Database security authentication method and system based on multiple factors

Abstract

The invention relates to a database security authentication method based on multiple factors. The method comprises the following steps: configuring multiple security authentication modes; configuring a mobile phone number of a manager and enterprise USB key account information, and setting an authorization code validity period; storing the plurality of security authentication modes; and the corresponding security authentication mode is called according to the sensitivity level of the data and the use scene, so that the database access security is improved, the user can flexibly select the authentication mode according to the scene and the data sensitivity, and diversified security requirements are met.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a database security authentication method and system based on multiple factors. Background Art

[0002] With the rapid development of information technology, database security has become an increasingly important issue for enterprise and organizational management. Database security authentication methods aim to protect the confidentiality, integrity and availability of data through effective identity authentication and authorization mechanisms. However, existing technical methods have many limitations in practical applications and are in urgent need of improvement and innovation.

[0003] Traditional database security authentication generally relies on a combination of username and password, which has significant security risks. Many users tend to store authentication information in plain text on the server to log in without a password. This not only puts the user's credentials at risk of being intercepted, but also hinders dynamic permission management and increases the possibility of data leakage. In an environment shared by multiple people, this static authentication model cannot guarantee the independent security of each user.

[0004] To enhance security, some database security authentication solutions have introduced two-factor authentication based on IP addresses. This method requires users to access from a specific network or device, adding a layer of security protection. However, this restriction also brings inconvenience. Especially in application scenarios that require remote access or flexible configuration, changes in IP addresses may prevent users from logging in smoothly, affecting work efficiency. In addition, if users are on business trips or using public networks to access, fixed IP authentication will severely limit their flexibility, resulting in a decline in user experience.

[0005] Most existing authentication mechanisms are static and cannot adapt to dynamically changing security requirements. Especially in the scenario of multi-user and multi-level permission management, how to effectively adjust access control policies in real time to ensure that users obtain appropriate permissions under specific conditions is still an urgent problem to be solved. Summary of the invention

[0006] In order to address the deficiencies of the prior art, the present invention is based on configuring multiple authentication modes to dynamically configure the authentication modes according to the sensitivity level of the data and the usage scenario, so as to improve the security of database access by introducing multi-factor authentication, and effectively prevent unauthorized access even if the password is leaked. Users can flexibly choose the authentication method according to the scenario and data sensitivity to meet diverse security needs. For the financial industry, bank U-shield authentication is adopted to ensure secure access to sensitive data while taking into account device mobility. Dynamic permission management combines user authorization codes with dynamic passwords to achieve temporary authentication, enhance the flexibility of permission management and control, and reduce security risks. In addition, the combination of multiple authentication methods optimizes the user experience, provides a smooth and efficient login process while ensuring security, and reduces usage barriers.

[0007] The present invention provides a database security authentication method based on multiple factors, which is characterized by comprising:

[0008] Configure multiple security authentication modes;

[0009] Configure the administrator's mobile phone number and corporate U-Shield account information, and set the validity period of the authorization code; store the various security authentication modes;

[0010] Call the corresponding security authentication mode according to the sensitivity level of the data and the usage scenario.

[0011] Exemplarily, the multiple security authentication modes include but are not limited to:

[0012] The password and verification code are combined. After the user enters the password for authentication, it is necessary to check whether the login address and / or device are consistent with the last login information. If they are inconsistent, it is necessary to call the operator's message middleware for SMS verification code authentication;

[0013] The authorization code and the dynamic password are combined, wherein the user enters the user name and the authorization code, and the database verifies that the authorization code is valid, and then sends the dynamic password to the database administrator, and the user obtains the database administrator's dynamic password for authentication.

[0014] Exemplarily, the multiple security authentication modes also include: the user enters the user name and password in the U shield, and the U shield calls the bank-related service to verify the user name and password.

[0015] Exemplarily, the administrator configures multiple authentication modes, further comprising: when calling an authentication mode according to the sensitivity level and usage scenario of the data, an authentication mode can also be selected according to the authentication mode priority configured by the administrator.

[0016] Exemplarily, the method also includes: being able to record and monitor the user's login activities and triggering a security alarm when an anomaly is detected.

[0017] Exemplarily, the recording and monitoring of user login activities and triggering a security alert when an anomaly is detected also includes setting a fixed number of login anomaly records, and directly locking the user account if the set number of abnormal logins is exceeded.

[0018] A database security authentication system based on multiple factors, characterized by comprising:

[0019] A user terminal is used to receive a user login request and provide a user interface;

[0020] Management side, used by administrators to configure authentication modes and manage user information;

[0021] Database, used to store user information, authentication mode, authorization code and its validity period;

[0022] The authentication module is responsible for processing user login requests, verifying user identities, and managing multi-factor authentication processes.

[0023] The present invention also provides a computer-readable storage medium, characterized in that a computer program is stored on the storage medium, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

[0024] The present invention also provides an electronic device, characterized in that it includes a processor and a memory;

[0025] The memory is used to store computer programs;

[0026] The processor is configured to execute the method according to any one of claims 1 to 6 by calling a stored computer program.

