Authentication method and device of hierarchical system, electronic equipment and medium

Abstract

The invention provides an authentication method and device for a hierarchical system, electronic equipment and a computer readable storage medium, and the method comprises the steps: a first database of first equipment receives a data obtaining instruction sent by a second calculation layer of a second database of second equipment through a first calculation layer, and carries out the authentication operation of to-be-verified information through the first calculation layer, when the authentication result represents that authentication is passed, the first verification password is sent to a second storage engine layer of a second database of the second device through the first storage engine layer, and after a comparison success result returned by the second storage engine layer of the second device is received, permission target data is sent to the second storage engine layer according to the authentication result. According to the invention, the authority information is transmitted at each layer of node through the first verification password, so that the storage engine layer does not need to confirm the authority through the calculation layer and forward the data through the calculation layer when sending the data, and does not need to additionally assist the node to complete the authentication operation, thereby protecting the low coupling and independence of each layer.

Description

Technical Field

[0001] The present invention relates to the field of authority identification, and in particular to an authentication method, device, electronic device and computer-readable storage medium for a hierarchical system. Background Art

[0002] In order to reduce coupling, databases usually adopt a layered design, consisting of a computing layer and a storage engine layer.

[0003] Each layer of the database has its own protocol and communication method. When performing physical replication, the replication permissions need to be determined at the computing layer, while the management of logs, files, caches, and communication connections during replication needs to be completed at the storage engine layer.

[0004] When the database is physically replicated, the computing layer needs to determine the permissions when the storage engine layer completes communication. However, the protocols and communication methods of each database layer are different. In order to ensure low coupling of the database, it is difficult to complete authentication and transmission between database layers. Summary of the invention

[0005] The embodiments of the present invention provide an authentication method, device, electronic device and computer-readable storage medium for a layered system to solve the problems in the prior art that the layered system has low coupling, the authentication operation requires frequent inter-layer communication or the use of additional authentication nodes may have poor security.

[0006] In a first aspect, an embodiment of the present invention provides an authentication method for a hierarchical system, which is applied to a first device deployed with a first database, where the first database is a source database, and the first database includes a first computing layer and a first storage engine layer. The method includes:

[0007] Receiving, through the first computing layer, a data acquisition instruction sent by a second computing layer of a second database of a second device; the data acquisition instruction includes a first verification password and information to be verified, and the first verification password is generated by the second computing layer;

[0008] Performing an authentication operation on the information to be authenticated through the first computing layer, and when the authentication result indicates that the authentication is passed, sending the first authentication password to the second storage engine layer of the second database of the second device through the first storage engine layer; the first verification password is used for the second storage engine layer to compare with the first verification password generated by the second computing layer;

[0009] After receiving the comparison success result returned by the second storage engine layer of the second device, the permission target data is sent to the second storage engine layer according to the authentication result; the permission target data is the data that can be manipulated within the permission range obtained according to the authentication result.

[0010] In a second aspect, an embodiment of the present invention further provides an authentication method for a hierarchical system, which is applied to a second device on which a second database is deployed, where the second database is a target database, and the second database includes a second computing layer and a second storage engine layer, and the method includes:

[0011] Sending a data acquisition instruction to the first computing layer of the first database of the first device through the second computing layer; the data acquisition instruction includes a first verification password and information to be verified, the first verification password is generated by the second computing layer, and the information to be verified is used for the first computing layer to perform an authentication operation, so that the first device sends the first verification password to the second storage engine layer through the first storage engine layer after obtaining the authentication result;

[0012] The second storage engine layer receives the second verification password sent by the first storage engine layer of the first database of the first device, and when the first verification password and the second verification password are consistent, a comparison success result is sent to the first storage engine layer of the first device; the comparison success result is used to instruct the first storage engine layer to send permission target data; the permission target data is the target data that can be manipulated within the permission scope obtained according to the authentication result.

[0013] In a third aspect, an embodiment of the present invention further provides an authentication device for a hierarchical system, which is applied to a first device deployed with a first database, where the first database is a source database, and the first database includes a first computing layer and a first storage engine layer, and the device includes:

[0014] A receiving module, configured to receive, through the first computing layer, a data acquisition instruction sent by the second computing layer of the second database of the second device; the data acquisition instruction includes a first verification password and information to be verified, and the first verification password is generated by the second computing layer;

[0015] an authentication module, configured to perform an authentication operation on the information to be authenticated through the first computing layer, and when the authentication result indicates that the authentication is passed, send the first authentication password to the second storage engine layer of the second database of the second device through the first storage engine layer; the first authentication password is used for the second storage engine layer to compare with the first authentication password generated by the second computing layer;

[0016] The first sending module is used to send the permission target data to the second storage engine layer according to the authentication result after receiving the comparison success result returned by the second storage engine layer of the second device; the permission target data is the data that can be manipulated within the permission scope obtained according to the authentication result.

[0017] In a fourth aspect, an embodiment of the present invention further provides an authentication device of a hierarchical system, which is applied to a second device deployed with a second database, where the second database is a target database, and the second database includes a second computing layer and a second storage engine layer, and the device includes:

[0018] a second sending module, configured to send a data acquisition instruction to the first computing layer of the first database of the first device through the second computing layer; the data acquisition instruction includes a first verification password and information to be verified, the first verification password is generated by the second computing layer, and the information to be verified is used for the first computing layer to perform an authentication operation, so that the first device can send the first verification password to the second storage engine layer through the first storage engine layer after obtaining the authentication result;

[0019] A password verification module is used to receive a second verification password sent by the first storage engine layer of the first database of the first device through the second storage engine layer, and when the first verification password and the second verification password are consistent, send a comparison success result to the first storage engine layer of the first device; the comparison success result is used to instruct the first storage engine layer to send permission target data; the permission target data is the target data that can be manipulated within the permission range obtained according to the authentication result.

