Database access control method and storage medium

Abstract

The application relates to the technical field of data security, and discloses a database access control method and a storage medium, which are applied to a server and comprise the following steps: when it is monitored that a first client and a database exist in connection, a first connection between a network probe and the database is established, and a second connection between the network probe and a database firewall is established; the network probe is arranged in the server; when the first client sends an access data packet to the database, the access data packet is sent to the network probe through the first connection; the network probe is used to process the access data packet; and the processed access data packet is sent to the database firewall through the second connection; the processed access data packet comprises first client information of the first client; the arrangement of the network probe enables the first client directly connected with the database to be brought into the control range of the database firewall, so that the database firewall realizes accurate tracing of database operation behaviors.

Description

Technical Field

[0001] This application relates to the field of data security technology, and provides a database access control method and storage medium. Background Technology

[0002] In reverse proxy mode, the client first connects to the proxy port of the database firewall, and then the database firewall connects to the database, thereby establishing a connection between the client and the database. In this way, when the client accesses the database, the database firewall can control and trace the client's behavior.

[0003] However, some clients, such as those used by developers and operations personnel, bypass the proxy provided by the database firewall and connect directly to the database. Clearly, these clients that connect directly to the database are not within the control scope of the database firewall. The database firewall cannot manage or trace these directly connected clients, thus creating security vulnerabilities for the database. Summary of the Invention

[0004] This application provides a database access control method and storage medium to enhance the database firewall's control over clients and its ability to trace the source of information.

[0005] The specific technical solution provided in this application is as follows:

[0006] In a first aspect, embodiments of this application provide a database access control method applied to a server, the method comprising:

[0007] When a connection is detected between the first client and the database, a first connection is established between the network probe and the database, and a second connection is established between the network probe and the database firewall. The network probe is set up on the server.

[0008] When the first client sends an access packet to the database, it sends the access packet to the network probe through the first connection. The network probe processes the access packet and sends the processed access packet to the database firewall through the second connection. The processed access packet includes the first client's information.

[0009] Optionally, establishing an initial connection between the network probe and the database includes:

[0010] Based on the preset correspondence between database ports and network probe listening ports, the first network probe listening port corresponding to the first database port is determined. The first database port represents the port in the database used to connect with the first client, and the first network probe listening port represents the port in the network probe used to connect with the database.

[0011] Establish a mapping between the first database port and the first network probe listening port, and define the mapping as the first connection between the network probe and the database.

[0012] Optionally, a second connection is established between the network probe and the database firewall, including:

[0013] Based on the preset correspondence between network probe listening ports and firewall ports, the first firewall port corresponding to the second network probe listening port is determined. The second network probe listening port represents the port in the network probe used to connect with the database firewall, and the first firewall port represents the port in the database firewall used to connect with the network probe.

[0014] Establish a connection between the second network probe's listening port and the first firewall port, and define this connection as the second connection between the network probe and the database firewall.

[0015] Optionally, a network probe may be used to process access packets, including:

[0016] Use a network probe to parse the access data packets and determine the first client information of the first client corresponding to the access data packets;

[0017] A network probe is used to bind the access data packets with the first client information to obtain the processed access data packets.

[0018] Optionally, the method further includes:

[0019] When a third connection is detected between the second client and the database firewall, the request data packet of the second client is sent to the database firewall through the third connection. The client information of the second client is different from that of the first client.

[0020] Optionally, after sending the second client's request packet to the database firewall via a third connection, the process further includes:

[0021] When a fourth connection is detected between the database firewall and the database, a response packet is sent to the database firewall through the fourth connection, so that the database firewall sends the response packet to the second client.

[0022] Secondly, embodiments of this application provide a database access control method, which is applied to a database firewall and includes:

[0023] The first client information of the first client is determined based on the received processed access data packets. The processed access data packets are sent to the database firewall through the second connection after being processed by the network probe. When the first client sends access data packets to the database, the network probe receives the access data packets through the first connection. The first connection is established between the network probe and the database when a connection between the first client and the database is detected. The second connection is established between the network probe and the database firewall when a connection between the first client and the database is detected. The network probe is set in the server.

