Database password regular changing system and method based on java service

Abstract

The invention discloses a database password regular changing system and method based on java service, and relates to the technical field of computer information security. The method comprises the following steps: a password service has a timed task to periodically and automatically generate and change a password of a database user, and stores a database user name and the latest password into a database; the database connection pool of the business service obtains a user name and a latest password of the database when establishing database connection; the business service reads and writes the database by using the database connection created by the database connection pool; in order to change the password of the database at regular intervals, the database connection pool needs to be expanded, the database user alias configuration is read and the http interface is called to obtain the real database user name and password by utilizing the expansion mechanism of the database connection pool when the database connection pool establishes connection; and the database password is regularly changed under the conditions that the database user name and password configuration of the business service are not changed and the business service is not restarted.

Description

Technical Field

[0001] The invention belongs to the technical field of computer information security, and in particular relates to a database password periodic changing system and method based on java service. Background Art

[0002] In software services that use databases, the database username and password need to be saved in the configuration file or configuration service. In order to ensure system security, the database username and password are generally encrypted and saved. After the username and password are encrypted, they may be cracked, posing a security risk.

[0003] For example, Chinese patent CN103279715A relates to a method and device for encrypting and decrypting database data. Among them, the method for encrypting and decrypting database data includes: obtaining a cryptographic algorithm and a key; using the cryptographic algorithm and the key to encrypt / decrypt an encryption / decryption object, and the encryption / decryption object is a database table, a column in a database table, a view, or a column in a view. The device for encrypting and decrypting database data includes: an acquisition module for obtaining a cryptographic algorithm and a key; an encryption / decryption module for encrypting / decrypting an encryption / decryption object using the cryptographic algorithm and the key obtained by the acquisition module, and the encryption / decryption object is a database table, a column in a database table, a view, or a column in a view. The method and device for encrypting and decrypting database data realizes the expansion of the database encryption and decryption method, and meets the efficient data encryption and decryption requirements of mobile computing environments and network applications. For example, Chinese patent CN114826702A also relates to a database access password encryption method, device, and computer equipment. First, if a user password request of the current user is received and the identity of the current user is legal, an access password of the current user is generated, a target cipher machine is assigned to the current user, the access password is encrypted by the target cipher machine, an encrypted access password is obtained, and then the encrypted access password is sent to the current user. The encrypted access password is used to instruct the current user to access the database according to the encrypted access password. This method improves the security of database access and ensures the reliability of database access.

[0004] It can be seen from this that in order to prevent the leakage of user names and passwords, each time the database password is changed, the new password must be re-encrypted, the configuration data in the configuration file or configuration service must be changed, and the service must be restarted. Some systems must also require regular changes to the database password.

[0005] For example, Chinese patent CN114785498A discloses a database password protection method, device and equipment, including: obtaining an access password query request for a target database sent by an application service; querying the access password of the target database based on the access password query request; encrypting the access password to obtain an encrypted password; returning the encrypted password to the application service so that the application service calls the encryption and decryption file pre-generated by the password service to decrypt the encrypted password to obtain the access password. In this way, it is avoided to write the password plain text or the encrypted password ciphertext into the application or its accessible configuration file or environment variable, encrypt it through the password service, and decrypt it through the encryption and decryption file generated by the password service, which can improve the security of the database password and prevent data leakage. Although the above patent improves the security of the password, it requires frequent encryption and decryption according to the access.

[0006] Therefore, the above method is inconvenient to use. Therefore, the present application provides a database password periodic change system and method based on Java service. Summary of the invention

[0007] The purpose of the present invention is to provide a database password periodic change system and method based on Java service, which solves the existing problems by periodically changing the database password without changing the database user name and password configuration of the business service or restarting the business service, and without leaking the database user name and password.