[0020] In a fifth aspect, an embodiment of the present invention further provides an electronic device, including: a processor;

[0021] a memory for storing instructions executable by the processor;

[0022] The processor is configured to execute the instructions to implement the above method.

[0023] In a sixth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to perform the above method.

[0024] In an embodiment of the present invention, a data acquisition instruction sent by the second computing layer of the second database of the second device is received through the first computing layer, an authentication operation is performed on the information to be verified through the first computing layer, and when the authentication result indicates that the authentication is passed, the first verification password is sent to the second storage engine layer of the second database of the second device through the first storage engine layer. After receiving the comparison success result returned by the second storage engine layer of the second device, the permission target data is sent to the second storage engine layer according to the authentication result. The present invention receives a data acquisition instruction sent by a second computing layer of a second database of a second device through a first computing layer, and the second computing layer sends a data acquisition instruction with a second database authority range to the first computing layer. The first computing layer performs an authentication operation on information to be verified, so that the first computing layer verifies the authority range of the second database through the data in the data acquisition instruction. When the authentication result indicates that the authentication is passed, the first verification password is sent to the second storage engine layer of the second database of the second device through the first storage engine layer. When sending the first verification password, the second storage engine layer makes it clear that the second database has authority. After receiving the comparison success result returned by the second storage engine layer of the second device, the first storage engine layer and the second storage engine layer both determine that the second database has authority. According to the authentication result, the authority target data is sent to the second storage engine layer. When the authentication is completed, the storage engine layer uses the first verification password to learn whether the second database has authority, so that when sending data, the storage engine layer does not need to confirm the authority through the computing layer and then forward it through the computing layer, and does not need to assist the node to complete the authentication operation, thereby reducing the inter-layer communication steps between the computing layer and the storage engine layer and the interface for implementing the inter-layer communication design, and protecting the low coupling and independence of each layer.

[0025] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a system block diagram of an authentication method for a hierarchical system in which a computing layer sends and receives data on behalf of another layer, provided in an embodiment of the present application;

[0027] Figure 2 It is a system block diagram of an authentication method for a hierarchical system with an external coordinator provided in an embodiment of the present application;

[0028] Figure 3 This is a flowchart of a method for authenticating a hierarchical system provided in an embodiment of the present application;

[0029] Figure 4 This is another step flow chart of an authentication method for a hierarchical system provided in an embodiment of the present application;

[0030] Figure 5 This is another step flow chart of an authentication method for a hierarchical system provided in an embodiment of the present application;

[0031] Figure 6 It is a system block diagram of a hierarchical system authentication method provided by an embodiment of the present application;

[0032] Figure 7 It is a block diagram of an authentication device of a hierarchical system provided in an embodiment of the present application;

[0033] Figure 8 It is a block diagram of another device for authenticating a hierarchical system provided in an embodiment of the present application;

[0034] Fig. 9 It is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0035] Computer systems and various applications are full of low coupling designs. Coupling is a measure of the degree of association between modules. The strength of coupling depends on the complexity of the interface between modules, the way to call modules, and the amount of data transmitted through the interface. The degree of coupling between modules refers to the dependency between modules. The more connections between modules, the stronger the coupling, and the worse the independence.

[0036] The low-coupling design enhances the independence between modules. Developers only need to focus on the design and implementation of the module's business logic, which also enhances the scalability and portability of the modules.

[0037] In some low-coupling hierarchical systems, the permission management system and permission usage system are in different layers. For example, the database is divided into the computing layer and the storage engine layer. When the database is physically replicated, it is necessary to identify whether the target database has replication permissions for information security needs. However, due to the hierarchical design of the database, the more abstract permission management needs to be completed in the computing layer, while the specific matters of replication: log, file and cache management, communication connection management and progress synchronization between threads need to be completed in the storage engine layer. If there are difficulties in inter-layer communication, the authentication operation will be difficult to complete.

[0038] In a related technique, Figure 1As shown, 1. Establish a computing layer connection; 2. The first computing layer verifies the second database authority; 3. The first computing layer notifies the first storage engine layer to enter the working state; 4. The second computing layer notifies the second storage engine layer to enter the working state; 5. The first storage engine layer cannot complete the physical replication of the database independently and needs to be authenticated through the first computing layer. Therefore, all generated data needs to be forwarded by the first computing layer; 6. The second computing layer collects data and transmits it to the second storage engine layer; inter-layer communication requires the design of a large number of receiving and sending and control interfaces, which destroys the low coupling between database layers.

[0039] In another related technique, Figure 2 As shown, 1. The first computing layer and the second computing layer establish a connection with the external coordinator; 2. The first computing layer and the second computing layer verify the authority of the external coordinator; 3. Generate a verification password and send it to the external coordinator; 4. The first storage engine layer and the second storage engine layer enter the working state; 5. The external coordinator sends the verification password generated by the first computing layer to the second storage engine layer; 6. The second storage engine layer and the first storage engine layer establish a connection and send the verification password for the first storage engine layer to verify; 7. The first storage engine layer receives the verification password of the first database for comparison; after successful verification, data is transmitted through the storage engine layer. The implementation method of adding an additional external coordinator significantly increases the complexity of the system. Many interfaces still need to be designed between the external coordinator and the database, and the external coordinator becomes a security trough of the system. Once the external coordinator is forged, hijacked or monitored, it may infringe the database, resulting in data leakage and other consequences.