[0024] Optionally, after determining the first client information of the first client based on the received processed access data packet, the method further includes:

[0025] The received request data packet is parsed to determine the second client information corresponding to the second client.

[0026] Thirdly, a server includes:

[0027] Memory, used to store executable instructions;

[0028] A processor for reading and executing executable instructions stored in memory to implement the method as described in any of the first aspects.

[0029] Fourthly, a database firewall includes:

[0030] Memory, used to store executable instructions;

[0031] A processor for reading and executing executable instructions stored in memory to implement the method as described in any of the second aspects.

[0032] Fifthly, a computer-readable storage medium, when instructions in the storage medium are executed by a processor, enables the processor to perform the method described in either the first or second aspect.

[0033] The beneficial effects of this application are as follows:

[0034] In summary, the database access control method and storage medium provided in this application embodiment are applied to a server. The method includes: when a connection between a first client and a database is detected, establishing a first connection between a network probe and the database, and establishing a second connection between the network probe and the database firewall. The network probe is set up in the server. When the first client sends an access data packet to the database, the access data packet is sent to the network probe through the first connection. The network probe processes the access data packet and sends the processed access data packet to the database firewall through the second connection. The processed access data packet includes the first client information of the first client. The setting of the network probe enables the first client directly connected to the database to be included in the control scope of the database firewall, thereby enabling the database firewall to accurately trace the database operation behavior.

[0035] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0036] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0037] Figure 1 This is a schematic diagram illustrating the connection between the first client and the database firewall via a network probe in an embodiment of this application.

[0038] Figure 2 This is a schematic diagram of a process for access control of a database in an embodiment of this application;

[0039] Figure 3 This is a schematic diagram illustrating the process of establishing the first connection between the network probe and the database in an embodiment of this application;

[0040] Figure 4 This is a schematic diagram illustrating the process of establishing a second connection between a network probe and a database firewall in an embodiment of this application;

[0041] Figure 5 This is a schematic diagram illustrating the process of using a network probe to process access data packets in an embodiment of this application;

[0042] Figure 6 This is a flowchart illustrating the interaction between the first client and the database firewall in an embodiment of this application.

[0043] Figure 7 This is a schematic diagram illustrating the connection between the second client and the database firewall in an embodiment of this application;

[0044] Figure 8 This is a schematic diagram illustrating a scenario in which the second client connects to the database via a database firewall in an embodiment of this application.

[0045] Figure 9 This is a schematic diagram illustrating a process in which both the first client and the second client connect to the database firewall in an embodiment of this application;

[0046] Figure 10 This is a schematic diagram illustrating another process in this application embodiment where both the first client and the second client connect to the database firewall;

[0047] Figure 11 This is a schematic diagram illustrating the process by which the database firewall obtains information about the first client and the second client in an embodiment of this application.

[0048] Figure 12 This is a schematic diagram of the physical architecture of a server according to an embodiment of this application;

[0049] Figure 13 This is a schematic diagram of the entity architecture of a database firewall according to an embodiment of this application. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0051] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in sequences other than those illustrated or described herein.

[0052] The preferred embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0053] See Figure 1 As shown in the embodiments of this application, the system includes at least one first client, a database firewall, a database, and a network probe. The database and network probe are both located on a server. It should be noted that... Figure 1In the text, the first client refers to this type of client that connects directly to the database.

[0054] In this application embodiment, the implementation of a database access control method is mainly divided into two types: server-side and database firewall-side. The following describes the server-side execution of the database access control method.

[0055] See Figure 2 As shown in the embodiments of this application, the specific flow of a database access control method is as follows:

[0056] Step 201: When a connection is detected between the first client and the database, establish a first connection between the network probe and the database, and establish a second connection between the network probe and the database firewall, wherein the network probe is set in the server.