[0008] In order to solve the above technical problems, the present invention is achieved through the following technical solutions:

[0009] As a first aspect of the present invention, the present invention is a database password periodic change system based on Java service, comprising:

[0010] A password service unit, which is used to automatically generate and change the password of a database user regularly through a timer, and save the database user name and the latest password to the database;

[0011] The business service unit, when creating a database link through the database connection pool, calls the http interface provided by the password service unit to obtain the database user name and the latest password;

[0012] The business service unit operates the database by configuring a database user alias, and the database user alias corresponds to the database user name and the database user's password. The password service will periodically change the database password and provide an http interface for the business service to obtain the database user name and password.

[0013] Furthermore, the business service unit utilizes the extension mechanism of the database connection pool, and when the database connection pool creates a database link, reads the database user alias configuration, and calls the http interface to obtain the database user name and the password of the database user. In this way, the business service does not need to configure the database user name and password, and only needs to configure a database user alias to operate the database. The database user alias is not the real database user name, but is only used to call the http interface according to the database user alias to obtain the real database user name and password. There is no risk of leaking the database user name and password.

[0014] As a second aspect of the present invention, the present invention is a method for periodically changing a database password based on a Java service, wherein the method is implemented based on the system for periodically changing a database password described in the first aspect, and the method for periodically changing a database password comprises the following steps:

[0015] Step 1: The password service has a scheduled task that automatically generates and changes the password of the database user on a regular basis, and saves the database user name and the latest password to the database. That is, the password service unit automatically generates and changes the password of the database user on a regular basis through a scheduled task, and saves the database user name and the latest password to the database;

[0016] Step 2: The business service unit configures a database user alias and operates the database through the database user alias;

[0017] Step 3: When creating a database connection, the database connection pool of the business service will call the http interface provided by the password service to obtain the database user name and the latest password. That is, when creating a database link, the database connection pool will obtain the database user name and the latest password by calling the http interface provided by the password service unit.

[0018] Step 4: The business service unit writes the database user name and the latest password into the database through the database link created by the database connection pool;

[0019] Step 5: The business service unit calls the http interface according to the database user alias to obtain the real database user name and password, and changes the database password regularly without changing the database user name and password configuration of the business service or restarting the business service, and the database user name and password will not be leaked.

[0020] Business services use the database connection created by the "database connection pool" to read and write to the database. This allows business services to operate the database without configuring a database username and password, but only a database user alias. The database user alias is not the real database username, but is used to call the http interface based on the database user alias to obtain the real database username and password, without the risk of leaking the database username and password.

[0021] Furthermore, the method for the password service unit to change the password of a database user comprises the following steps:

[0022] Step S1: Generate a random string as a new password for a specified database user according to a timing rule by using a timer;

[0023] Step S2: Use the root user to connect to the database, where the root user is a user with the authority to change the database user password;

[0024] Step S3: The root user changes the password of the specified database user to the new password generated in step S1;

[0025] Step S4: Save the database user name, new password and database user alias to the database table auto_pass.

[0026] Furthermore, when the business service unit calls the http interface to obtain the database user name and password according to the database user alias, the password service unit queries the database table auto_pass according to the database user alias to obtain the real database user name and password. Add a password service, the password service will regularly change the database password, and provide an http interface for the business service to obtain the database user name and password;

[0027] Furthermore, in order to change the database password regularly, the database connection pool needs to be extended. By using the extension mechanism of the database connection pool, when the database connection pool creates a connection, the database user alias configuration is read, and the http interface is called to obtain the real database user name and password. The method for the business service unit to operate the database by configuring the database user alias includes the following steps:

[0028] Step S11: the business service unit obtains a database link from the database connection pool; if there is an available database link in the connection pool, a database link is obtained and the process proceeds to step S15;

[0029] Step S12: If there is no available database link in the database connection pool, the database connection pool reads the database user alias from the configuration file or the configuration service;

[0030] Step S13: the database connection pool calls the http interface of the password service unit to obtain the database user name and password according to the database user alias;

[0031] Step S14: the database connection pool creates a database link according to the database user name and password;

[0032] Step S15: The business service unit reads and writes the database through the database link.

