075] Still using the above example 2 as an example, when the first client 2 is connected to the database firewall through the second network sniffer listening port B, and it is determined that the second network sniffer listening port B corresponds to the first firewall port 11, a second connection 20 is established between the second network sniffer listening port B and the first firewall port 11, that is, the first client 2 is connected to the database firewall through the second connection 20 after connecting to the database and the network probe.

[0076] Through the above steps, the port redirection of data packets using network probes is realized. In the specific implementation process, the port redirection can be performed for specific data packets by setting NetFilter rules. The above Netfilter is a component in the Linux kernel, which is used to handle tasks such as packet filtering and address translation. Iptables is a tool used to configure and manage Netfilter in Linux. It allows users to create, modify and delete Netfilter rules through the command line interface to customize the behavior of data packets as needed.

[0077] Step 202: When the first client sends an access data packet to the database, the access data packet is sent to the network probe via the first connection, the access data packet is processed by the network probe, and the processed access data packet is sent to the database firewall via the second connection, wherein the processed access data packet includes the first client information of the first client.

[0078] During the implementation, after the hardware links of the first connection and the second connection are established, when the first client sends an access data packet to the database, the access data packet is further sent to the network probe through the first connection, and the network probe is used to process the access data packet. Figure 5 As shown, specifically including:

[0079] Step 221: Use a network probe to parse the access data packet to determine the first client information of the first client corresponding to the access data packet.

[0080] During the implementation process, when the network probe receives an access data packet, it will parse the access data packet, thereby determining the first client information of the first client corresponding to the access data packet through analysis. It should be noted that the first client information may include one or more of the IP address of the first client, the port of the client and the MAC address of the client.

[0081] Step 2022: Use a network probe to bind the access data packet and the first client information to obtain a processed access data packet.

[0082] During implementation, after parsing the first client information, the network probe binds the access data packet and the first client information to obtain the processed access data packet, thereby preparing for the database firewall to obtain the first client information.

[0083] See also Figure 6 As shown, in the actual interaction process, after the network probe is used to obtain the first client information, the above-processed access data packet will continue to be sent to the database firewall, so that the database firewall can obtain and save the first client information. When the first client sends request data (for example, the above-mentioned access data packet), the above-mentioned request data will be transmitted to the network probe via the first connection, and then transmitted to the database firewall via the second connection, so that the database returns the response data for the request data. Correspondingly, the database sends the above-mentioned response data to the database firewall, sends the response data to the network probe via the second connection, and then sends the response data to the first client via the first connection. In this way, the database firewall can control the interaction between the first client and the database, and trace the request data and response data accordingly.

[0084] It should be noted that, in addition to the first client directly connected to the database, the embodiment of the present application also includes a second client, see Figure 7 As shown in the figure, this type of client first connects to the database firewall and then to the database. Figure 7 Under the connection relationship shown, the database firewall can control and trace the behavior of the second client accessing the database without the participation of the network probe. In the actual application scenario, when the second client is directly connected to the database through a switch, the database firewall will divert the data of the second client to the database, thereby realizing the control and traceability of the second client by the database firewall, see Figure 8 shown.

[0085] It should also be noted that in order to effectively distinguish the first client and the second client, during the implementation process, different labels can be set for the first client and the second client in advance. For example, the IP address of the client directly connected to the database is marked as a first-class IP address, and the IP address of the client directly connected to the database firewall is marked as a second-class IP address. In this way, in the subsequent processing process, the first client and the second client can be distinguished only by the IP address.

[0086] In addition, when the connection relationship between the second client, the database firewall and the database is as follows Figure 7 When shown, refer to Fig. 9 As shown, the method also includes:

[0087] Step 203: When it is detected that there is a third connection between the second client and the database firewall, the request data packet of the second client is sent to the database firewall through the third connection, wherein the client information of the second client is different from that of the first client.

