Database security management method and device based on limit of number of attempts

Abstract

The invention discloses a database security management method and device based on attempt frequency limitation, and relates to the technical field of database security, and the method comprises the following steps: introducing a login failure maximum attempt frequency limitation and locking mechanism into a database system; a user initiates a connection and a request to the database server through the client; the system checks whether the user who initiates the request sets and starts the maximum number of attempts for login failure, if yes, whether the user is in a locked state currently continues to be detected, if yes, the user is refused to carry out login attempts, and if not, a normal identity authentication process is entered; when authentication fails, the number of continuous login failures of the user is correspondingly increased, whether the maximum number of attempts for login failures is reached or not is checked, and if yes, the account of the user is locked for a set time length; and after the locking time is over, executing the identity authentication process again. According to the method, malicious client connection attacks can be effectively defended, and the safety and stability of a database system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of database security, in particular to a database security management method and device based on attempt number limitation. Background Art

[0002] In the prior art, database systems often face various security threats, especially the problem of malicious client connection consumption of database resources. This security threat usually manifests itself in attackers initiating a large number of client connection requests to occupy database resources, resulting in a decrease in the performance of the database system or even a system crash. This attack method not only consumes the processing power and storage resources of the database, but also may cause legitimate users to be unable to access database services, seriously affecting the stability and availability of the database system.

[0003] Therefore, how to effectively defend against malicious client connection attacks, protect the resources of the database system, and improve the security and stability of the database system has become an urgent problem to be solved in the current technical field. Summary of the invention

[0004] In view of the needs and shortcomings of current technology development, the present invention provides a database security management method and device based on attempt number limitation to enhance the client connection protection capability of the database.

[0005] In the first aspect, the present invention provides a database security management method based on the number of attempts limit, and the technical solution adopted to solve the above technical problem is as follows:

[0006] A database security management method based on attempt number limit comprises the following steps:

[0007] S1. Introduce a maximum number of failed login attempts and a locking mechanism in the database system;

[0008] S2. The user initiates a connection and request to the database server through the client;

[0009] S3. The database system checks whether the user who initiated the request has set and enabled the maximum number of failed login attempts.

[0010] S4. After the user who initiated the request has enabled the maximum number of failed login attempts, the database system continues to detect whether the user is currently locked out. If so, the user's login attempt is rejected and prompted that the account has been locked out. If not, the normal identity authentication process is entered.

[0011] S5. After the identity authentication is successful, the user can access the database server. After the identity authentication fails, the database system will increase the number of consecutive login failures of the user and check whether the maximum number of failed login attempts has been reached.

[0012] S6. When the number of failed identity authentication attempts of the user reaches the set maximum number of failed login attempts, the database system locks the login account corresponding to the user for a set period of time and notifies the user at the same time;

[0013] S7. After the lock time is over, the login authentication process of steps S2-S6 is executed again.

[0014] Optionally, create or modify the maximum number of failed attempts and lockout duration for a specified user by a member of the admin role or a user with the CREATE USER privilege.

[0015] Optionally, a locked user account is unlocked by a member of the admin role or a user with CREATE USER permission, and the number of consecutive login failures of the user account is reset to 0. Subsequently, the unlocked user account executes the login authentication process of steps S2-S6 again.

[0016] Optionally, step S5 is performed. After the identity authentication is successful, the database system first resets the number of consecutive login failures of the user and clears all lock time records, and then allows the user to re-initiate a connection and request to the database server through the client.

[0017] In a second aspect, the present invention provides a database security management device based on the number of attempts limit, and the technical solution adopted to solve the above technical problem is as follows:

[0018] A database security management device based on attempt number limitation, comprising:

[0019] The mechanism introduction module is used to introduce the maximum number of login failure attempts and the locking mechanism into the database system;

[0020] The login check module is used to check whether the user who initiates the request has set and enabled the maximum number of failed login attempts when the user initiates a connection and request to the database server through the client;

[0021] The account detection module is used to detect whether the user who initiated the request is currently locked out after the maximum number of failed login attempts is enabled. If so, the login rejection module is called; if not, the identity authentication module is called;

[0022] The login rejection module is used to reject the user's login attempt when the user is in a locked state and prompt that the user's account has been locked;

[0023] The identity authentication module is used to authenticate the user who initiates the connection and request, access the database server after the identity authentication is successful, and call the count check module after the identity authentication fails;

[0024] A counting check module is used to increase the number of consecutive login failures after the user fails the identity authentication, and check whether the maximum number of failed login attempts has been reached. If so, the lock notification module is called, and if not, the identity authentication module is called;

[0025] The lock notification module is used to lock the login account corresponding to the user for a set period of time and notify the user when the number of failed identity authentication attempts reaches the set maximum number of failed login attempts.