[0040] The following is a further description of an authentication method for a hierarchical system of the present application in conjunction with the relevant drawings and embodiments:

[0041] Figure 3 is a flowchart of a hierarchical system authentication method provided by an embodiment of the present invention, which is applied to a first device deployed with a first database, the first database being a source database, and the first database including a first computing layer and a first storage engine layer, such as Figure 3 As shown, the method may include:

[0042] Step 101: A first database of a first device receives a data acquisition instruction sent by a second computing layer of a second database of a second device through a first computing layer.

[0043] In an embodiment of the present invention, the first device includes a first database, which is designed in layers and consists of a first computing layer and a first storage engine layer; the second device includes a second database, which is also designed in layers and consists of a second computing layer and a second storage engine layer. The data acquisition instruction includes a first verification password and information to be verified, wherein the first verification password is a verification password generated by the second computing layer, and the first computing layer sends the first verification password to the second computing layer of the second database of the second device, so that the second computing layer can send it to the second storage engine layer after the authentication operation. When the second storage engine layer obtains the first verification password, it indicates that the authentication result of the first computing layer is authentication passed. At this time, both the first computing layer and the first storage engine layer can determine that the first database of the first device has the corresponding authority in the authentication result. The first storage engine layer can obtain the authentication result without going through the first computing layer, and there is no need to add an additional interface, thereby maintaining the low coupling of the first database.

[0044] In addition, the information to be verified includes the computing layer account, computing layer password, and Internet Protocol (IP) address and port number information of the second computing layer. The computing layer account and computing layer password are used for authentication of the first computing layer, and the IP address and port number information are used to establish a connection between the first database and the second database. The second computing layer only sends the computing layer account and computing layer password of the corresponding operation authority to the first computing layer. For example, when the second database needs to copy the first database, only the computing layer account and computing layer password with copy authority are sent, while the computing layer account and computing layer password with higher authority (such as adding, deleting, modifying and querying data in the first database) are not transmitted on the network, so the higher authority of the computing layer cannot be monitored or intercepted.

[0045] Step 102: The first database of the first device performs an authentication operation on the information to be verified through the first computing layer. When the authentication result indicates that the authentication is successful, the first verification password is sent to the second storage engine layer of the second database of the second device through the first storage engine layer.

[0046] In an embodiment of the present invention, the authentication operation is performed in the first computing layer. The built-in permission table is used to query whether there is a computing layer account in the information to be verified, and whether the computing layer password corresponding to the computing layer account is correct. If correct, the authentication is successful. This authentication method can ensure that the authentication result depends entirely on the permission registration status of the first computing layer, and attackers cannot break through the communication protocol from the storage engine layer to obtain the copied data of the storage engine layer.

[0047] For example, database A includes A computing layer and A storage engine layer. When A storage engine layer needs to send a replica to database B, it needs to be authenticated by A computing layer and forward the replica. At this time, if attacker C breaks through the inter-layer communication between A computing layer and A storage engine layer, it will lead to the leakage of the replica. However, by using the method in the embodiment of the present invention, even if the inter-layer communication is broken, only the first verification password can be obtained.

[0048] In addition, after the authentication is passed, the first storage engine layer sends the first verification password to the second storage engine layer, and the second storage engine layer receives the first verification password sent by the second computing layer, which is originally generated by the second computing layer. If there are no attacks or other problems in the authentication process, the first verification passwords received by the second storage engine layer from the first storage engine layer and the second computing layer are consistent. The same first verification password is circulated and gathered in the second storage engine layer. At this time, the second storage engine layer only needs to compare the two first verification passwords to determine that the authentication operation has occurred. The first operation engine layer knows that the second operation engine layer has the authority, and the second operation engine layer also determines that it has the authority. This method of confirming the rights uses the first verification password as a carrier, so that the storage engine layer obtains the authentication result. In the subsequent data operations corresponding to the authority, there is no need for the computing layer to send and receive on behalf of it, and there is no need for an external coordinator to verify the authority. At the same time, there is no additional interface between layers, which ensures the low coupling and independence between database levels.

[0049] In some embodiments, the first storage engine layer establishes a connection with the second storage engine layer, and the first storage engine layer transmits the first verification password to the second storage engine layer using symmetric encryption to ensure the security of data transmission. The present invention does not limit the encryption method used to transmit the first verification password.

[0050] Step 103: After receiving the comparison success result returned by the second storage engine layer of the second device, the first database of the first device sends the permission target data to the second storage engine layer according to the authentication result.

[0051] In the embodiment of the present invention, the comparison success result is the result obtained by the second storage engine layer after receiving the consistency of the two first verification passwords sent by the second computing layer and the first storage engine layer. The comparison result is sent to the first storage engine layer to indicate the end of authentication. The first storage engine layer can start to transmit the permission target data, wherein the permission target data is the target data that can be manipulated within the permission range corresponding to the computing layer account determined by the authentication result. When the permission corresponding to the account is to obtain a replica, the permission target data includes the replica. By establishing a connection through the storage engine layer for data transmission, it is known that the authentication result does not need to be obtained again through the computing layer, nor does it need to be authenticated by an external coordinator, which reduces the operation of data transmission in the storage engine layer, and does not require the additional design of the inter-layer interface, thereby improving the transmission efficiency while ensuring the low coupling of the database.