[0027] The present invention also relates to a computer program product, comprising a computer program and / or instructions, characterized in that the computer program and / or instructions implement the steps of the above method when executed by a processor.

[0028] The beneficial effects of the present invention are:

[0029] Improve database access security: By introducing multi-factor authentication, the security of data access has been significantly enhanced. Even in the case of password leakage, combined with SMS verification code, U shield authentication and other methods, it can still effectively prevent unauthorized access.

[0030] Flexible configuration of access methods: Users can freely choose and configure appropriate authentication methods according to different usage scenarios and data sensitivity levels. This flexibility meets diverse security needs and improves user convenience.

[0031] Adapt to financial business scenarios: Especially for the financial industry, it adopts bank U-shield authentication and uses hardware security measures to ensure secure access to sensitive business data, while maintaining the mobility of the device to facilitate users to log in safely in different environments.

[0032] Dynamic permission management: By combining user authorization codes with dynamic passwords, temporary authentication and authorization are realized, allowing the main administrator to generate authorization codes for other users. This not only improves the flexibility of permission management, but also facilitates timely permission recovery and reduces security risks.

[0033] Optimize user experience: The combination of multiple authentication methods allows users to enjoy a smoother and more efficient login experience while ensuring security, reducing usage barriers caused by security measures. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 The figure is a flow chart of the database security authentication method based on multiple factors of the present invention.

[0035] Figure 2 It is a schematic diagram of the structure of the database security authentication device based on multiple factors of the present invention.

[0036] Figure 3 A business flow chart for configuring the database authentication mode of the present invention.

[0037] Figure 4 This is a flowchart of the password combined with SMS verification code authentication business of the present invention.

[0038] Figure 5 This is the bank U-shield authentication business flow chart of the present invention.

[0039] Figure 6 This is a flowchart of the user authorization code combined with dynamic password authentication service of the present invention.

[0040] Specific implementation mode

[0041] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present invention generally described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0042] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. At the same time, in the description of the present invention, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0043] This application provides a database security authentication method based on multiple factors, such as Figure 1 As shown, including:

[0044] Configure multiple security authentication modes;

[0045] Configure the administrator's mobile phone number and corporate U-Shield account information, and set the validity period of the authorization code; store the various security authentication modes;

[0046] Call the corresponding security authentication mode according to the sensitivity level of the data and the usage scenario.

[0047] Specifically, the implementation steps are as follows:

[0048] (1) The administrator configures the authentication method, such as Figure 3 As shown:

[0049] Security authentication mode configuration: The administrator configures various transaction authentication methods in the database and maintains the user's mobile phone number and U-Shield enterprise information.

[0050] The administrator generates an authorization code and stores it in the database, including user information, authorization code and its validity period.

[0051] The administrator informs the user of the authorization code for subsequent use.

[0052] If you select the following authentication methods according to the sensitivity level of the logged-in database information or the usage scenario, the specific authentication process is as follows:

[0053] (2) Password combined with SMS verification code authentication, such as Figure 4 As shown:

[0054] User enters password: The user enters the user name and password on the login interface.

[0055] Database verification: The database first verifies the correctness of the password.

[0056] If the password is correct, the system further checks whether the user's login address or device is consistent with the last time.

[0057] Exception handling: If the login address or device is inconsistent with the last time, the mobile phone operator will call the message middleware service to send a text message verification code.

[0058] SMS verification code verification: The user receives the SMS verification code and enters it, and the system verifies the correctness of the verification code. If the verification code is correct, the user authentication is successful.

[0059] (3) Bank U-Shield authentication, such as Figure 5 As shown:

[0060] User operation of USB shield: The user inserts the USB shield and enters the user name and password on the USB shield interface.

[0061] Call bank services: The U-Shield calls relevant bank services to verify the username and password.

[0062] Certificate verification: After successful verification, read the U-shield information and verify the U-shield certificate key and its validity period. If all information verification passes, the user authentication is successful.

[0063] (4) User authorization code combined with dynamic password authentication, such as Figure 6 As shown:

[0064] User input information: The user enters the user name and authorization code on the login interface.

[0065] Authorization code verification: The database verifies whether the entered authorization code is valid.

[0066] Dynamic password sending: After verification, the database sends a dynamic password to the administrator.

[0067] Dynamic password input and verification: After the user obtains the dynamic password from the database administrator, he submits the dynamic password to the database for verification.

[0068] If the dynamic password is correct, the user authentication is successful.

[0069] (5) Login activity monitoring and exception handling

[0070] User activity logging: The system is able to log and monitor user login activity, including successful and failed login attempts.

[0071] Anomaly Detection: When unusual login activity is detected, the system triggers a security alert.

[0072] Account lock mechanism: Set a fixed number of abnormal login records. If the number of abnormal logins exceeds the set number, the user account will be automatically locked to protect data security.