[0026] Optionally, the database security management device based on the number of attempts limit further includes a permission modification module;

[0027] Members of the admin role or users with the CREATE USER permission can use the permission modification module to create or modify the maximum number of failed attempts and lockout duration for a specified user.

[0028] Optionally, the database security management device based on the number of attempts limit further includes an unlocking and resetting module;

[0029] A member of the admin role or a user with the CREATE USER permission can unlock a locked user account through the unlock and reset module, and reset the number of consecutive login failures for the user account to 0.

[0030] Further optionally, the identity authentication module involved authenticates the user who initiates the connection and request. After the identity authentication is successful, the identity authentication module calls the unlock reset module to reset the user's consecutive login failures and clear all lock time records, and then calls the login check module to allow the user to re-initiate connection and request to the database server through the client.

[0031] Compared with the prior art, the database security management method and device based on the attempt number limit of the present invention have the following beneficial effects:

[0032] 1. The present invention prevents attackers from occupying database resources by initiating a large number of client connection requests, thereby causing the performance of the database system to degrade or even crash the database system by limiting the number of login attempts of users and introducing a locking mechanism;

[0033] 2. The present invention provides a configurable maximum number of failed attempts, which can be adjusted according to different application scenarios and security requirements, and has high flexibility and adaptability;

[0034] 3. After the lockout time is reached, the user can directly unlock the login by entering the correct password without additional unlocking steps, thus maintaining the simplicity and ease of use of the database system; after the user authentication is successful, the database system will automatically reset the number of consecutive login failures and clear the lockout time, so that the user will not be affected by previous erroneous attempts after logging in correctly, thereby improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Attached Figure 1 is a flow chart of a method according to Embodiment 1 of the present invention;

[0036] Attached Figure 2 This is a module connection block diagram of the second embodiment of the present invention. DETAILED DESCRIPTION

[0037] In order to make the technical solution, the technical problem solved and the technical effect of the present invention more clearly understood, the technical solution of the present invention is clearly and completely described below in conjunction with specific embodiments.

[0038] Embodiment 1:

[0039] Combined with Figure 1 This embodiment proposes a database security management method based on the number of attempts limit, which includes the following steps:

[0040] S1. Introduce a maximum number of failed login attempts and a locking mechanism in the database system.

[0041] Members of the admin role or users with the CREATE USER privilege can create or modify the maximum number of failed attempts and lockout duration for a specified user.

[0042] Limiting the number of failed login attempts and the locking mechanism are important measures to ensure database security and stability. For limiting the number of failed login attempts, the usual practice is to set a maximum number of account login attempts, and temporarily lock the account or trigger a security alert after the limit is reached. The locking mechanism includes automatic locking, manual unlocking, locking duration, and protection against repeated attacks. The following is a description of the locking mechanism:

[0043] (a) Automatic lock: When a user enters an incorrect password multiple times in a row, the system will automatically lock the account. This mechanism can effectively prevent brute force password cracking attempts.

[0044] (b) Manual unlocking: A locked account needs to be unlocked by the user by re-authenticating the user's identity, or it will be unlocked automatically after a period of time.

[0045] (c) Lockout duration: Depending on the security policy, the length of time an account is locked may vary. Some systems allow administrators to set a specific lockout duration.

[0046] (d) Protection against repeated attacks: In the event that an account is locked, the system will monitor and record further login attempts, which can be used for security analysis and alerts.

[0047] (e) Notification mechanism: When a user’s account is locked, the user will receive a notification, which may be in the form of email, SMS or in-app prompt, informing the user of the current status of the account and relevant operational instructions.

[0048] (f) Security Review: During the account lock period, the system may perform additional security checks, such as secondary verification or security question verification, to ensure the security of the account.

[0049] (g) Data protection: The system will ensure that during the account lock period, the data related to the account is protected and cannot be obtained by unauthorized access.

[0050] S2. The user initiates a connection and request to the database server through the client.

[0051] S3. The database management system checks whether the user who initiated the request has set and enabled the maximum number of failed login attempts. If so, execute step S4. If not, enter the normal identity authentication process and then execute step S5.