[0052] In an embodiment of the present invention, a data acquisition instruction sent by the second computing layer of the second database of the second device is received through the first computing layer, an authentication operation is performed on the information to be verified through the first computing layer, and when the authentication result indicates that the authentication is passed, the first verification password is sent to the second storage engine layer of the second database of the second device through the first storage engine layer. After receiving the comparison success result returned by the second storage engine layer of the second device, the permission target data is sent to the second storage engine layer according to the authentication result. The present invention receives a data acquisition instruction sent by a second computing layer of a second database of a second device through a first computing layer, and the second computing layer sends a data acquisition instruction with a second database authority range to the first computing layer. The first computing layer performs an authentication operation on information to be verified, so that the first computing layer verifies the authority range of the second database through the data in the data acquisition instruction. When the authentication result indicates that the authentication is passed, the first verification password is sent to the second storage engine layer of the second database of the second device through the first storage engine layer. When sending the first verification password, the second storage engine layer makes it clear that the second database has authority. After receiving the comparison success result returned by the second storage engine layer of the second device, the first storage engine layer and the second storage engine layer both determine that the second database has authority. According to the authentication result, the authority target data is sent to the second storage engine layer. When the authentication is completed, the storage engine layer uses the first verification password to learn whether the second database has authority, so that when sending data, the storage engine layer does not need to confirm the authority through the computing layer and then forward it through the computing layer, and does not need to assist the node to complete the authentication operation, thereby reducing the inter-layer communication steps between the computing layer and the storage engine layer and the interface for implementing the inter-layer communication design, and protecting the low coupling and independence of each layer.

[0053] Figure 4 is a flowchart of a hierarchical system authentication method provided by an embodiment of the present invention, which is applied to a second device deployed with a second database, the second database being a target database, and the second database including a second computing layer and a second storage engine layer, such as Figure 4 As shown, the method may include:

[0054] Step 201: The second database of the second device sends a data acquisition instruction to the first computing layer of the first database of the first device through the second computing layer.

[0055] In an embodiment of the present invention, the data acquisition instruction includes a first verification password and information to be verified. The information to be verified includes the computing layer account, computing layer password, IP address and port number information of the second computing layer. The computing layer account and computing layer password are only transmitted once between the second computing layer and the first computing layer. Since the storage engine layer does not need to be authenticated through the computing layer, the computing layer account and computing layer password do not need to be transmitted between layers, thereby ensuring the security of information. At the same time, the permissions possessed by the computing layer account are only those required to complete the task. The computing layer account and computing layer password with higher permissions are not transmitted on the network. Therefore, the higher permissions of the computing layer cannot be monitored or intercepted to pose a threat to the database.

[0056] In some embodiments, the first computing layer and the second computing layer use hash encryption to transmit computing layer accounts and computing layer passwords, wherein the first computing layer's permission table records the computing layer accounts and computing layer passwords that have been hashed twice. When the transmission starts, the second computing layer sends the computing layer account and computing layer password hashed once to the first computing layer, and the first computing layer performs hash calculations again to obtain the computing layer account and computing layer password that have been hashed twice, and compares the computing layer account and computing layer password that have been hashed twice with the permission table to perform permission authentication. Since the transmitted computing layer account and computing layer password are transmitted after being hashed, even if a third party obtains the transmitted data, it cannot obtain the plain text of the computing layer account and computing layer password, thereby increasing the security of data transmission. In addition, the computing layer account and computing layer password can be transmitted using other encryption algorithms, which are not limited in the present invention.

[0057] Step 202: The second database of the second device receives the second verification password sent by the first storage engine layer of the first database of the first device through the second storage engine layer, and sends a comparison success result to the first storage engine layer of the first device when the first verification password and the second verification password are found to be consistent.

[0058] In an embodiment of the present application, the second verification password is the verification password sent by the first storage engine layer. If there is no data interception or tampering in the authentication process, the second verification password is the content of the first verification password. If the second storage engine layer does not receive the second verification password, it means that an error has occurred in the authentication link, and the computing layer account used by the second database does not have permission; if the second verification password received by the second storage engine layer is inconsistent with the first verification password sent by the second computing layer, it means that the second verification password has been tampered with.

[0059] In addition, the first verification password is generated from the second computing layer and is transmitted in two paths. One path passes through the first computing layer and the first storage engine layer to the second storage engine layer, and the other path is directly transmitted to the second storage engine layer through the second computing layer, and finally converges at the second storage engine layer to form a ring authentication topology. The first verification password allows each layer to clearly identify the authentication result without adding additional transmission interfaces. Compared with related technologies, no additional steps are added, which not only improves the efficiency of authentication and data transmission, but also ensures the low coupling of each layer of the database.

[0060] Among them, the comparison success result is sent to the first storage engine layer through the second storage engine layer, indicating that the authentication is successful and the authentication link is completed. The first storage engine layer and the second storage engine layer have obtained the authentication results without the need for authentication through the computing layer or external coordinator. There is no need to increase inter-layer communication and complete the authentication and subsequent data transmission without destroying the design intent of the layered architecture.

[0061] In an embodiment of the present invention, a data acquisition instruction sent by the second computing layer of the second database of the second device is received through the first computing layer, an authentication operation is performed on the information to be verified through the first computing layer, and when the authentication result indicates that the authentication is passed, the first verification password is sent to the second storage engine layer of the second database of the second device through the first storage engine layer. After receiving the comparison success result returned by the second storage engine layer of the second device, the permission target data is sent to the second storage engine layer according to the authentication result. The present invention receives a data acquisition instruction sent by a second computing layer of a second database of a second device through a first computing layer, and the second computing layer sends a data acquisition instruction with a second database authority range to the first computing layer. The first computing layer performs an authentication operation on information to be verified, so that the first computing layer verifies the authority range of the second database through the data in the data acquisition instruction. When the authentication result indicates that the authentication is passed, the first verification password is sent to the second storage engine layer of the second database of the second device through the first storage engine layer. When sending the first verification password, the second storage engine layer makes it clear that the second database has authority. After receiving the comparison success result returned by the second storage engine layer of the second device, the first storage engine layer and the second storage engine layer both determine that the second database has authority. According to the authentication result, the authority target data is sent to the second storage engine layer. When the authentication is completed, the storage engine layer uses the first verification password to learn whether the second database has authority, so that when sending data, the storage engine layer does not need to confirm the authority through the computing layer and then forward it through the computing layer, and does not need to assist the node to complete the authentication operation, thereby reducing the inter-layer communication steps between the computing layer and the storage engine layer and the interface for implementing the inter-layer communication design, and protecting the low coupling and independence of each layer.