[0057] When a connection is detected between the first client and the database (i.e., a direct connection), in order to bring the first client under the control and tracing scope of the database firewall, this embodiment first sets up a network probe on the server. The network probe establishes a connection between the database firewall and the database. Thus, after the first client connects to the database, it then connects to the database firewall via the network probe. In specific implementation, the connection between the network probe and the database is referred to as the first connection, and the connection between the network probe and the database firewall is referred to as the second connection.

[0058] The above establishes the first connection between the network probe and the database. (See also...) Figure 3 As shown, it includes:

[0059] Step 2011: Based on the preset correspondence between database ports and network probe listening ports, determine the first network probe listening port corresponding to the first database port, wherein the first database port represents the port in the database used to connect with the first client, and the first network probe listening port represents the port in the network probe used to connect with the database.

[0060] Considering that there may be multiple first clients connecting to the database, and that there is only one first database port in the database used to connect to each first client, in order to achieve the connection between each first client and the database firewall, the network probe needs to be configured with a first network probe listening port. That is, after the first client connects to the database through the first database port, it then connects to the network probe through the first network probe listening port.

[0061] In order to better match the ports between the database and the network probe, in this embodiment of the application, a correspondence between the database port and the network probe listening port will be established in advance, that is, the first database port and the first network probe listening port will be matched one by one.

[0062] Once it is detected that the database and the first client are connected through the first database port, the first network probe listening port corresponding to the first database port is determined according to the preset correspondence between the database port and the network probe listening port. That is, after it is clear that the first client and the database are connected through the first database port, the first network probe listening port for the connection between the database and the network probe is then determined.

[0063] Example 1: It is detected that the database is connected to the first client 1 through the first database port a, the database is connected to the first client 2 through the first database port a, and the database is connected to the first client 3 through the first database port a. Based on the preset correspondence between database ports and network probe listening ports, it is determined that the first database port a corresponds to the first network probe listening port A.

[0064] Step 2012: Establish a mapping between the first database port and the first network probe listening port, and define the mapping as the first connection between the network probe and the database.

[0065] During implementation, after determining the first database port and the first network probe listening port, a mapping is established between the first database port and the first network probe listening port. This means realizing the port mapping between the network probe and the database, as well as the establishment of the hardware link. The mapping between the first database port and the first network probe listening port is then defined as the first connection between the network probe and the database.

[0066] Taking Example 1 above as an example, when the first client 2 connects to the database through the first database port a and determines that the first database port a corresponds to the first network probe listening port A, the first connection 2 is established between the first database port a and the first network probe listening port A. That is, after the first client 2 connects to the database, it connects to the network probe through the first connection 2.

[0067] Similarly, the above describes establishing a second connection between the network probe and the database firewall; see [link / reference]. Figure 4 As shown, it includes:

[0068] Step 2011': Based on the preset correspondence between network probe listening ports and firewall ports, determine the first firewall port corresponding to the second network probe listening port, wherein the second network probe listening port represents the port in the network probe used to connect with the database firewall, and the first firewall port represents the port in the database firewall used to connect with the network probe.

[0069] During implementation, when there are multiple first clients connected to the database, there is also only one first database port and one first network probe listening port. The number of first firewall ports in the database firewall connected to the second network probe listening port is also only one. That is, after the first client connects to the database through the first database port, it connects to the network probe through the first network probe listening port, and then connects to the database firewall through the second network probe listening port and the first firewall port.

[0070] In order to better match the ports between the network probe and the database firewall, in this embodiment of the application, a correspondence between the network probe listening port and the firewall port will be established in advance, that is, the second network probe listening port will be matched one-to-one with the first firewall port.

[0071] Once it is detected that the network probe and the database are connected through the first network probe listening port, the first firewall port corresponding to the second network probe listening port is determined according to the preset correspondence between the network probe listening port and the firewall port. That is, after it is clear that the database and the network probe are connected through the first network probe listening port, the second network probe listening port and the first firewall port that connect the network probe and the database firewall are determined.