[0052] S4. The database management system continues to detect whether the user is currently in a locked state. If so, the user's login attempt is rejected and a prompt is given that the account has been locked. If not, the normal identity authentication process is entered.

[0053] S5. After the identity authentication is successful, the database system first resets the number of consecutive login failures of the user and clears all lock time records, and then allows the user to re-initiate a connection and request to the database server through the client.

[0054] After identity authentication fails, the database system increases the number of consecutive login failures of the user accordingly, and checks whether the maximum number of failed login attempts has been reached. If so, step S6 is executed; if not, step S2 is returned to execute.

[0055] S6. When the number of failed identity authentication attempts of the user reaches the set maximum number of failed login attempts, the database system locks the login account corresponding to the user for a set period of time and notifies the user at the same time;

[0056] S7. After the lock time is over, the login authentication process of steps S2-S6 is executed again.

[0057] It should be added that a member of the admin role or a user with CREATE USER permission can unlock a locked user account and reset the number of consecutive login failures of the user account to 0. Subsequently, the unlocked user account executes the login authentication process of steps S2-S6 again.

[0058] Embodiment 2:

[0059] Combined with Figure 2 This embodiment proposes a database security management device based on the number of attempts limit, which includes:

[0060] The mechanism introduction module is used to introduce the maximum number of login failure attempts and the locking mechanism into the database system;

[0061] The login check module is used to check whether the user who initiates the request has set and enabled the maximum number of failed login attempts when the user initiates a connection and request to the database server through the client;

[0062] The account detection module is used to detect whether the user who initiated the request is currently locked out after the maximum number of failed login attempts is enabled. If so, the login rejection module is called; if not, the identity authentication module is called;

[0063] The login rejection module is used to reject the user's login attempt when the user is in a locked state and prompt that the user's account has been locked;

[0064] The authentication module is used to authenticate the user who initiates the connection and request, and access the database server after the authentication is successful. The count check module is called after the authentication fails.

[0065] A counting check module is used to increase the number of consecutive login failures after the user fails the identity authentication, and check whether the maximum number of failed login attempts has been reached. If so, the lock notification module is called, and if not, the identity authentication module is called;

[0066] The lock notification module is used to lock the login account corresponding to the user for a set period of time and notify the user when the number of failed identity authentication attempts reaches the set maximum number of failed login attempts.

[0067] The device of this embodiment further includes a permission modification module. A member of the admin role or a user with CREATE USER permission can create or modify the maximum number of failed attempts and lockout duration of a specified user through the permission modification module.

[0068] The device described in this embodiment has an unlocking and resetting module. A member of the admin role or a user with CREATE USER permission can unlock a user account in a locked state through the unlocking and resetting module, and reset the number of consecutive login failures of the user account to 0. In this case, after the identity authentication is successful, the identity authentication module calls the unlocking and resetting module to reset the number of consecutive login failures of the user and clear all lock time records, and then calls the login checking module to allow the user to re-initiate a connection and request to the database server through the client.

[0069] It should be added that the limit on the number of failed login attempts and the locking mechanism are important measures to ensure the security and stability of the database. For the limit on the number of failed login attempts, the usual practice is to set the maximum number of account login attempts, and temporarily lock the account or trigger a security alarm after the limit is reached. The locking mechanism includes automatic locking, manual unlocking, locking duration, and protection against repeated attacks. The following is a description of the locking mechanism:

[0070] (a) Automatic lock: When a user enters an incorrect password multiple times in a row, the system will automatically lock the account. This mechanism can effectively prevent brute force password cracking attempts.

[0071] (b) Manual unlocking: A locked account needs to be unlocked by the user by re-authenticating the user's identity, or it will be unlocked automatically after a period of time.

[0072] (c) Lockout duration: Depending on the security policy, the length of time an account is locked may vary. Some systems allow administrators to set a specific lockout duration.

[0073] (d) Protection against repeated attacks: In the event that an account is locked, the system will monitor and record further login attempts, which can be used for security analysis and alerts.

[0074] (e) Notification mechanism: When a user’s account is locked, the user will receive a notification, which may be in the form of email, SMS or in-app prompt, informing the user of the current status of the account and relevant operational instructions.

[0075] (f) Security Review: During the account lock period, the system may perform additional security checks, such as secondary verification or security question verification, to ensure the security of the account.