[0088] During the implementation process, when it is monitored that there is a third connection between the second client and the database firewall, that is, when the second client and the database firewall are directly connected, in the embodiment of the present application, when the second client sends a request data packet to the database, the request data packet of the second client is sent to the database firewall through the third connection. It should be noted that the third connection is a hardware link established according to the one-to-one correspondence between the port of the second client and the port of the database firewall.

[0089] In addition, it should be further explained that the client information corresponding to the second client is different from that of the first client, that is, the IP address, the port of the client and the MAC address of the client of the second client are all different from those of the first client.

[0090] After the second client's request data packet is sent to the database firewall through the third connection, refer to Fig.10 As shown, it also includes:

[0091] Step 204: When it is detected that there is a fourth connection between the database firewall and the database, a response data packet is sent to the database firewall through the fourth connection, so that the database firewall sends the response data packet to the second client.

[0092] During the implementation process, after the request data packet of the second client is sent to the database firewall through the third connection, the fourth connection between the database firewall and the database is further determined. The fourth connection here is a hardware link established based on the one-to-one correspondence between the port of the database firewall and the port of the database, which will not be repeated here.

[0093] When the fourth connection between the database firewall and the database is detected, the request data packet is further sent to the database through the fourth connection, so that the database transmits a response data packet to the request data packet, and sends the response data packet to the database firewall through the fourth connection, and further sends the response data packet to the second client through the third connection. In the above process, the database firewall can realize the control and traceability of the second client's access to the database.

[0094] The following first introduces the implementation of database access control methods on the database firewall side. Fig.11 As shown, in the embodiment of the present application, the specific process of the database firewall controlling the client is as follows:

[0095] Step 301: Determine the first client information of the first client based on the received processed access data packet, wherein the processed access data packet is sent to the database firewall through the second connection after the network probe processes the access data packet, when the first client sends the access data packet to the database, the network probe receives the access data packet through the first connection, the first connection is a connection between the network probe and the database established when a connection is detected between the first client and the database, the second connection is a connection between the network probe and the database firewall established when a connection is detected between the first client and the database, and the network probe is set in the server.

[0096] During the implementation process, after receiving the processed access data packet, the database firewall further parses the processed access data packet to determine the first client information of the first client. In this way, when the first client sends the access data packet to the database, the database firewall can obtain the processed access data packet through the network probe, thereby effectively controlling and tracing the first client.

[0097] It should be noted that a first connection is established between the first client and the database, and a second connection is established between the network probe and the database firewall. The specific transmission of the access data packet will not be described in detail here.

[0098] After determining the first client information of the first client based on the received processed access data packet, refer to Fig.11 As shown, it also includes:

[0099] Step 302: Parse the received request data packet to determine the second client information of the second client corresponding to the request data packet.

[0100] In order to realize the control and traceability of all clients by the database firewall, in the embodiment of the present application, after the second client sends a request data packet, the database firewall can also parse the received request data packet to determine the second client information of the second client corresponding to the request data packet. In this way, when the second client sends a request data packet to the database firewall, the database firewall can obtain the client information of the second client, thereby effectively controlling and tracing the second client.

[0101] Based on the same inventive concept, refer to Fig.12 As shown, an embodiment of the present application provides a server, including: a memory 1201, used to store executable instructions; a processor 1202, used to read and execute the executable instructions stored in the memory, and execute any one of the methods of the first aspect above.

[0102] Based on the same inventive concept, refer to Fig.13 As shown, an embodiment of the present application provides a database firewall, including: a memory 1301, used to store executable instructions; a processor 1302, used to read and execute the executable instructions stored in the memory, and execute any one of the methods of the second aspect above.

[0103] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium. When the instructions in the storage medium are executed by a processor, the processor is enabled to execute the method described in any one of the first aspect or the second aspect above.