[0072] Example 2: After detecting the establishment of the first connection, it is further determined that the first client 1 connects to the database firewall through the second network probe listening port A, the first client 2 connects to the database firewall through the second network probe listening port B, and the first client 3 connects to the database firewall through the second network probe listening port C. According to the preset correspondence between network probe listening ports and firewall ports, it is determined that the second network probe listening port A corresponds to the first firewall port 11, the second network probe listening port B corresponds to the first firewall port 11, and the second network probe listening port C corresponds to the first firewall port 11.

[0073] Step 2012': Establish a connection between the second network probe listening port and the first firewall port, and define the connection as the second connection between the network probe and the database firewall.

[0074] During implementation, after identifying the second network probe listening port and the first firewall port, a connection is established between the second network probe listening port and the first firewall port, that is, the hardware link between the network probe and the database firewall is established, and the hardware link between the second network probe listening port and the first firewall port is determined as the second connection between the network probe and the database firewall.

[0075] Taking Example 2 above as an example, when the first client 2 connects to the database firewall through the second network probe listening port B and determines that the second network probe listening port B corresponds to the first firewall port 11, a second connection 20 is established between the second network probe listening port B and the first firewall port 11. That is, after the first client 2 connects to the database and the network probe, it connects to the database firewall through the second connection 20.

[0076] The above steps achieve port redirection of data packets using a network probe. In practice, NetFilter rules can be configured to redirect specific data packets. NetFilter is a component in the Linux kernel used for tasks such as packet filtering and address translation. Iptables is a Linux tool for configuring and managing NetFilter, allowing users to create, modify, and delete NetFilter rules through a command-line interface to customize packet behavior as needed.

[0077] Step 202: When the first client sends an access data packet to the database, it sends the access data packet to the network probe through the first connection, processes the access data packet using the network probe, and sends the processed access data packet to the database firewall through the second connection. The processed access data packet includes the first client information of the first client.

[0078] During implementation, after establishing the aforementioned first and second hardware links, when the first client sends an access data packet to the database, the access data packet is further sent to the network probe through the first connection, and the network probe processes the access data packet. (See [link to relevant documentation]). Figure 5 As shown, it specifically includes:

[0079] Step 2021: Use a network probe to parse the access data packets and determine the first client information of the first client corresponding to the access data packets.

[0080] During implementation, when the network probe receives an access data packet, it will parse the access data packet to determine the first client information corresponding to the access data packet. It should be noted that the first client information may include one or more of the first client's IP address, client port, and client MAC address.

[0081] Step 2022: Use a network probe to bind the access data packet and the first client information to obtain the processed access data packet.

[0082] During implementation, after parsing the first client information, the network probe binds the access data packet and the first client information to obtain the processed access data packet, thus preparing the database firewall to obtain the first client information.

[0083] See Figure 6 As shown, in the actual interaction process, after obtaining the first client information using the network probe, the processed access data packet is sent to the database firewall. This allows the database firewall to obtain and save the first client information. When the first client sends request data (e.g., the aforementioned access data packet), the request data is transmitted to the network probe via the first connection, and then to the database firewall via the second connection. This causes the database to return response data in response to the request data. The database then sends the response data to the database firewall, which in turn sends it to the network probe via the second connection, and then back to the first client via the first connection. In this way, the database firewall can control the interaction between the first client and the database, and trace the request and response data accordingly.

[0084] It should be noted that, in addition to the first client directly connected to the database, this application embodiment also includes a second client, see [reference]. Figure 7 As shown, this type of client first connects to the database firewall, and then connects to the database. Clearly, in... Figure 7 Under the connection shown, the database firewall can control and trace the behavior of the second client accessing the database without the need for a network probe. In practical applications, when the second client is directly connected to the database via a switch, the database firewall redirects the second client's data to the database, thereby enabling the database firewall to control and trace the second client. (See [link to relevant documentation]). Figure 8 As shown.

[0085] It should also be noted that, in order to effectively distinguish between the first client and the second client, different labels can be set for the first client and the second client in advance during the implementation process. For example, the IP address of the client that is directly connected to the database can be labeled as a Class I IP address, and the IP address of the client that is directly connected to the database firewall can be labeled as a Class II IP address. In this way, the first client and the second client can be distinguished based on the IP address alone during subsequent processing.