[0076] (g) Data protection: The system will ensure that during the account lock period, the data related to the account is protected and cannot be obtained by unauthorized access.

[0077] In summary, the database security management method and device based on the attempt number limitation of the present invention can prevent attackers from occupying database resources by initiating a large number of client connection requests, thereby causing the performance of the database system to deteriorate or even crash the database system, by limiting the number of login attempts of users and introducing a locking mechanism.

[0078] The above specific examples are used to explain the principles and implementation methods of the present invention in detail. These examples are only used to help understand the core technical content of the present invention. Based on the above specific embodiments of the present invention, any improvements and modifications made by technicians in this technical field without departing from the principles of the present invention should fall within the scope of patent protection of the present invention.

Claims

1. A database security management method based on attempt number limit, characterized in that: The steps include: S1. Introduce a maximum number of failed login attempts and a locking mechanism in the database system; S2. The user initiates a connection and request to the database server through the client; S3. The database system checks whether the user who initiated the request has set and enabled the maximum number of failed login attempts. S4. After the user who initiated the request has enabled the maximum number of failed login attempts, the database system continues to detect whether the user is currently locked out. If so, the user's login attempt is rejected and prompted that the account has been locked out. If not, the normal identity authentication process is entered. S5. After the identity authentication is successful, the user can access the database server. After the identity authentication fails, the database system will increase the number of consecutive login failures of the user and check whether the maximum number of failed login attempts has been reached. S6. When the number of failed identity authentication attempts of the user reaches the set maximum number of failed login attempts, the database system locks the login account corresponding to the user for a set period of time and notifies the user at the same time; S7. After the lock time is over, the login authentication process of steps S2-S6 is executed again.

2. A database security management method based on attempt number limitation according to claim 1, characterized in that: Use a member of the admin role or a user with the CREATE USER privilege to create or modify the maximum number of failed attempts and lockout duration for a specified user.

3. A database security management method based on attempt number limitation according to claim 1, characterized in that: The locked user account is unlocked by a member of the admin role or a user with CREATE USER permission, and the number of consecutive login failures of the user account is reset to 0. Subsequently, the unlocked user account executes the login authentication process of steps S2-S6 again.

4. A database security management method based on attempt number limitation according to claim 1, characterized in that: Execute step S5. After the identity authentication is successful, the database system first resets the number of consecutive login failures of the user and clears all lock time records, and then allows the user to re-initiate a connection and request to the database server through the client.

5. A database security management device based on the number of attempts limit, characterized in that: It includes: The mechanism introduction module is used to introduce the maximum number of login failure attempts and the locking mechanism into the database system; The login check module is used to check whether the user who initiates the request has set and enabled the maximum number of failed login attempts when the user initiates a connection and request to the database server through the client; The account detection module is used to detect whether the user who initiated the request is currently locked out after the maximum number of failed login attempts is enabled. If so, the login rejection module is called; if not, the identity authentication module is called; The login rejection module is used to reject the user's login attempt when the user is in a locked state and prompt that the user's account has been locked; The identity authentication module is used to authenticate the user who initiates the connection and request, access the database server after the identity authentication is successful, and call the count check module after the identity authentication fails; A counting check module is used to increase the number of consecutive login failures after the user fails the identity authentication, and check whether the maximum number of failed login attempts has been reached. If so, the lock notification module is called, and if not, the identity authentication module is called; The lock notification module is used to lock the login account corresponding to the user for a set period of time and notify the user when the number of failed identity authentication attempts reaches the set maximum number of failed login attempts.

6. A database security management device based on attempt number limitation according to claim 5, characterized in that: The device also includes a permission modification module; Members of the admin role or users with the CREATE USER permission can use the permission modification module to create or modify the maximum number of failed attempts and lockout duration for a specified user.

7. A database security management device based on attempt number limitation according to claim 5, characterized in that: The device also includes an unlocking and resetting module; A member of the admin role or a user with the CREATE USER permission can unlock a locked user account through the unlock and reset module, and reset the number of consecutive login failures for the user account to 0.

8. A database security management device based on attempt number limitation according to claim 7, characterized in that: The identity authentication module authenticates the user who initiates the connection and request. After the identity authentication is successful, the identity authentication module calls the unlock reset module to reset the number of consecutive login failures of the user and clear all lock time records, and then calls the login check module to allow the user to re-initiate a connection and request to the database server through the client.

Images