[0033] The present invention has the following beneficial effects:

[0034] The present invention periodically changes the database password without changing the database user name and password configuration of the business service or restarting the business service, and the database user name and password will not be leaked. A password service is added, the password service will periodically change the database password, and provide an http interface for the business service to obtain the database user name and password.

[0035] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for describing the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0037] Figure 1 Regularly change the passwords of the database users of the present invention and read the logic diagram;

[0038] Figure 2 A flowchart of regularly changing passwords for the password service unit of the present invention;

[0039] Figure 3 This is a flowchart of the business service unit operating the database of the present invention. DETAILED DESCRIPTION

[0040] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0041] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0042] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0043] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0044] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0045] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0046] Embodiment 1:

[0047] As a first embodiment of the present invention, the present invention is a database password periodic change system based on Java service, comprising:

[0048] A password service unit, which is used to automatically generate and change the password of a database user regularly through a timer, and save the database user name and the latest password to the database;

[0049] The business service unit, when creating a database link through the database connection pool, calls the http interface provided by the password service unit to obtain the database user name and the latest password; adds a password service, the password service will regularly change the database password, and provide an http interface for the business service to obtain the database user name and password;

[0050] Among them, the business service unit operates the database by configuring the database user alias, and the database user alias corresponds to the database user name and the password of the database user. The password service will regularly change the database password and provide an http interface for the business service to obtain the database user name and password; the database password will be regularly changed without changing the database user name and password configuration of the business service or restarting the business service, and the database user name and password will not be leaked.

[0051] As an embodiment of the present invention, preferably, the business service unit utilizes the extension mechanism of the database connection pool, and when the database connection pool creates a database link, reads the database user alias configuration, and calls the http interface to obtain the database user name and the password of the database user. In this way, the business service does not need to configure the database user name and password, and only needs to configure a database user alias to operate the database. The database user alias is not the real database user name, but is only used to call the http interface according to the database user alias to obtain the real database user name and password. The database password is changed regularly without changing the database user name and password configuration of the business service or restarting the business service, and the database user name and password will not be leaked. There is no risk of leaking the database user name and password.

[0052] Embodiment 2:

[0053] See also Figure 1 As shown, as the second embodiment of the present invention, the present invention is a method for periodically changing a database password based on a Java service, wherein the method is implemented based on the system for periodically changing a database password described in the first embodiment, and the method for periodically changing a database password comprises the following steps:

[0054] Step 1: The password service has a scheduled task that automatically generates and changes the password of the database user regularly, and saves the database user name and the latest password to the database; specifically, the password service unit automatically generates and changes the password of the database user regularly through the scheduled task, and saves the database user name and the latest password to the database, and changes the database password regularly without changing the database user name and password configuration of the business service or restarting the business service, and the database user name and password will not be leaked;

[0055] Step 2: The business service unit configures a database user alias and operates the database through the database user alias;

[0056] Step 3: When creating a database connection, the database connection pool of the business service will call the http interface provided by the password service to obtain the database user name and the latest password; specifically, when creating a database link, the database connection pool obtains the database user name and the latest password by calling the http interface provided by the password service unit; add a password service, the password service will regularly change the database password, and provide an http interface for the business service to obtain the database user name and password;

[0057] Step 4: The business service uses the database connection created by the "database connection pool" to read and write to the database. The business service unit writes the database user name and the latest password to the database through the database link created by the database connection pool. This allows the business service to operate the database without configuring the database user name and password. The database user alias is not the real database user name, but is used to call the http interface based on the database user alias to obtain the real database user name and password. There is no risk of leaking the database user name and password.

[0058] Step 5: In order to change the database password regularly, the database connection pool needs to be expanded. By using the extension mechanism of the database connection pool, when the database connection pool creates a connection, the database user alias configuration is read and the http interface is called to obtain the real database user name and password. Specifically, the business service unit calls the http interface according to the database user alias to obtain the real database user name and password.