[0062] Figure 5 is a flowchart of a hierarchical system authentication method provided by an embodiment of the present invention. Figure 5 As shown, the method may include:

[0063] Step 301: The second database of the second device sends a data acquisition instruction to the first computing layer of the first database of the first device through the second computing layer.

[0064] This step may specifically refer to the above step 201, which will not be described in detail here.

[0065] Optionally, after step 301, the method further includes:

[0066] Sub-step 3011: The second database adjusts the second storage engine layer to a working state; the working state is used to enable the second storage engine layer to prepare to receive data sent by the first storage engine layer.

[0067] In an embodiment of the present invention, the second storage engine layer is adjusted to a working state, and can be synchronized to the database in a timely manner to realize data backup and synchronization, and effectively ensure the security and reliability of the data; at the same time, by monitoring the data changes in the database, the data modification operations can be captured in a timely manner, and the data consistency can be verified; it is also possible to monitor and capture abnormal operations and abnormal data in the database in real time, and process and repair abnormal data in a timely manner when it is input, to ensure the security and stability of the database; it is also possible to monitor and capture the changing status of data in the business flow in real time, and realize control and management of the business process.

[0068] Step 302: The first database of the first device receives, through the first computing layer, a data acquisition instruction sent by the second computing layer of the second database of the second device.

[0069] This step may specifically refer to the above step 101, which will not be described in detail here.

[0070] Step 303: When the first database of the first device determines that the corresponding relationship included in the information to be verified exists in the permission table built into the first computing layer, it obtains the permission corresponding to the computing layer account included in the information to be verified.

[0071] In the embodiment of the present invention, the information to be verified includes the correspondence between the computing layer account and the computing layer password of the first computing layer, and the permission table built into the first computing layer records the correspondence between the computing layer account and the computing layer password, as well as the permissions of the computing layer account. By using the query permission table as the authentication method in the database, the database operation permissions and function permissions can be uniformly associated by the permission table, making it more convenient. When the system performs permission control on new computing layer accounts, it is also easy to expand.

[0072] Step 304: When the first database of the first device determines that the authority corresponding to the computing layer account included in the information to be verified is effective, it determines that the authentication result indicates that the authentication is successful.

[0073] In an embodiment of the present invention, when the computing layer account included in the information to be verified appears in the permission table and the computing layer password is consistent, it indicates that the computing layer account has the permission, and the permission it has is also recorded in the permission table. According to the operation request in the information to be verified, it is verified whether the computing layer account has the permission to complete the operation request. If so, it indicates that the authentication is successful.

[0074] For example: the computing layer account in the information to be verified is "user001", and the computing layer password is "password". The computing layer account "user001" is searched in the permission table. After finding it, the computing layer password is compared to see if it is correct. If it is correct, the permission recorded in the permission table is queried. At this time, the permission information in the permission table is "operate copy", which is consistent with the request to obtain the copy in the information to be verified, and the authentication is passed.

[0075] Step 305: When the corresponding relationship included in the information to be verified does not exist in the permission table, or the permission corresponding to the computing layer account included in the information to be verified is not effective, the first database of the first device determines that the authentication result indicates that the authentication has failed.

[0076] In an embodiment of the present invention, when the computing layer account in the data to be verified does not exist in the permission table, or the computing layer password recorded in the permission table does not match the computing layer password in the data to be verified, it means that the login failed and the authentication result failed; in addition, when the computing layer account and the computing layer password match the records in the permission table, but the operation request in the information to be verified cannot be supported by the permissions of the computing layer account in the permission table, it is also characterized as an authentication failure.

[0077] For example: the computing layer account in the information to be verified is "user001", and the computing layer password is "password", but there is no computing layer account "user001" in the permission table, or the password corresponding to the computing layer account "user001" is not "password", which means that the login is unsuccessful and the authentication fails; when there is a computing layer account "user001" and a computing layer password "password" in the permission table, and the permission corresponding to the computing layer account is "read only", and the operation request in the information to be verified is "input data", it cannot be supported by the permission recorded in the permission table, which also indicates an authentication failure.

[0078] Optionally, step 304 may specifically include:

[0079] Sub-step 3041: Perform authentication operation on the information to be verified through the first computing layer.

[0080] In the embodiment of the present invention, the authentication operation needs to be implemented at the computing layer. First, it is verified whether the computing layer account and computing layer password in the information to be verified are correct. If correct, it is then verified whether the permissions of the computing layer account can support the operation request in the information to be verified.

[0081] Sub-step 3042: When the authentication result indicates that the second storage engine layer has the permission to obtain the replica copy, the first verification password is sent to the second storage engine layer of the second database of the second device through the first storage engine layer, and the management area is registered through the first storage engine layer using the first verification password.

[0082] The management area is the storage space registered in the first storage engine layer, which is used to manage logs, files, caches, communication connections, and progress synchronization between threads during replication operations. Specific operations are recorded in logs to restore data in the event of a system crash or failure. Based on logs and recovery operations, the database can quickly restore data in the event of a system crash or failure, ensuring data consistency and integrity.

[0083] For example, when the database system crashes, the database can be restored to a specific point in time. When the replication task is not completed and a failure occurs, it can be restored to the state before the replication task started, so that operations in the database are either all successful or all failed, ensuring the atomicity and consistency of the operations.