[0086] Furthermore, when the connection relationship between the second client, the database firewall, and the database is as follows: Figure 7 When shown, refer to Figure 9 As shown, the method also includes:

[0087] Step 203: When a third connection is detected between the second client and the database firewall, the request data packet of the second client is sent to the database firewall through the third connection. The client information of the second client is different from that of the first client.

[0088] During implementation, when a third connection is detected between the second client and the database firewall (i.e., a direct connection exists between them), in this embodiment, when the second client sends a request data packet to the database, the request data packet is forwarded to the database firewall via the third connection. It should be noted that this third connection is a hardware link established based on a one-to-one correspondence between the ports of the second client and the database firewall.

[0089] In addition, it should be noted that the client information for the second client is different from that of the first client; that is, the IP address, port, and MAC address of the second client are all different from those of the first client.

[0090] After the request data packet from the second client is sent to the database firewall via the third connection, see [link to relevant documentation]. Figure 10 As shown, it also includes:

[0091] Step 204: When a fourth connection is detected between the database firewall and the database, a response packet is sent to the database firewall through the fourth connection so that the database firewall sends the response packet to the second client.

[0092] During implementation, after sending the request data packet from the second client to the database firewall through the third connection, the fourth connection between the database firewall and the database is further determined. This fourth connection is the hardware link established based on the one-to-one correspondence between the ports of the database firewall and the database, which will not be elaborated here.

[0093] When a fourth connection is detected between the database firewall and the database, the request packet is sent to the database via this fourth connection. This prompts the database to send a response packet back to the database firewall via the fourth connection, which in turn sends the response packet to the second client via a third connection. Through this process, the database firewall can control and trace the second client's access to the database.

[0094] The following section describes the execution of database access control methods on the database firewall side. (See also...) Figure 11 As shown in this embodiment, the specific process by which the database firewall manages and controls the client is as follows:

[0095] Step 301: Determine the first client information of the first client based on the received processed access data packet. The processed access data packet is sent to the database firewall through the second connection after the network probe processes the access data packet. When the first client sends an access data packet to the database, the network probe receives the access data packet through the first connection. The first connection is the connection between the network probe and the database established when a connection between the first client and the database is detected. The second connection is the connection between the network probe and the database firewall established when a connection between the first client and the database is detected. The network probe is set in the server.

[0096] During implementation, after receiving the processed access data packets, the database firewall further parses them to determine the first client's information. Thus, when the first client sends access data packets to the database, the database firewall can obtain these processed access data packets via network probes, enabling effective control and tracing of the first client.

[0097] It should be noted that the first client establishes a first connection with the database, and the network probe establishes a second connection with the database firewall. The specific transmission of access data packets will not be described in detail here.

[0098] After determining the first client information based on the received processed access data packet, refer to... Figure 11 As shown, it also includes:

[0099] Step 302: Parse the received request data packet to determine the second client information of the second client corresponding to the request data packet.

[0100] To enable the database firewall to control and trace all clients, in this embodiment, after the second client sends a request data packet, the database firewall can also parse the received request data packet to determine the second client information corresponding to the request data packet. Thus, when the second client sends a request data packet to the database firewall, the database firewall can obtain the aforementioned client information, thereby effectively controlling and tracing the second client.

[0101] Based on the same inventive concept, see [reference] Figure 12 As shown, this application embodiment provides a server, including: a memory 1201 for storing executable instructions; and a processor 1202 for reading and executing the executable instructions stored in the memory, and executing any of the methods described in the first aspect above.

[0102] Based on the same inventive concept, see [reference] Figure 13 As shown, this application embodiment provides a database firewall, including: a memory 1301 for storing executable instructions; and a processor 1302 for reading and executing the executable instructions stored in the memory, and executing any of the methods described in the second aspect above.