[0059] Embodiment three:

[0060] like Figure 2 As shown, as the third embodiment of the present invention, the present invention is a method for periodically changing a database password based on a Java service, wherein the method is implemented based on the system for periodically changing a database password described in the first embodiment, and the method for periodically changing a database password comprises the following steps:

[0061] Step 1: The password service has a scheduled task to automatically generate and change the password of the database user regularly, and save the database user name and the latest password to the database; specifically, the password service unit automatically generates and changes the password of the database user regularly through the scheduled task, and saves the database user name and the latest password to the database, and changes the database password regularly without changing the database user name and password configuration of the business service or restarting the business service, and the database user name and password will not be leaked; the method for changing the password of the database user by the password service unit includes the following steps:

[0062] Step S1: Generate a random string as a new password for a specified database user according to a timing rule by using a timer;

[0063] Step S2: Use the root user to connect to the database, where the root user is a user with the authority to change the database user password;

[0064] Step S3: The root user changes the password of the specified database user to the new password generated in step S1;

[0065] Step S4: Save the database user name, new password and database user alias to the database table auto_pass.

[0066] As an embodiment of the present invention, preferably, when the business service unit calls the http interface to obtain the database user name and password according to the database user alias, the password service unit queries the database table auto_pass according to the database user alias to obtain the real database user name and password;

[0067] Step 2: The business service unit configures a database user alias and operates the database through the database user alias;

[0068] Step 3: When creating a database connection, the database connection pool of the business service will call the http interface provided by the password service to obtain the database user name and the latest password; specifically, when creating a database link, the database connection pool obtains the database user name and the latest password by calling the http interface provided by the password service unit; add a password service, the password service will regularly change the database password, and provide an http interface for the business service to obtain the database user name and password;

[0069] Step 4: The business service uses the database connection created by the "database connection pool" to read and write to the database. The business service unit writes the database user name and the latest password to the database through the database link created by the database connection pool. This allows the business service to operate the database without configuring the database user name and password. The database user alias is not the real database user name, but is used to call the http interface based on the database user alias to obtain the real database user name and password. There is no risk of leaking the database user name and password.

[0070] Step 5: In order to change the database password regularly, the database connection pool needs to be expanded. By using the extension mechanism of the database connection pool, when the database connection pool creates a connection, the database user alias configuration is read and the http interface is called to obtain the real database user name and password. Specifically, the business service unit calls the http interface according to the database user alias to obtain the real database user name and password.

[0071] Embodiment 4:

[0072] like Figure 3 As shown, in order to change the database password regularly, the database connection pool needs to be extended. By using the extension mechanism of the database connection pool, when the database connection pool creates a connection, the database user alias configuration is read, and the http interface is called to obtain the real database user name and password. As a fourth embodiment of the present invention, the present invention is a method for regularly changing the database password based on a java service. The method is implemented based on the database password regularly changing system described in the first embodiment. The method for regularly changing the database password includes the following steps:

[0073] Step 1: The password service unit automatically generates and changes the database user's password regularly through a scheduled task, and saves the database user name and the latest password to the database. The database password is changed regularly without changing the database user name and password configuration of the business service or restarting the business service, and the database user name and password will not be leaked;

[0074] Step 2: The business service unit configures a database user alias and operates the database through the database user alias. The method for the business service unit to operate the database by configuring the database user alias includes the following steps:

[0075] Step S11: the business service unit obtains a database link from the database connection pool; if there is an available database link in the connection pool, a database link is obtained and the process proceeds to step S15;

[0076] Step S12: If there is no available database link in the database connection pool, the database connection pool reads the database user alias from the configuration file or the configuration service;

[0077] Step S13: the database connection pool calls the http interface of the password service unit to obtain the database user name and password according to the database user alias;

[0078] Step S14: the database connection pool creates a database link according to the database user name and password;

[0079] Step S15: The business service unit reads and writes the database through the database link;

[0080] Step 3: Specifically, when creating a database link, the database connection pool obtains the database user name and the latest password by calling the http interface provided by the password service unit; add a password service, the password service will regularly change the database password, and provide an http interface to the business service to obtain the database user name and password;

[0081] Step 4: The business service uses the database connection created by the "database connection pool" to read and write to the database. The business service unit writes the database user name and the latest password to the database through the database link created by the database connection pool. This allows the business service to operate the database without configuring the database user name and password. The database user alias is not the real database user name, but is used to call the http interface based on the database user alias to obtain the real database user name and password. There is no risk of leaking the database user name and password.