[0084] In an embodiment of the present invention, when the authentication result indicates that the computing layer account has the permission to obtain the replica, it indicates that the second database where the second computing layer is located has the permission to obtain the replica, and the second storage engine layer of the second database also has the permission to obtain the replica. When the authentication result passes, the first database sends the first verification password to the first storage engine layer through the first computing layer. When the first storage engine layer receives the first verification password, it can determine that the second storage engine layer has the permission to obtain the replica, without the need for the first storage engine layer to determine the permission through the first computing layer. At this time, the first storage engine layer sends the first verification password to the second storage engine layer, indicating that the first storage engine layer has obtained the authentication result and can establish a connection with the second storage engine layer to transmit the replica.

[0085] Optionally, after sub-step 3042, the following further steps are included:

[0086] Sub-step A1: receiving a comparison success result sent by the second storage engine layer.

[0087] The second storage engine layer sends a successful comparison result, indicating that the second storage engine layer has confirmed that the authentication result is passed, confirming that the first storage engine layer is connected to the second storage engine layer, and that it has the authority to obtain the replica and can receive the replica from the first storage engine layer.

[0088] Sub-step A2: Sending a replica of the first storage engine layer to the second storage engine layer through the management area of ​​the first storage engine layer.

[0089] In an embodiment of the present invention, a connection is established between the first storage engine layer and the second storage engine layer to transmit a replica copy. At the same time, for data security reasons, each layer of the two databases has verified the authority to execute the operation command and obtained the verification result, thereby ensuring data transmission security. There is no need to add additional communication interfaces between layers, and data is forwarded after authentication by the computing layer. There is also no need for an external coordinator to handle the logical function of authentication.

[0090] Step 306: The second database of the second device receives the second verification password sent by the first storage engine layer of the first database of the first device through the second storage engine layer, and sends a comparison success result to the first storage engine layer of the first device when the first verification password and the second verification password are found to be consistent.

[0091] This step may be specifically referred to as the above step 202, which will not be described in detail here.

[0092] Step 307: After receiving the comparison success result returned by the second storage engine layer of the second device, the first storage engine layer of the first database of the first device sends the permission target data to the second storage engine layer according to the authentication result.

[0093] This step may be specifically referred to as the above step 103, which will not be described in detail here.

[0094] Figure 6 It is a hierarchical system authentication process:

[0095] 1. The second computing layer of the second database of the second device sends an acquisition instruction to the first computing layer of the first database of the first device; 2. The second computing layer notifies the second storage engine layer to enter the working state; 3. The first computing layer determines whether the second database has permission through authentication; 4. After the authentication is passed, the second storage engine layer is notified to use the first verification password to register the management area; 5. The first storage engine layer sends the first verification password to the second storage engine layer.

[0096] In an embodiment of the present invention, a data acquisition instruction sent by the second computing layer of the second database of the second device is received through the first computing layer, an authentication operation is performed on the information to be verified through the first computing layer, and when the authentication result indicates that the authentication is passed, the first verification password is sent to the second storage engine layer of the second database of the second device through the first storage engine layer. After receiving the comparison success result returned by the second storage engine layer of the second device, the permission target data is sent to the second storage engine layer according to the authentication result. The present invention receives a data acquisition instruction sent by a second computing layer of a second database of a second device through a first computing layer, and the second computing layer sends a data acquisition instruction with a second database authority range to the first computing layer. The first computing layer performs an authentication operation on information to be verified, so that the first computing layer verifies the authority range of the second database through the data in the data acquisition instruction. When the authentication result indicates that the authentication is passed, the first verification password is sent to the second storage engine layer of the second database of the second device through the first storage engine layer. When sending the first verification password, the second storage engine layer makes it clear that the second database has authority. After receiving the comparison success result returned by the second storage engine layer of the second device, the first storage engine layer and the second storage engine layer both determine that the second database has authority. According to the authentication result, the authority target data is sent to the second storage engine layer. When the authentication is completed, the storage engine layer uses the first verification password to learn whether the second database has authority, so that when sending data, the storage engine layer does not need to confirm the authority through the computing layer and then forward it through the computing layer, and does not need to assist the node to complete the authentication operation, thereby reducing the inter-layer communication steps between the computing layer and the storage engine layer and the interface for implementing the inter-layer communication design, and protecting the low coupling and independence of each layer.

[0097] Figure 7 An authentication device for a hierarchical system provided by an embodiment of the present invention is Figure 7 As shown, the device may include:

[0098] A receiving module 401 is configured to receive, through the first computing layer, a data acquisition instruction sent by the second computing layer of the second database of the second device; the data acquisition instruction includes a first verification password and information to be verified, and the first verification password is generated by the second computing layer;

[0099] An authentication module 402 is configured to perform an authentication operation on the information to be authenticated through the first computing layer, and when the authentication result indicates that the authentication is passed, send the first authentication password to the second storage engine layer of the second database of the second device through the first storage engine layer; the first authentication password is used by the second storage engine layer to compare the first authentication password generated by the second computing layer to be consistent;

[0100] The first sending module 403 is used to send the permission target data to the second storage engine layer according to the authentication result after receiving the comparison success result returned by the second storage engine layer of the second device; the permission target data is the target data that can be manipulated within the permission scope obtained according to the authentication result.

[0101] Optionally, the authentication module 402 may specifically include:

[0102] The permission table query submodule obtains the permission corresponding to the computing layer account included in the information to be verified when it is determined that the corresponding relationship included in the information to be verified exists in the permission table built into the first computing layer.

[0103] The authorized submodule determines that the authentication result represents that the authentication is passed when it is determined that the authority corresponding to the computing layer account included in the information to be verified is effective.

[0104] The unauthorized submodule determines that the authentication result indicates that the authentication has failed when the corresponding relationship included in the information to be verified does not exist in the permission table or the permission corresponding to the computing layer account included in the information to be verified is not effective.