[0104] To summarize, in an embodiment of the present application, a database access control method and storage medium are provided, which are applied to a server, and the method includes: when a connection is detected between a first client and a database, a first connection is established between a network probe and the database, and a second connection is established between the network probe and a database firewall, wherein the network probe is arranged in the server, and when the first client sends an access data packet to the database, the access data packet is sent to the network probe through the first connection, the access data packet is processed by the network probe, and the processed access data packet is sent to the database firewall through the second connection, wherein the processed access data packet includes the first client information of the first client, and the setting of the above-mentioned network probe enables the first client directly connected to the database to be included in the management and control scope of the database firewall, thereby enabling the database firewall to accurately trace the database operation behavior.

[0105] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program product systems. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product system implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0106] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program product systems according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0107] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0108] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0109] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A database access control method, characterized in that: Applied to a server, the method comprises: When a connection is detected between the first client and the database, a first connection is established between the network probe and the database, and a second connection is established between the network probe and a database firewall, wherein the network probe is arranged in the server; When the first client sends an access data packet to the database, the access data packet is sent to the network probe through the first connection, the access data packet is processed by the network probe, and the processed access data packet is sent to the database firewall through the second connection, wherein the processed access data packet includes the first client information of the first client.

2. The method according to claim 1, characterized in that The establishing of a first connection between the network probe and the database comprises: Based on the correspondence between the preset database port and the network probe listening port, determine the first network probe listening port corresponding to the first database port, wherein the first database port represents the port in the database used to connect with the first client, and the first network probe listening port represents the port in the network probe used to connect with the database; A mapping between the first database port and the first network probe listening port is established, and the mapping is determined as a first connection between the network probe and the database.

3. The method according to claim 1, characterized in that The establishing of a second connection between the network probe and the database firewall comprises: Based on the correspondence between the preset network probe listening port and the firewall port, determine the first firewall port corresponding to the second network probe listening port, wherein the second network probe listening port represents the port in the network probe used to connect to the database firewall, and the first firewall port represents the port in the database firewall used to connect to the network probe; A connection is established between the second network probe listening port and the first firewall port, and the connection is determined as a second connection between the network probe and the database firewall.

4. The method according to claim 1, characterized in that The using the network probe to process the access data packet includes: parsing the access data packet using the network probe to determine first client information of the first client corresponding to the access data packet; The access data packet and the first client information are bound together using the network probe to obtain a processed access data packet.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: When it is monitored that there is a third connection between the second client and the database firewall, a request data packet of the second client is sent to the database firewall through the third connection, wherein the client information of the second client is different from that of the first client.

6. The method according to claim 5, characterized in that After sending the request data packet of the second client to the database firewall through the third connection, the method further includes: When it is monitored that there is a fourth connection between the database firewall and the database, a response data packet is sent to the database firewall through the fourth connection, so that the database firewall sends the response data packet to the second client.

7. A database access control method, characterized in that: The method is applied to a database firewall, comprising: The first client information of the first client is determined based on the received processed access data packet, wherein the processed access data packet is sent to the database firewall through the second connection after the network probe processes the access data packet, when the first client sends the access data packet to the database, the network probe receives the access data packet through the first connection, the first connection is a connection between the network probe and the database established when a connection is detected between the first client and the database, the second connection is a connection between the network probe and the database firewall established when a connection is detected between the first client and the database, and the network probe is set in the server.

8. The method according to claim 7, characterized in that After determining the first client information of the first client based on the received processed access data packet, the method further includes: The received request data packet is parsed to determine the second client information of the second client corresponding to the request data packet.

9. A server, characterized in that: include: A memory for storing executable instructions; A processor, configured to read and execute the executable instructions stored in the memory to implement the method according to any one of claims 1 to 6.

10. A database firewall, characterized in that: include: A memory for storing executable instructions; A processor, configured to read and execute the executable instructions stored in the memory to implement the method according to claim 7 or 8.

11. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor, the processor is enabled to execute the method according to any one of claims 1 to 8.

Images