[0082] Step 5: In order to change the database password regularly, the database connection pool needs to be expanded. By using the extension mechanism of the database connection pool, when the database connection pool creates a connection, the database user alias configuration is read and the http interface is called to obtain the real database user name and password. Specifically, the business service unit calls the http interface according to the database user alias to obtain the real database user name and password.

[0083] The present invention provides a specific design and implementation method for periodically changing a database password, which periodically changes the database password without changing the database user name and password configuration of the business service or restarting the business service, and does not leak the database user name and password. A password service is added, which periodically changes the database password and provides an http interface for the business service to obtain the database user name and password.

[0084] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0085] The preferred embodiments of the present invention disclosed above are only used to help illustrate the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A database password periodic change system based on Java services, characterized in that: include: A password service unit, which is used to automatically generate and change the password of a database user regularly through a timer, and save the database user name and the latest password to the database; The business service unit, when creating a database link through the database connection pool, calls the http interface provided by the password service unit to obtain the database user name and the latest password; The business service unit operates the database by configuring a database user alias, and the database user alias corresponds to the database user name and the database user's password.

2. The database password periodic change system based on Java service according to claim 1 is characterized in that: The business service unit utilizes the extension mechanism of the database connection pool, reads the database user alias configuration when the database connection pool creates a database link, and calls the http interface to obtain the database user name and the database user's password.

3. A method for periodically changing database passwords based on Java services, characterized in that: The method is implemented based on the database password periodic change system according to any one of claims 1 to 2, and the database password periodic change method comprises the following steps: Step 1: The password service unit automatically generates and changes the database user's password regularly through a scheduled task, and saves the database user name and the latest password to the database; Step 2: The business service unit configures a database user alias and operates the database through the database user alias; Step 3: When creating a database link, the database connection pool obtains the database user name and the latest password by calling the http interface provided by the password service unit; Step 4: The business service unit writes the database user name and the latest password into the database through the database link created by the database connection pool; Step 5: The business service unit calls the http interface based on the database user alias to obtain the real database user name and password.

4. The method for periodically changing database passwords based on Java services according to claim 3 is characterized in that: The method for changing the password of a database user by the password service unit comprises the following steps: Step S1: Generate a random string as a new password for a specified database user according to a timing rule by using a timer; Step S2: Use the root user to connect to the database, where the root user is a user with the authority to change the database user password; Step S3: The root user changes the password of the specified database user to the new password generated in step S1; Step S4: Save the database user name, new password and database user alias to the database table auto_pass.

5. The method for periodically changing database passwords based on Java services according to claim 4 is characterized in that: When the business service unit calls the http interface to obtain the database user name and password according to the database user alias, the password service unit queries the database table auto_pass according to the database user alias to obtain the database user name and password.

6. The method for periodically changing database passwords based on Java services according to claim 3 is characterized in that: The method for the business service unit to operate a database by configuring a database user alias comprises the following steps: Step S11: the business service unit obtains a database link from the database connection pool; if there is an available database link in the connection pool, a database link is obtained and the process proceeds to step S15; Step S12: If there is no available database link in the database connection pool, the database connection pool reads the database user alias from the configuration file or the configuration service; Step S13: the database connection pool calls the http interface of the password service unit to obtain the database user name and password according to the database user alias; Step S14: the database connection pool creates a database link according to the database user name and password; Step S15: The business service unit reads and writes the database through the database link.

Images