[0105] Optionally, the authentication module 402 may specifically include:

[0106] The authentication submodule is replicated, and the authentication operation is performed on the information to be verified through the first computing layer.

[0107] The replication right confirmation submodule sends the first verification password to the second storage engine layer of the second database of the second device through the first storage engine layer when the authentication result indicates that the second storage engine layer has the permission to obtain the replica copy, and registers the management area using the first verification password through the first storage engine layer.

[0108] Optionally, the copy right confirmation submodule may specifically include:

[0109] A receiving unit receives a comparison success result sent by the second storage engine layer.

[0110] A sending unit sends a replica of the first storage engine layer to the second storage engine layer through the management area of ​​the first storage engine layer.

[0111] In an embodiment of the present invention, a data acquisition instruction sent by the second computing layer of the second database of the second device is received through the first computing layer, an authentication operation is performed on the information to be verified through the first computing layer, and when the authentication result indicates that the authentication is passed, the first verification password is sent to the second storage engine layer of the second database of the second device through the first storage engine layer. After receiving the comparison success result returned by the second storage engine layer of the second device, the permission target data is sent to the second storage engine layer according to the authentication result. The present invention receives a data acquisition instruction sent by a second computing layer of a second database of a second device through a first computing layer, and the second computing layer sends a data acquisition instruction with a second database authority range to the first computing layer. The first computing layer performs an authentication operation on information to be verified, so that the first computing layer verifies the authority range of the second database through the data in the data acquisition instruction. When the authentication result indicates that the authentication is passed, the first verification password is sent to the second storage engine layer of the second database of the second device through the first storage engine layer. When sending the first verification password, the second storage engine layer makes it clear that the second database has authority. After receiving the comparison success result returned by the second storage engine layer of the second device, the first storage engine layer and the second storage engine layer both determine that the second database has authority. According to the authentication result, the authority target data is sent to the second storage engine layer. When the authentication is completed, the storage engine layer uses the first verification password to learn whether the second database has authority, so that when sending data, the storage engine layer does not need to confirm the authority through the computing layer and then forward it through the computing layer, and does not need to assist the node to complete the authentication operation, thereby reducing the inter-layer communication steps between the computing layer and the storage engine layer and the interface for implementing the inter-layer communication design, and protecting the low coupling and independence of each layer.

[0112] Figure 8 An authentication device for a hierarchical system provided by an embodiment of the present invention is Figure 8 As shown, the device may include:

[0113] The second sending module 501 is used to send a data acquisition instruction to the first computing layer of the first database of the first device through the second computing layer; the data acquisition instruction includes a first verification password and information to be verified, the first verification password is generated by the second computing layer, and the information to be verified is used by the first computing layer to perform an authentication operation, so that the first storage engine layer sends the first verification password to the second storage engine layer after the authentication operation passes;

[0114] The password verification module 502 receives the second verification password sent by the first storage engine layer of the first database of the first device through the second storage engine layer, and sends a comparison success result to the first storage engine layer of the first device when the first verification password and the second verification password are consistent; the comparison success result is used to instruct the first storage engine layer to send the permission target data

[0115] Optionally, the second sending module 501 may specifically include:

[0116] The monitoring submodule adjusts the second storage engine layer to a working state.

[0117] In an embodiment of the present invention, a data acquisition instruction sent by the second computing layer of the second database of the second device is received through the first computing layer, an authentication operation is performed on the information to be verified through the first computing layer, and when the authentication result indicates that the authentication is passed, the first verification password is sent to the second storage engine layer of the second database of the second device through the first storage engine layer. After receiving the comparison success result returned by the second storage engine layer of the second device, the permission target data is sent to the second storage engine layer according to the authentication result. The present invention receives a data acquisition instruction sent by a second computing layer of a second database of a second device through a first computing layer, and the second computing layer sends a data acquisition instruction with a second database authority range to the first computing layer. The first computing layer performs an authentication operation on information to be verified, so that the first computing layer verifies the authority range of the second database through the data in the data acquisition instruction. When the authentication result indicates that the authentication is passed, the first verification password is sent to the second storage engine layer of the second database of the second device through the first storage engine layer. When sending the first verification password, the second storage engine layer makes it clear that the second database has authority. After receiving the comparison success result returned by the second storage engine layer of the second device, the first storage engine layer and the second storage engine layer both determine that the second database has authority. According to the authentication result, the authority target data is sent to the second storage engine layer. When the authentication is completed, the storage engine layer uses the first verification password to learn whether the second database has authority, so that when sending data, the storage engine layer does not need to confirm the authority through the computing layer and then forward it through the computing layer, and does not need to assist the node to complete the authentication operation, thereby reducing the inter-layer communication steps between the computing layer and the storage engine layer and the interface for implementing the inter-layer communication design, and protecting the low coupling and independence of each layer.

[0118] The present invention also provides an electronic device, see Fig. 9 , including: a processor 601, a memory 602, and a computer program 6021 stored in the memory and executable on the processor, and when the processor executes the program, the speech recognition model training method of the aforementioned embodiment is implemented.

[0119] The present invention also provides a readable storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the hierarchical system authentication method of the aforementioned embodiment.

[0120] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0121] It should be noted that the various information and data obtained in the embodiments of the present invention are all obtained with the authorization of the information / data holder.

[0122] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific languages ​​is for disclosing the best mode of the present invention.