[0073] The present application also provides a database security authentication system based on multiple factors, such as Figure 2 As shown, including:

[0074] A user terminal is used to receive a user login request and provide a user interface;

[0075] Management side, used by administrators to configure authentication modes and manage user information;

[0076] Database, used to store user information, authentication mode, authorization code and its validity period;

[0077] The authentication module is responsible for processing user login requests, verifying user identities, and managing multi-factor authentication processes.

[0078] By using this system, the above-mentioned processing method can be executed and the corresponding technical effects can be achieved.

[0079] An embodiment of the present invention also provides a computer-readable storage medium capable of implementing all the steps in the method in the above embodiment, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, all the steps in the method in the above embodiment are implemented.

[0080] An embodiment of the present invention also provides an electronic device for executing the above method. As an implementation device of the method, the electronic device has at least a processor and a memory, and in particular, the memory stores data and related computer programs required for executing the method, and the processor calls the data and programs in the memory to execute all steps of the implementation method and obtains the corresponding technical effect.

[0081] Preferably, the electronic device may include a bus architecture, the bus may include any number of interconnected buses and bridges, and the bus will include various circuits linked together by one or more processors and memories. The bus may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are all well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the receiver and transmitter. The receiver and transmitter may be the same component, i.e., a transceiver, providing a unit for communicating with various other systems over a transmission medium. The processor is responsible for managing the bus and general processing, while the memory may be used to store data used by the processor when performing operations.

[0082] In addition, the electronic device may further include components such as a communication module, an input unit, an audio processor, a display, and a power supply. The processor (or controller, operation control) used may include a microprocessor or other processor device and / or a logic device, which receives input and controls the operation of various components of the electronic device; the memory may be one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory, or other suitable devices, which may store the above-mentioned related data information, and may also store a program for executing related information, and the processor may execute the program stored in the memory to realize information storage or processing, etc.; the input unit is used to provide input to the processor, for example, it may be a key or a touch input device; the power supply is used to provide power to the electronic device; the display is used to display display objects such as images and text, for example, it may be an LCD display. The communication module is a transmitter / receiver that sends and receives signals via an antenna. The communication module (transmitter / receiver) is coupled to the processor to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal. Based on different communication technologies, multiple communication modules may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless local area network module, etc. The communication module (transmitter / receiver) is also coupled to a speaker and a microphone via an audio processor to provide an audio output via the speaker and receive an audio input from the microphone, thereby realizing a common telecommunication function. The audio processor may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor is also coupled to a central processor, so that recording can be performed on the machine through the microphone, and the sound stored on the machine can be played through the speaker.

[0083] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0084] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or multiple boxes.

[0085] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific mode, so that the instructions stored in the computer readable memory produce a product including an instruction system, which is implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0086] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps of the functions specified in a box or multiple boxes. Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they know the basic creative concept. Therefore, the attached claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0087] The above is only a preferred specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A database security authentication method based on multiple factors, characterized in that: include: Configure multiple security authentication modes; Configure the administrator's mobile phone number and corporate U-Shield account information, and set the authorization code validity period; storing the multiple security authentication modes; Call the corresponding security authentication mode according to the sensitivity level of the data and the usage scenario.

2. The method according to claim 1, characterized in that The multiple security authentication modes include but are not limited to: The password and verification code are combined. After the user enters the password for authentication, it is necessary to check whether the login address and / or device are consistent with the last login information. If they are inconsistent, it is necessary to call the operator's message middleware for SMS verification code authentication; The authorization code and the dynamic password are combined, wherein the user enters the user name and the authorization code, and the database verifies that the authorization code is valid, and then sends the dynamic password to the database administrator, and the user obtains the database administrator's dynamic password for authentication.

3. The method according to claim 1, characterized in that The multiple security authentication modes also include: the user enters the user name and password in the U shield, and the U shield calls the bank-related service to verify the user name and password.

4. The method according to claim 1, characterized in that The administrator configures multiple authentication modes, further comprising: when calling an authentication mode according to the sensitivity level and usage scenario of the data, an authentication mode can also be selected according to the authentication mode priority configured by the administrator.

5. The method according to claim 1, characterized in that The method also includes being able to record and monitor a user's login activity and trigger a security alert when anomalies are detected.

6. The method according to claim 5, characterized in that The method records and monitors the user's login activities and triggers a security alarm when an abnormality is detected. It also includes setting a fixed number of abnormal login records. If the number of abnormal logins exceeds the set number, the user account will be directly locked.

7. A database security authentication system based on multiple factors, characterized in that: include: A user terminal is used to receive a user login request and provide a user interface; Management side, used by administrators to configure authentication modes and manage user information; Database, used to store user information, authentication mode, authorization code and its validity period; The authentication module is responsible for processing user login requests, verifying user identities, and managing multi-factor authentication processes.

8. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store computer programs; The processor is configured to execute the method according to any one of claims 1 to 6 by calling a stored computer program.

10. A computer program product comprising a computer program and / or instructions, characterized in that: When the computer program and / or the instructions are executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images