[0103] Based on the same inventive concept, embodiments of this application provide a computer-readable storage medium that, when the instructions in the storage medium are executed by a processor, enables the processor to perform the method described in either the first or second aspect above.

[0104] In summary, this application provides a database access control method and storage medium. The method is applied to a server and includes: when a connection between a first client and a database is detected, establishing a first connection between a network probe and the database, and establishing a second connection between the network probe and a database firewall. The network probe is located on the server. When the first client sends an access data packet to the database, the access data packet is sent to the network probe through the first connection. The network probe processes the access data packet and sends the processed access data packet to the database firewall through the second connection. The processed access data packet includes the first client's information. The network probe enables the first client directly connected to the database to be included in the database firewall's control scope, thereby allowing the database firewall to accurately trace the source of database operations.

[0105] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program product systems. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product system implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0106] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program product systems according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0107] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0108] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0109] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A database access control method, characterized in that, Applied to a server, the method includes: When a connection is detected between the first client and the database, a first connection is established between the network probe and the database, and a second connection is established between the network probe and the database firewall, wherein the network probe is set in the server; When the first client sends an access data packet to the database, the access data packet is sent to the network probe through the first connection. The network probe processes the access data packet and sends the processed access data packet to the database firewall through the second connection. The processed access data packet includes the first client information of the first client.

2. The method as described in claim 1, characterized in that, Establishing the first connection between the network probe and the database includes: Based on the preset correspondence between database ports and network probe listening ports, the first network probe listening port corresponding to the first database port is determined, wherein the first database port represents the port in the database used to connect with the first client, and the first network probe listening port represents the port in the network probe used to connect with the database. Establish a mapping between the first database port and the first network probe listening port, and determine the mapping as the first connection between the network probe and the database.

3. The method as described in claim 1, characterized in that, Establishing the second connection between the network probe and the database firewall includes: Based on the preset correspondence between network probe listening ports and firewall ports, the first firewall port corresponding to the second network probe listening port is determined, wherein the second network probe listening port represents the port in the network probe used to connect with the database firewall, and the first firewall port represents the port in the database firewall used to connect with the network probe. Establish a connection between the second network probe's listening port and the first firewall port, and define the connection as the second connection between the network probe and the database firewall.

4. The method as described in claim 1, characterized in that, The process of using the network probe to process the access data packets includes: The network probe is used to parse the access data packet to determine the first client information of the first client corresponding to the access data packet; The network probe is used to bind the access data packet and the first client information to obtain the processed access data packet.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: When a third connection is detected between the second client and the database firewall, the request data packet of the second client is sent to the database firewall through the third connection, wherein the client information of the second client is different from that of the first client.

6. The method as described in claim 5, characterized in that, After sending the request data packet from the second client to the database firewall via the third connection, the method further includes: When a fourth connection is detected between the database firewall and the database, a response packet is sent to the database firewall through the fourth connection, so that the database firewall sends the response packet to the second client.

7. A database access control method, characterized in that, The method is applied to a database firewall, including: The first client information of the first client is determined based on the received processed access data packet. The processed access data packet is sent to the database firewall through a second connection after being processed by the network probe. When the first client sends an access data packet to the database, the network probe receives the access data packet through a first connection. The first connection is established between the network probe and the database when a connection between the first client and the database is detected. The second connection is established between the network probe and the database firewall when a connection between the first client and the database is detected. The network probe is set in the server.

8. The method as described in claim 7, characterized in that, After determining the first client information of the first client based on the received processed access data packet, the method further includes: The received request data packet is parsed to determine the second client information of the second client corresponding to the request data packet.

9. A server, characterized in that, include: Memory, used to store executable instructions; A processor for reading and executing executable instructions stored in the memory to implement the method as described in any one of claims 1 to 6.

10. A database firewall, characterized in that, include: Memory, used to store executable instructions; A processor for reading and executing executable instructions stored in the memory to implement the method as described in claim 7 or 8.

11. A computer-readable storage medium, characterized in that, When the instructions in the storage medium are executed by the processor, the processor is able to perform the method as described in any one of claims 1 to 8.

Images