[0123] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, the various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0124] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0125] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components in the sorting device according to the present invention. The present invention may also be implemented as a device or apparatus program for executing part or all of the methods described herein. Such a program for implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0126] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

[0127] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A hierarchical system authentication method, characterized in that: Applied to a first device on which a first database is deployed, the first database is a source database, the first database includes a first computing layer and a first storage engine layer, the method includes: Receiving, through the first computing layer, a data acquisition instruction sent by a second computing layer of a second database of a second device; the data acquisition instruction includes a first verification password and information to be verified, and the first verification password is generated by the second computing layer; Performing an authentication operation on the information to be authenticated through the first computing layer, and when the authentication result indicates that the authentication is passed, sending the first authentication password to the second storage engine layer of the second database of the second device through the first storage engine layer; the first verification password is used for the second storage engine layer to compare with the first verification password generated by the second computing layer; After receiving the comparison success result returned by the second storage engine layer of the second device, the permission target data is sent to the second storage engine layer according to the authentication result; the permission target data is the data that can be manipulated within the permission range obtained according to the authentication result.

2. The method according to claim 1, characterized in that The information to be verified includes the correspondence between the computing layer account and the computing layer password of the first computing layer, and the authentication operation on the information to be verified by the first computing layer includes: When it is determined that the corresponding relationship included in the information to be verified exists in the permission table built into the first computing layer, obtaining the permission corresponding to the computing layer account included in the information to be verified; the permission table is used to store the corresponding relationship between the computing layer account and the computing layer password, and the permission corresponding to the computing layer account; When it is determined that the authority corresponding to the computing layer account included in the information to be verified is effective, determining that the authentication result indicates that the authentication is passed; When the corresponding relationship included in the information to be verified does not exist in the permission table, or the permission corresponding to the computing layer account included in the information to be verified is not effective, it is determined that the authentication result represents that the authentication has failed.

3. The method according to claim 1, characterized in that The data acquisition instruction includes: a registration request; the registration request is used to register a management slice for managing replica data in the first storage engine layer; The step of performing an authentication operation on the information to be authenticated by the first computing layer, and sending the first authentication password to the second storage engine layer of the second database of the second device by the first storage engine layer when the authentication result indicates that the authentication is passed, includes: Performing authentication operation on the information to be verified through the first computing layer; When the authentication result indicates that the second storage engine layer has the permission to obtain the replica copy, the first verification password is sent to the second storage engine layer of the second database of the second device through the first storage engine layer, and the management area is registered through the first storage engine layer using the first verification password.

4. The method according to claim 3, characterized in that The authority target data includes a replica; When the authentication result indicates that the second storage engine layer has the permission to obtain the replica, after sending the first verification password to the second storage engine layer of the second database of the second device through the first storage engine layer, and registering the management slice through the first storage engine layer using the first verification password, the method further includes: receiving a comparison success result sent by the second storage engine layer; the comparison success result indicates that the second storage engine layer confirms that it has the copy replication permission; A replica of the first storage engine layer is sent to the second storage engine layer through the management slice of the first storage engine layer.

5. A hierarchical system authentication method, characterized in that: Applied to a second device on which a second database is deployed, the second database is a target database, the second database includes a second computing layer and a second storage engine layer, the method includes: Sending a data acquisition instruction to the first computing layer of the first database of the first device through the second computing layer; the data acquisition instruction includes a first verification password and information to be verified, the first verification password is generated by the second computing layer, and the information to be verified is used for the first computing layer to perform an authentication operation, so that the first device sends the first verification password to the second storage engine layer through the first storage engine layer after obtaining the authentication result; The second storage engine layer receives the second verification password sent by the first storage engine layer of the first database of the first device, and when the first verification password and the second verification password are consistent, a comparison success result is sent to the first storage engine layer of the first device; the comparison success result is used to instruct the first storage engine layer to send permission target data; the permission target data is the target data that can be manipulated within the permission scope obtained according to the authentication result.

6. The method according to claim 5, characterized in that The information to be verified includes a computing layer account and a computing layer password having permission to obtain a duplicate copy, and after the second computing layer sends the data acquisition instruction to the first computing layer of the first database of the first device, the method further includes: The second storage engine layer is adjusted to a working state; the working state is used to enable the second storage engine layer to prepare to receive data sent by the first storage engine layer.

7. An authentication device for a layered system, characterized in that: Applied to a first device deployed with a first database, the first database being a source database, the first database including a first computing layer and a first storage engine layer, the apparatus comprising: A receiving module, configured to receive, through the first computing layer, a data acquisition instruction sent by the second computing layer of the second database of the second device; the data acquisition instruction includes a first verification password and information to be verified, and the first verification password is generated by the second computing layer; an authentication module, configured to perform an authentication operation on the information to be authenticated through the first computing layer, and when the authentication result indicates that the authentication is passed, send the first authentication password to the second storage engine layer of the second database of the second device through the first storage engine layer; the first authentication password is used for the second storage engine layer to compare with the first authentication password generated by the second computing layer; The first sending module is used to send the permission target data to the second storage engine layer according to the authentication result after receiving the comparison success result returned by the second storage engine layer of the second device; the permission target data is the data that can be manipulated within the permission scope obtained according to the authentication result.

8. An authentication device for a layered system, characterized in that: Applied to a second device deployed with a second database, the second database being a target database, the second database including a second computing layer and a second storage engine layer, the apparatus comprising: a second sending module, configured to send a data acquisition instruction to the first computing layer of the first database of the first device through the second computing layer; the data acquisition instruction includes a first verification password and information to be verified, the first verification password is generated by the second computing layer, and the information to be verified is used for the first computing layer to perform an authentication operation, so that the first device can send the first verification password to the second storage engine layer through the first storage engine layer after obtaining the authentication result; A password verification module is used to receive a second verification password sent by the first storage engine layer of the first database of the first device through the second storage engine layer, and when the first verification password and the second verification password are consistent, send a comparison success result to the first storage engine layer of the first device; the comparison success result is used to instruct the first storage engine layer to send permission target data; the permission target data is the target data that can be manipulated within the permission range obtained according to the authentication result.

9. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the method as claimed in any one of claims 1 to 6.

Images